hxxps://triovista[.]com[.]tr/Blzhnt/index[.]html

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://triovista.com.tr/Blzhnt/index.html
Sample260708-rbfbcsgs2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279928622476231"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{CC1E9E99-4ED2-4817-AB28-5F06881FA75B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3344	1884	msedge.exe	88
PID 1884 wrote to memory of 3100	1884	msedge.exe	89
PID 1884 wrote to memory of 2792	1884	msedge.exe	90
PID 1884 wrote to memory of 2792	1884	msedge.exe	90
PID 1884 wrote to memory of 2792	1884	msedge.exe	90
PID 1884 wrote to memory of 1960	1884	msedge.exe	91
PID 1884 wrote to memory of 1960	1884	msedge.exe	91
PID 1884 wrote to memory of 3936	1884	msedge.exe	93
PID 1884 wrote to memory of 4028	1884	msedge.exe	94
PID 1884 wrote to memory of 3936	1884	msedge.exe	93
PID 1884 wrote to memory of 3936	1884	msedge.exe	93
PID 1884 wrote to memory of 4028	1884	msedge.exe	94
PID 1884 wrote to memory of 4028	1884	msedge.exe	94
PID 1884 wrote to memory of 2216	1884	msedge.exe	95
PID 1884 wrote to memory of 2216	1884	msedge.exe	95
PID 1884 wrote to memory of 2216	1884	msedge.exe	95
PID 1884 wrote to memory of 1644	1884	msedge.exe	96
PID 1884 wrote to memory of 1644	1884	msedge.exe	96
PID 1884 wrote to memory of 1644	1884	msedge.exe	96
PID 1884 wrote to memory of 2484	1884	msedge.exe	99
PID 1884 wrote to memory of 2484	1884	msedge.exe	99
PID 1884 wrote to memory of 1664	1884	msedge.exe	100
PID 1884 wrote to memory of 1664	1884	msedge.exe	100
PID 1884 wrote to memory of 1116	1884	msedge.exe	102
PID 1884 wrote to memory of 744	1884	msedge.exe	110
PID 1884 wrote to memory of 744	1884	msedge.exe	110
PID 1884 wrote to memory of 744	1884	msedge.exe	110
PID 1884 wrote to memory of 2404	1884	msedge.exe	111
PID 1884 wrote to memory of 2404	1884	msedge.exe	111
PID 1884 wrote to memory of 2404	1884	msedge.exe	111
PID 1884 wrote to memory of 544	1884	msedge.exe	113
PID 1884 wrote to memory of 3552	1884	msedge.exe	114
PID 1884 wrote to memory of 2352	1884	msedge.exe	115
PID 1884 wrote to memory of 3372	1884	msedge.exe	116
PID 1884 wrote to memory of 3372	1884	msedge.exe	116
PID 1884 wrote to memory of 3372	1884	msedge.exe	116
PID 1884 wrote to memory of 3036	1884	msedge.exe	118
PID 1884 wrote to memory of 3036	1884	msedge.exe	118
PID 1884 wrote to memory of 3036	1884	msedge.exe	118
PID 1884 wrote to memory of 4556	1884	msedge.exe	119
PID 1884 wrote to memory of 4556	1884	msedge.exe	119
PID 1884 wrote to memory of 4556	1884	msedge.exe	119
PID 1884 wrote to memory of 4660	1884	msedge.exe	120
PID 1884 wrote to memory of 4660	1884	msedge.exe	120
PID 1884 wrote to memory of 4660	1884	msedge.exe	120
PID 1884 wrote to memory of 3552	1884	msedge.exe	121
PID 1884 wrote to memory of 3552	1884	msedge.exe	121
PID 1884 wrote to memory of 3956	1884	msedge.exe	122
PID 1884 wrote to memory of 3956	1884	msedge.exe	122
PID 1884 wrote to memory of 3956	1884	msedge.exe	122
PID 1884 wrote to memory of 4408	1884	msedge.exe	123
PID 1884 wrote to memory of 4408	1884	msedge.exe	123
PID 1884 wrote to memory of 4408	1884	msedge.exe	123
PID 1884 wrote to memory of 4580	1884	msedge.exe	124
PID 1884 wrote to memory of 4580	1884	msedge.exe	124
PID 1884 wrote to memory of 4580	1884	msedge.exe	124
PID 1884 wrote to memory of 1260	1884	msedge.exe	125
PID 1884 wrote to memory of 1260	1884	msedge.exe	125
PID 1884 wrote to memory of 1260	1884	msedge.exe	125
PID 1884 wrote to memory of 400	1884	msedge.exe	126
PID 1884 wrote to memory of 400	1884	msedge.exe	126
PID 1884 wrote to memory of 400	1884	msedge.exe	126
PID 1884 wrote to memory of 3936	1884	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://triovista.com.tr/Blzhnt/index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffd1b6c188,0x7fffd1b6c194,0x7fffd1b6c1a0
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,11831033384802064054,591255352868184610,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,152290559147494048,5832308453561858119,262144 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,13686138762218069569,12672811382130922018,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2736,i,7405908687449034154,16763009635330029888,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2464,i,15638617525029681187,9799293921639046029,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,9439336993292281359,5255662306839482317,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,1311498955253107056,7155800742357645379,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,2133139976638259789,2488530078853286131,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,1966730937336503257,10735741288035299225,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6830115568631155465,17916543718768096560,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6830115568631155465,17916543718768096560,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,2180587957760162097,8156729336450224477,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5712,i,2589387846283250466,9347188587487670396,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3498369632193972449,4135762474603246515,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4020817503425988061,14689303859440253245,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5443152883350471471,16899506883869224492,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6360,i,9941291950696449812,18193237327776249561,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3572,i,1753865891252174892,2559215217193062264,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6224,i,8147642287695834436,12886727960479039012,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3684,i,16257822083841270750,15409142456159104682,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,7987366044177671743,93745108176315256,524288 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5884,i,11772876986999140445,15055418356705496655,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5704,i,4895683441387821802,6262029309183601842,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=764,i,5245982402531772699,8412957937545376176,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4392,i,4867402525992935901,1520804140885849044,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4396,i,5492210258507209294,2409152187668072731,2097152 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4176,i,13444923708472998083,2534930751144328286,262144 --field-trial-handle=2364,i,14281550537373938177,11758502799548049941,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8be70a1fb67285e361cf8cdc0965cc3ca965990e64433b61e7a416925a6edfd4
MD5 0d3f2c52bf5d6388b3e9945c565bb68c
SHA1 d557918b7a8a744dfd5f621f8db27d0bf37f8ed3
SHA512 3500c318c8b781f1fdc2d5ccb61c753870d3ecbd41b2a4bd1738403c9523aecb472e565264e97545fb78fa016873d78841a64fa82d43ec9211481cf641157bd1
TLSH
T19E5150180692649EE730D231C0E01B03BE36C5F9897B8E380290E9BFD7277E79B6901C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a66c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a66c.TMP
Size 2KB
SHA256 325580830b8f982b46daa2a3408e6d0591f912dd94e91d98f22b9f61dba8765a
MD5 9bf6cc537d3e1dc39f46041fa1c40ab2
SHA1 a81fbe989c9e9c5066adaa4b49b50634b2e50acf
SHA512 3395da5c5d408225ba2b7c7a69e02f4ecab49710c203518367fbb8e7f821fc4c0afd9cc90cb3cbf8bac5fb5a505b24a799e55a94eaf955154aa0d09b125f008f
TLSH
T1B2514F180652649EE730D231C4E01B03BE36C1F9897B8E394290E9BF97277E79B6905C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 10b0de8f217341abdc6476f4a41ecff51e3dcc48925166ee65f553866ca005f3
MD5 99b2f38d6169312aa4ade1e3baf235e9
SHA1 9ff86e43ad8adddddbb11b1f93df692f0d6882cd
SHA512 7bb59f0deda752d8abd8c320b164af964c62b34fa361f6ecda7af66b88cd5f8a1b28782cac6295c41c792f35b88eb3b474ad21a5107728aa947ece39fc770357
TLSH
T107117DF7C3D5896E890116F06A28AE2BCE2D0606431C7D1985D4EF67D3E3079D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 73d2e3732cbf2903f52baa101690e523d904df81294519b7dc89f867f243a2d8
MD5 504263b209e93c13d8dc716338d67abd
SHA1 54cbe7cd3b48552f61636c294d828ab9e6a4191d
SHA512 71f43a647950136d1316da5290f4767c0900fccfcf53942f2125711103be8ded39f5dd8304bf1cbaefd3bf68074feed2ec9abb7a8ad28b0b744f135203f9279a
SSDEEP 192:sxZ0RlRf6yM/jK1Ml8MkvN/fP2sbJgZegIdpJHW6+WNGYw80yz7YeIgrJ:sxZ0RllSMvN/fP2sbiZehJHbGBs7J9
TLSH
T106420A066B34997BCCCBD209FA55BF53D6F9447292900E48A9FCDA0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4422aabe6443ab1b096370803eb21318316a05cb44740011e14cc393a5835d8e
MD5 129ba85490a37f45bfd45859254782d7
SHA1 315c0e38e0039feb4847b7133ef4e935adf1b5ab
SHA512 e93959a7b5e485721079f25a30fed096f5ee0a44c436a5fb4765c6547f85d2dcbbbab623a422a223c29b0133b368a9fe540aafbe0d14e78a9083ef9de66f54e5
SSDEEP 384:sxZ0RllSqvPvN/fP2svkCv0shqtyHbGaT+8J4G:s0Pn1/fmOgyHbG8
TLSH
T15652E806AA349977DCDBD20AFA51BB53D6F5447292500E44AAFCCB0C06E7ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 18ff9e1d1e8ba8ab3b807bfd304d9342317fbf25f17aecc3ef940cd62a72dc93
MD5 8191b59ff332542a8e5613a1531d4670
SHA1 71f7aa776005bb46a350898966e8fcb51ecbc938
SHA512 264dd010e5a17b86c02e9d55e0ef762d2f861e5f541ce3e3609155b2c3903772f58a3e28fae60db7877dfaa3d1d1b9970e5ed6f0b4ca072c0c1a7f353b53458b
SSDEEP 768:wd4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHrohBcTaA:wd4jeXmWvmKLEu1jacPLZQdUkL
TLSH
T152D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a01f75ce5c32a7965f21a438f183eaa343321ab11d18d85d128dbfa55c7ee038
MD5 33be9c54168ffd9430971025729e9860
SHA1 fd89a89ecca38d9dbd4726362104ce07bbd9af62
SHA512 7cf90d3f88c0e1be9b5a58d43ca6b1879f56dad0457c1e0934d853fb228677fb51ac9c2de8f6ac4535e2b8e688c0da9d9a6bb1daffa41c8534e8ed3c8ab7f0f3
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCdsZs2sHsDsxsk:WvdxjfAsZs2sHsDsxsk
TLSH
T16FC1E09A30BF02163D7D2509A2A4D7274F417AA37015E42B7BA940B60EA7E354CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de19032f-3444-428b-b183-498852a90086.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\de19032f-3444-428b-b183-498852a90086.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 854f0ed08ef3f78572422bc88c5e113e2686288e3c03054728968c6b235d0109
MD5 136fbee9837676244909b92e728b3d87
SHA1 8a8fe626e989d9181b650d5d584a6caba2b72471
SHA512 f8ede25cb4d9ab70230b82f1602a17226afd2dd341cea21c004956129fc51090c53fafbb6c4f1fe4fa39bb6795ec4079ebfd0857a13dba98886f2c14b9640b57
SSDEEP 384:U4tNn/s3n9SfsNmxJic5gqcl6T0Z2if+MOetB+2tFBlScjmww6EGGG5:jj+9UKjhOqBlH71j4c
TLSH
T1AF928E3768259CA75EE2919AF447362BCFF8516786C12FC4D9EC6F0D01CA6AC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 fe628c46423d1de57e217bee00c35174f2ed08e0c45b1e73fd3736e1d75e39c0
MD5 7648779f2760e09b55da5886bd4602ca
SHA1 498023317133f873a788db9d5227440993d3225a
SHA512 64c3b3bed7fc8338d47844cafe76d4fef39bb37fa7cc51a162d168846c712389c05673fc0771035ca17fec655503b85be0248524e9bc423cf9e330183c96c151
SSDEEP 384:qPlJaiF1tNn/s3n9SnmzsNmD8TUNTUlIlQic5gqcl6T0Z2if+MOetB+2vFBlScjN:sF1j+9V9wgJjhOqBlt71j4c
TLSH
T16AA26D335854C86BAEE68A96F50A3627CFF451A3C9C1AE94E6DC6F0D01C71EC130BD24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 633dcbbf7ea1e1be23efe9687bb34f8a6d8483244b27f24ffc34724320996bd5
MD5 637ac5b8fa94aa0e2c5eda5dcacfd793
SHA1 38f5bc34a1f795c88590acd4bffbe42784d385d0
SHA512 7009bb70c428349520146fc67a047ad7e6cc613cbf3137e800c7984d9efd674b5a13844111c8c15e1259a84bbaf97ba7d16ea6db13d09cf6bc7229b5e2a6ae47
SSDEEP 192:EONg6hZ0QmiUy0p0ppc/+jVqO1Qz5wOZBtT9U6:EONg6oJeppu+MOeK2BtBU6
TLSH
T1C002E73968686CB78EE2AE45F48737235FE4113BE9956F84E6E81F1D00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b06f5032c59022a495fa7414cbb7b8039c1fe9b23ef94947c834307cc33799d
MD5 edf48e4e8e1ca5a91fcb7ac31cb3acaf
SHA1 c9c7f815a5a17c7ff4934db212ffbab0aa2a243d
SHA512 68f399c866b2f94cdd6cdb674619a08d59a505138f02bb2b1f1bd414aec80f9105f64d0ddf2e57c552ad8430d003fb229d92b930754d516327592534c577ecab
SSDEEP 192:2AONKg6hZaFQmiUy070p2+c/+jVqO1QtB+2b55cOqBBqsU6:2AONKg6GjJAp2+u+MOetB+2A9BlU6
TLSH
T1C81219366868AC675ED2A551F08736278FE4512BEA86BFC0D5DC2F1C01CB6AC230AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 58ea63cde81cc28c1351338a2ed6790776d2cd06880927687ba3ea3e383ea458
MD5 a5a32c4e64c9f581355e0ea99ccaa120
SHA1 e4ed7275bf2adc07c05581e15bb66703d68e15dd
SHA512 e675df32b498e4a9ad4e4d8a3fa28fc4e04be86b36c971e8915bd91af5d3dcd7b2013edcf3c3aeedbee4f9661d6600355fc38f5daf47b726f98d9c4cd3505278
SSDEEP 384:SP4tNn/s3n9SfsNmxQic5gqcl6T0Z2if+MOetB+2tFBlScjmww6EGGG5:Tj+9UfjhOqBlH71j4c
TLSH
T1B6928D3768259CA75EE2D19AF447362BCFF8516786C22F84D9EC6F0D01CA6AC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee348512b9cae062dcae887ca7cec61243e8197b4303f8632dbec9bd4d3a003d
MD5 bcce15d7a8cfc4d5ba621ead14fb286d
SHA1 3c34939d7defd0340b2ba1d57a90db1944888f19
SHA512 81bbc8b8a46e62fb9dde1524492d45fc7a215ef0f7f1bcac2eaf442ee7b3310824f9c49018a90dd94ea56a6e0dd6893cf2174bc00186063ba5a6d062b4e06821
TLSH
T132413758AAE91109F3B76E56AFF6A86E087FB8332E17846D00110D4E0A23B41C971737
MD5 SHA1 SHA512 TLSH

Submit Download