hxxps://www[.]twitch[.]tv/

Resubmissions

24/08/2026, 17:41

260824-v9d3qsaq9t3

24/08/2026, 17:40

260824-v83ppsxtds3

24/08/2026, 17:39

260824-v8p4lsxtcv3

24/08/2026, 17:38

260824-v7ypcs1fkb3

Analysis

user interaction
yes
max time kernel
898s
max time network
890s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.twitch.tv/
Sample260824-v83ppsxtds

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320668448214118"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{5B01C01C-EBA5-4324-9123-16C9B62462D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2820	1828	msedge.exe	86
PID 1828 wrote to memory of 5044	1828	msedge.exe	87
PID 1828 wrote to memory of 3840	1828	msedge.exe	88
PID 1828 wrote to memory of 5044	1828	msedge.exe	87
PID 1828 wrote to memory of 5044	1828	msedge.exe	87
PID 1828 wrote to memory of 2060	1828	msedge.exe	89
PID 1828 wrote to memory of 2060	1828	msedge.exe	89
PID 1828 wrote to memory of 2396	1828	msedge.exe	90
PID 1828 wrote to memory of 2396	1828	msedge.exe	90
PID 1828 wrote to memory of 2396	1828	msedge.exe	90
PID 1828 wrote to memory of 5000	1828	msedge.exe	92
PID 1828 wrote to memory of 5000	1828	msedge.exe	92
PID 1828 wrote to memory of 5000	1828	msedge.exe	92
PID 1828 wrote to memory of 2348	1828	msedge.exe	93
PID 1828 wrote to memory of 4676	1828	msedge.exe	94
PID 1828 wrote to memory of 2348	1828	msedge.exe	93
PID 1828 wrote to memory of 2348	1828	msedge.exe	93
PID 1828 wrote to memory of 4676	1828	msedge.exe	94
PID 1828 wrote to memory of 4676	1828	msedge.exe	94
PID 1828 wrote to memory of 4132	1828	msedge.exe	95
PID 1828 wrote to memory of 4132	1828	msedge.exe	95
PID 1828 wrote to memory of 4132	1828	msedge.exe	95
PID 1828 wrote to memory of 3132	1828	msedge.exe	98
PID 1828 wrote to memory of 3132	1828	msedge.exe	98
PID 1828 wrote to memory of 3132	1828	msedge.exe	98
PID 1828 wrote to memory of 2408	1828	msedge.exe	99
PID 1828 wrote to memory of 2976	1828	msedge.exe	100
PID 1828 wrote to memory of 2408	1828	msedge.exe	99
PID 1828 wrote to memory of 2976	1828	msedge.exe	100
PID 1828 wrote to memory of 4924	1828	msedge.exe	104
PID 1828 wrote to memory of 812	1828	msedge.exe	106
PID 1828 wrote to memory of 812	1828	msedge.exe	106
PID 1828 wrote to memory of 812	1828	msedge.exe	106
PID 1828 wrote to memory of 4132	1828	msedge.exe	109
PID 1828 wrote to memory of 4132	1828	msedge.exe	109
PID 1828 wrote to memory of 4132	1828	msedge.exe	109
PID 1828 wrote to memory of 5000	1828	msedge.exe	113
PID 1828 wrote to memory of 4788	1828	msedge.exe	114
PID 1828 wrote to memory of 2704	1828	msedge.exe	115
PID 1828 wrote to memory of 1204	1828	msedge.exe	116
PID 1828 wrote to memory of 1204	1828	msedge.exe	116
PID 1828 wrote to memory of 1204	1828	msedge.exe	116
PID 1828 wrote to memory of 600	1828	msedge.exe	117
PID 1828 wrote to memory of 600	1828	msedge.exe	117
PID 1828 wrote to memory of 4260	1828	msedge.exe	118
PID 1828 wrote to memory of 4260	1828	msedge.exe	118
PID 1828 wrote to memory of 4520	1828	msedge.exe	119
PID 1828 wrote to memory of 4520	1828	msedge.exe	119
PID 1828 wrote to memory of 4520	1828	msedge.exe	119
PID 1828 wrote to memory of 3240	1828	msedge.exe	120
PID 1828 wrote to memory of 3824	1828	msedge.exe	121
PID 1828 wrote to memory of 3824	1828	msedge.exe	121
PID 1828 wrote to memory of 4696	1828	msedge.exe	122
PID 1828 wrote to memory of 4696	1828	msedge.exe	122
PID 1828 wrote to memory of 1712	1828	msedge.exe	123
PID 1828 wrote to memory of 1712	1828	msedge.exe	123
PID 1828 wrote to memory of 1168	1828	msedge.exe	126
PID 1828 wrote to memory of 1168	1828	msedge.exe	126
PID 1828 wrote to memory of 1564	1828	msedge.exe	127
PID 1828 wrote to memory of 1564	1828	msedge.exe	127
PID 1828 wrote to memory of 1564	1828	msedge.exe	127
PID 1828 wrote to memory of 1468	1828	msedge.exe	128
PID 1828 wrote to memory of 1468	1828	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.twitch.tv/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff80d4ec188,0x7ff80d4ec194,0x7ff80d4ec1a0
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,16892716768205557850,4080026800623765698,262144 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,5576100122697461260,89044807558482522,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,12801913730831028261,9911492879508302637,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,11661966676664907324,17568662779474269853,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,10736196748889973444,1059942509565558536,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13094571396350011136,2477638378133549472,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5990445280863073053,13877080462228179228,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,10483230943695786505,2745935489317014319,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5284,i,16148887339328105289,17236892567246591181,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,14942536231117475074,11125731387497656830,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,16569967941893011367,9074591463074554671,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,14218295231185649439,1419048261815039874,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,14218295231185649439,1419048261815039874,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6188,i,1064707781470793274,2007087725221991206,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5300,i,13097561944019699924,11529923800113447144,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,13146737812048122677,17164423657717124887,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,1108754030763712546,245757000081065152,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,409983537682802977,4928403869097753375,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4840,i,5434807994807870545,7783297517970293361,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,11554106106002523838,10766815465898564908,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6350035388993895571,14639672103348509282,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5416,i,2505195426855470887,17962047552672799500,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,383192808169408216,5796302137895207988,262144 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,16463677578710291153,3424507162140164819,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,8632531529120347503,11651720987195442720,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16413677157151917248,8575444780319963231,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,3363124139134768500,7846167748377763925,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6364,i,42305123642991597,3027485147017667237,2097152 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,4915076118202701894,11825756880094538393,524288 --field-trial-handle=2348,i,4243813885284192116,3402497260594146216,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 564B
SHA256 109dfd50ff5910b467b264b293f46d88f1ac2302aa51e10608e6678c4e76d2be
MD5 f5510d1bee42e8571b2edff44a7fb78a
SHA1 269d2d4e1b424359ba243d3635a0dbc16c7e868c
SHA512 c100e06a3ae27255257a85e50d22b4ef565c687484423aacf198d2111edd880c2c300a9b1004f8d486a7acbfdfb67173b02d9b3f8b1ab8dcfa1d1108fbbeb949
TLSH
T1EEF0F68A93C8C2F5EA46E1CB915C67389192B38DEF88EDFD2A08BDC8649104152551E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4eda6b5d616f2923f891df567012037ae6ff659a0903d1a33b1e812643f5a3c7
MD5 cafa947e7323838e52946e3d56eef2ef
SHA1 bec1b8486dc55d7315db4bcc119493278c09f88c
SHA512 eaef0af720fdaf25e41740430861c64eb9bf2279904746a087bf745e85d72b6589409a21b06cb0517e72ea9d0c1b259abb1219102e1a66339ca20e0b816e14b9
TLSH
T174E0208405CCC2FD9504648751D8AB4CC250378F96C4A9D55714CD94310204473BB9E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7fe9efd7b698c8cf88894a1a7b2ac4d5bb44cb8af9eba3a6d5c2fa365ceac872
MD5 61d585011b8b54b4cd3dedccf29555f3
SHA1 afaad93cacd27f9914527a97808594f9c64b20b6
SHA512 b3cb55f406ede667f0d844c46fcbce87bdaa4169f78ccb9560f08af5f999d699b591585486390ed35a0ce514a290307e5a7278c7cb9c3823b0f5f2d439727766
TLSH
T1B0E0268817DCC3FEE618ECC792B8730DC280370ED2C8ADDA6F00E8843101540AAE25DC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 07a6b795b66ac17e13b438aeb451b05c0a1f9bb6b94487c2e8759c4404a85dce
MD5 4438dc9f44f586a76d274e802d3c5489
SHA1 94bc8b50aa185628dcb6f3915f413c10b3f9907c
SHA512 3cd9fd73f03023830e0710b2bccaf2be417ec2c24d03e91e15d94b549c9882e505e741adf7f530dd1307a155dc3fff9d9acda44cee14524a65a054dd6cc82778
TLSH
T17A41FCB4363242C7D349133160D176D235FA81530B036F1236A46677EA257E6F7F6218
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21ea44dd1f88246a333108cb43393caa166b4a7b903e04c52e96210eed2781fb
MD5 677f4d51cbfcfa76244204fc067423e1
SHA1 036e7c77236aa196513db34333242345a64dcfbb
SHA512 341cfa9ad237a3780e96da37e6c88434af5adea02cf976b81f31ff3adcda88fbcf63064b305ca2ff5baed79fafa5005320849c3c2b460cd0b4964153fd7065bd
SSDEEP 192:sxZN/yM/jK1Ml8MWA/fDsblIdpm1MHW6+WNGY4wnMhIgrJ:sxZN7uA/fDsbWlHbGv9
TLSH
T1D442D811AA34AA7BCCDBD209F9557F53D6F90473A2900D44A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e590290defc29077b5fbe4eb4f0aaca86ad5147a02f73cff3577dafb1d5e89bf
MD5 829e8b77ceaf4b913b0f265a9b6e037f
SHA1 b5a1cd5a69dbdf5c69d40247aef81c648c809323
SHA512 d4f62dacdde16a9ddca117417d137808eb02375a03f19065635aaf63eef63e8c42d6c5692164bae42e6a1e0169a9e9c8d8fa18a342d87f7eac1befbb934be71c
SSDEEP 192:sxZN/yM/jK1Ml8UQCWA/fDsHlIdps1MHW6+WNGY4JAfhIg55J:sxZN7qdA/fDsHWrHbGsR
TLSH
T17C52E716AA349A77CCDBD20DF9517F93D6F9447292900E44A9FCCA1C05E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2900912c69c20fb0b26c1c40849a5e42e95fda0ae28833d939febe25bd008a26
MD5 3c3853ae61f877f8c00ed3df0976b3f7
SHA1 a860660665b1726c1b65c30f41c3f1c1846bed40
SHA512 5b5496ff22d0837c74997081d6d1059f0f7f15d983b4137ca413e7d9c9e2868f4007b635edd70f0dee6ed3437884291100b0cc6609fc6550b73506da960faac0
SSDEEP 768:Xf8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdUroskOUni:Xf8iJPNWvx76ru1jahALocd/WUi
TLSH
T186D20A3B680CCB7E4F845E9CEC266F966DD801CB6B948D5447FA880C03C76EA51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 069241924f6a886056c810771e28088760b169a8002e223c14877ff0af816aec
MD5 843accc15236039ca4d1d98d73658d20
SHA1 bb1db20361ff8df6cda55d0e9d7df521b6d7c75f
SHA512 f6dce5b0f5875ba5bdc01192667fcd380a41aac06b6f2fde4eeb23b6d1441a0ff11ef1f0623f63d7285490da9c517a97d91acc4cc677295ae850c462eb9d719c
SSDEEP 96:KPVZuKSYimz2Kg8LWIKHKyylUJ1vL/grjuzttgK11tXg59te3g:GA5BL/ylUJ1vL/SjuJth1tXa9te3g
TLSH
T186C1030673BF16032D3D251CA2E08B274786B1B37058A42BBBA914B54E66E351DFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a42ae64483f6e3c87e3a75cb3ec5d9ed8d47b2bbafd11340b276028086b688e2
MD5 a925aad26b3cc6ed027789f277b5ba4d
SHA1 9171ba9dd5e56f78930ecfe81c8245f3e24a5032
SHA512 90731f3c0f8026e2dfc740fa07bf4c66c18985f8ace3c07d24e6fb4e3d80f0c78429bfc7d45d5a999facb729190559403e8a8732a39240e2c4f715ebe75d0584
SSDEEP 192:sLsNkEQYCimFvQmiU1Uaw4k03HHK8EFeLIKqmUI:KsNkEaXh/kOHK/FzeUI
TLSH
T1FD3228316878BC7A9DD3A555F48737135FA8502BDB882FA4C5EC561C05DF298230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 260bfde291be2ff15e09e449470dae311501d05fb96af58818348297540fb8b2
MD5 e9709f0e94217dca477857a16ff4f6a0
SHA1 d189302cd9f5d2b8091c25a8ee7ba9661d9e4675
SHA512 e3756f02e4bb2e6c5b58a8e3257abbd9521e93f2134495a56cda4769ed243544fa3c3d0543267574fdf091a65a84668a8d3f281921b8f0f301280d2a0eb445b7
SSDEEP 192:+s1sNkbQYCimFvQmiU1Uaw4k03HHK8EFlHIKqmUI:tsNkbaXh/kOHK/FueUI
TLSH
T1E04218316878AC7A9DD3A555F58737135FA8502BDB882FA0D5EC571C05CB298230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 030aafd4c7ed2906021b7be8e0a342fcc10b69bfe59597594dceb6c2d436801c
MD5 0ac27b1cb0bad4726e2eaba8f6c5a84b
SHA1 b94c096af12efa4c12fd6c63aee43e1b28e165cb
SHA512 1f6bacc369bab4f9c2a2d97581a7ed675988399ab7b3693ea746078364831be2e2bcce71dcef03822ba1334f0a5705fe02d717f6c1b65b9b3039187920a09424
SSDEEP 192:FLsNkbQYCimFvQmiU1Uaw4k03HHK8EFeLIKqmUI:5sNkbaXh/kOHK/FzeUI
TLSH
T1ED3229316878BC7A9DD3A555F58737136FA8502BDB882FA0C6EC571C05DF298230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 276023bc10089ca9ca1baa7862603dd3d31b33b98fddf48cf2c3f3b10dff57e0
MD5 0429730ab5fd3e7ab830fecdb3088d75
SHA1 a03ef013b16eb7425a53e88c6ef414c20fb8627a
SHA512 5fe6c3a6e4e44c5c203bef19114d6f6959da8888dbd4f2b56bde41db1ebc5f00224680568918390a51fe467d62323953e56097021411f5cf5942826bacca011b
SSDEEP 192:+s1sNlbQYCimFvQmiU1Uaw4k03HHK8EFrwIKqmUI:tsNlbaXh/kOHK/F9eUI
TLSH
T1234218316878AC7A9DE3A555F58737135FA8502BDB882FA0D6EC571C05CB29C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8e5dc910034edf5bd3a5ad958574ace289730df9e3270bc9e72ef99d3f8d85a8
MD5 f99f10a6f620ccfc023bbff3ae561938
SHA1 5bf39d5b66c36e8a534cb1832d51b723ef445984
SHA512 228dc3b482db5f67469ee3dd1bda271d4e3629836b3c45833a07329a29f388c98e2eb43312b44c1b09f5cc56b2120227596d638fff47f6922c1bbfcc5f054a69
SSDEEP 192:+s1sNkb/YCimFvQmiU1Uaw4k03HHK8EFrwIKqmUI:tsNkbVXh/kOHK/F9eUI
TLSH
T123423930A878BC7A9DE36555F58737135FA8512BDB882FA0C6EC171C05CB29C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 98a78ac02551fad938525cfe07afb734dd9550f8143d5e13147e1920622a84c5
MD5 c37a0997af8c6d9f322450cc0d980b09
SHA1 5f8a836130f2e56d515d9878ca8e4f66f113a773
SHA512 908aa873a78d1656de95ad32878272e5c5863b4f911f7ea8e24242519890665e3c6225a5004169fa1bfc9ce23d2ea8a6e5b1d02a852c8b5a4f6f53f5509e3a8b
SSDEEP 192:+s1sNkYk/YCimFvQmiU1Uaw4k03HHK8EFrwIKqmUp:tsNkPVXh/kOHK/F9eUp
TLSH
T1DA422931A878BC7A9DD3A555F58737135FA8512BDB882FA0D6EC161C05CB29C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f9539d346fab622c81f4ffb2a3a82548b89e3e78c0dedf2963cb940bf3b2dbd5
MD5 51bdf23822a47b800304804eaea19b0e
SHA1 c7557208b78045d9aef872f55a4981e0baae4da2
SHA512 54db9378b67e70c744955996d76b262d0275d7b066a9c559e64c3f67b5c097f5460bb71732298e5f85cc5c89c46771be558afea34c3a9c0a38aeb435020a1fa3
SSDEEP 96:ZqONkNQsjpfmUTmDK5ih/cIPURHl8h4otop5m5DwBhPwivh50xy0SFYKkAxvYysd:gONR6kDfQmiUyA0Z903HHNQiX5U6
TLSH
T16302E835AC786CBB8EE3AE46F44737175FA5112BEAD52F94D9E81B1C04D724C1306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4861e45b50397b9ce487a7662ce3d1e005c208b4f6dc35bbb5437d2070ae839
MD5 0a7b6b99f60e654bb8fbb93cbf8f3a30
SHA1 6a584b9ddeb2877ea0fc01a2c7c86ed2997a64e4
SHA512 b34c2e935d591039c1f587cb8e1ff37e7eb034c534b7293ff9d976aa8af06087f588ac11ee0ab2a0a17569cc94d5bc23856514463c26e5acf4117bc55218d073
SSDEEP 96:4qONklQsjpfmUTaK5ih/cIPURHl8h4otop5mYDwB9Pwivh50xy0SFYKkAxvYysHm:jONV6knQmiUyR0d903HHK8EFZcRKqmU6
TLSH
T1FB121731A878BC7B9DD3A852F48736135FA8912BEF896F91D5EC261C05DF198130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bdbcae4-8a6a-4aba-98a0-1b9efa06bce2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7bdbcae4-8a6a-4aba-98a0-1b9efa06bce2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 881148e455bc73114e34c9226533fda7bc3c10c86cd90cd68f10d583f9a5b4de
MD5 ec348e7c301b6d353c6cc260cf323773
SHA1 55d334a98ede45f153c8c75d0aa5a7ad2d10e719
SHA512 9bc6b537e71c0f369b6aaeb35595e0e24f8147f72f9c7f29b25b782cd339fb56bc26eb9de5240b3e16e2e7a661fa22607f197389fa394b423b60b17ea3b5b6d6
TLSH
T145412B5CBAFA1108B3766F0A9BF6A86E487BB9372E46945D00110E4E0623B40D871B73
MD5 SHA1 SHA512 TLSH

Submit Download