hxxps://trivona[.]lat/d/?n=6343690

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://trivona.lat/d/?n=6343690
Sample260825-xvmsfavtes

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321586577050451"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{E00D7672-F883-4C24-A73F-5024A63643A8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
924	msedge.exe
924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3528	1656	msedge.exe	81
PID 1656 wrote to memory of 2120	1656	msedge.exe	82
PID 1656 wrote to memory of 3568	1656	msedge.exe	84
PID 1656 wrote to memory of 3568	1656	msedge.exe	84
PID 1656 wrote to memory of 4496	1656	msedge.exe	87
PID 1656 wrote to memory of 1352	1656	msedge.exe	86
PID 1656 wrote to memory of 4496	1656	msedge.exe	87
PID 1656 wrote to memory of 4496	1656	msedge.exe	87
PID 1656 wrote to memory of 1352	1656	msedge.exe	86
PID 1656 wrote to memory of 1352	1656	msedge.exe	86
PID 1656 wrote to memory of 3312	1656	msedge.exe	83
PID 1656 wrote to memory of 3312	1656	msedge.exe	83
PID 1656 wrote to memory of 3312	1656	msedge.exe	83
PID 1656 wrote to memory of 4768	1656	msedge.exe	88
PID 1656 wrote to memory of 1572	1656	msedge.exe	89
PID 1656 wrote to memory of 2888	1656	msedge.exe	90
PID 1656 wrote to memory of 1724	1656	msedge.exe	91
PID 1656 wrote to memory of 4768	1656	msedge.exe	88
PID 1656 wrote to memory of 4768	1656	msedge.exe	88
PID 1656 wrote to memory of 1572	1656	msedge.exe	89
PID 1656 wrote to memory of 1572	1656	msedge.exe	89
PID 1656 wrote to memory of 2888	1656	msedge.exe	90
PID 1656 wrote to memory of 2888	1656	msedge.exe	90
PID 1656 wrote to memory of 1724	1656	msedge.exe	91
PID 1656 wrote to memory of 1724	1656	msedge.exe	91
PID 1656 wrote to memory of 1916	1656	msedge.exe	94
PID 1656 wrote to memory of 1820	1656	msedge.exe	95
PID 1656 wrote to memory of 1916	1656	msedge.exe	94
PID 1656 wrote to memory of 1820	1656	msedge.exe	95
PID 1656 wrote to memory of 4720	1656	msedge.exe	97
PID 1656 wrote to memory of 4060	1656	msedge.exe	98
PID 4060 wrote to memory of 4632	4060	msedge.exe	99
PID 1656 wrote to memory of 3660	1656	msedge.exe	100
PID 1656 wrote to memory of 1316	1656	msedge.exe	101
PID 1656 wrote to memory of 408	1656	msedge.exe	102
PID 1656 wrote to memory of 2096	1656	msedge.exe	103
PID 1656 wrote to memory of 2096	1656	msedge.exe	103
PID 1656 wrote to memory of 1532	1656	msedge.exe	104
PID 1656 wrote to memory of 1532	1656	msedge.exe	104
PID 1656 wrote to memory of 1532	1656	msedge.exe	104
PID 1656 wrote to memory of 2812	1656	msedge.exe	105
PID 1656 wrote to memory of 2812	1656	msedge.exe	105
PID 1656 wrote to memory of 2812	1656	msedge.exe	105
PID 1656 wrote to memory of 3852	1656	msedge.exe	106
PID 1656 wrote to memory of 3852	1656	msedge.exe	106
PID 1656 wrote to memory of 3852	1656	msedge.exe	106
PID 1656 wrote to memory of 2200	1656	msedge.exe	108
PID 1656 wrote to memory of 2200	1656	msedge.exe	108
PID 1656 wrote to memory of 2200	1656	msedge.exe	108
PID 1656 wrote to memory of 2152	1656	msedge.exe	109
PID 1656 wrote to memory of 2152	1656	msedge.exe	109
PID 1656 wrote to memory of 5064	1656	msedge.exe	111
PID 1656 wrote to memory of 5064	1656	msedge.exe	111
PID 1656 wrote to memory of 924	1656	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trivona.lat/d/?n=6343690
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffb012ec188,0x7ffb012ec194,0x7ffb012ec1a0
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,10247505379403116357,3836944266037203624,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,11868501696540587326,5231361180018716694,262144 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,1636415561517616286,15412451804585019957,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,8121167999916967277,15425996772728001810,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3320,i,5089861936755519699,6522167191559832252,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17268096565659897864,17779695550683033149,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,2063406251754357537,448218592273117221,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,15489011370285876747,11057571546738156690,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4304,i,8778540205310673937,2422822312691922160,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,15841341975411555767,15047792194852825965,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,208384614871117606,7575229985623073339,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11151907001866344012,17828428120969382807,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11151907001866344012,17828428120969382807,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,8942179050644760300,10696876807659182143,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,3403238441760742967,10575507518735645260,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,14500553511278901506,10263320639869623819,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,16243085281320979339,5039847994500388245,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,17721969610037002113,15379638185612893566,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6512,i,9126192659186362826,8665118857787484635,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4708,i,7978967198633984321,758533244966850679,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3544,i,5398084093837282470,224216366104503136,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4744,i,11814013623193363534,15149942174719333098,2097152 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,2706565090855236554,15227951823639058078,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,13078364609586176409,881433027319089839,524288 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:12
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5380,i,15893561789339289256,8494255107772480334,262144 --field-trial-handle=2184,i,5634166293081297619,15000864685795817955,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ee68c4545cd29b918e404a6902e65840affc84a6b91f7fe38b01c778798c1cba
MD5 937cd95f13d1eec9771f01f3f7c81183
SHA1 bf75bbf9bbff4ee47bd8df4db70fdf0631ca243a
SHA512 87cac17b07c1f30c31d2ff561a7d7c92c83d2cbb63043c7703ed50b4ff88e5f8ac596b2bc1d96cbe67764bcf401ae9af68cc2bf8feb7310477e5d6b7d8d33295
TLSH
T10671C737FE510462E370C13078DEE107357EB19BEA976F17538468BB74367A142A6388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3f8437a8a926e4b84e25b95dfc2c8e8251a9d94b6e7e5979ebd751560d336f0a
MD5 dddcab75f5fddc40b0b4e9a022ecf677
SHA1 00fdf3e5730b19fc001af97898e653641c94cda4
SHA512 ce9a5b9c475bd70ee15750bf08b9b0597e5e6ce89737b373f78748ed108a7d503b886831a36724a33e5f8a814d406ebb50a01630e00a9b5d459f9ff057407994
SSDEEP 48:T0PWFnwc6AZjT7x9IqgsVua8Ec4LLKGuvj5I5kXatfHg:T0mnphT7x9IqvVuJEn6n9I5kXWA
TLSH
T1A481F93BED9B0011E770C13078DEE907357EB09BEA675F1753A5A8BB7436B914262388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5880d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5880d3.TMP
Size 3KB
SHA256 cc22ae71b1c4b6531761d932d982549054e8e43b76ec90c06d766da54e9ceef8
MD5 38ccb25c91e42ebcf73c63b327982a00
SHA1 ce1f9ab2431459587e82e10588c21ceb80cce15f
SHA512 6848ecccf2bbd05b4289645ee948ae96682a5fda21479ca26a8590a68e9cc557aad4485b511a854b91237057946d12d6c2e5a7987b97485f2d6a722db40498ee
TLSH
T12271E837FE510462E370C13078CEE107357EB19BEA936F17538468BB34367A142A6388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 456be50ff939c03c276972cd05ef08c54c66979fb2cec93454af9814861a0f8c
MD5 343136c44654cfd4cb3dda73081c6503
SHA1 429db23c78c232d4ddee825ac07671444aee464a
SHA512 720162c02c995c00a5a34b2036c891e1ba625ae99449ed3208d7a3bbcfc4b5471eb2fc0433ab7e0d1fdbc42c4b7cd7f0bc1e232f27a0ea55a49acf79934647fb
SSDEEP 96:DdOujuKZKu5ibbDzNulu6wGu5TZou1YDoYiMPBMBGBUNQ:DwmtZKZbfxMdHCZ/GcYiM54eUG
TLSH
T117919BF7C3E5866ED91152F09A18BE2BCE1D0A55432C3D2AC9D4EE5B93E3071E201A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 83d854f0e05e9e1e6c5a0bfaa38b8b4a8fe06977a2e0133812b44cb664220a05
MD5 a12ee347a805c275e3c2eb8dfda1915e
SHA1 6e713ccb1c106c1160378a9eb09472ae18e91d3a
SHA512 d5d8fd992a22f62e580859eab55c3a2a32d13583ba7e80ba21548f5d80b7a22fceb7500eb31bc25beffa5cd615278d2c313b9173e1019a21654de0e7ab0a846b
SSDEEP 96:DdOujuKZKu5ibbDz0uNu52ou1YDoYiMPBGBKKugUNBwjGg0MQ:DwmtZKZbfwiT/GcYiM5eKKJULuGBv
TLSH
T1D991ABF7C3E4866ED91192F09A14AE2FCE1D0A55431C3D2AC9D4EE6793E3071E10165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9c827ba1a293d4198a8c7e922cfce554c5370d8162dfb547a4a301109e6dad3c
MD5 41222ff73ad508ca1782549e3864fb73
SHA1 bc4dfe72300b4e980068c94a5b2cde446b13de88
SHA512 65d7f8ca36453aaf80d3908c7679e77111f4af34e782d5a8be5cdcfd93f0fb03aacb1d8a2e276df0a4c01dce174abe1e9fe431ad25efff0d98e22c116f5441f4
TLSH
T160D02223220130F5AAADBE81806AED8FC72741610C82EDE624D0A89A0A315AC0607240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59265a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59265a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4b655f12f9f0284a63ba77d4e88cdb9d590d78add8c786c10952da97f907c06c
MD5 20c252238aa40a81c51d38f16b5535c1
SHA1 15c9d30b50c535ec1ca062893be9f2900d7ed74f
SHA512 3f5e419edf4d41f72806a1e7e52e9e35e3caf837a045499bc80a1b0858ab0cf57e7e50f720103392206cb419021a4b649452d8610415a39d1b181ad69cb9848d
SSDEEP 192:sxZnRiyM/jK1Ml8UQRFS/f9s0IAjIdpiJ3ca4/x16+WND/iI/vf89Y051JvDIg5W:sxZnQqXS/f9s0IA83/Ud8951k
TLSH
T1B262E746A6345E77CCDBD209FA51BB53D6F9147291911E88AAFCCA1C00E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3f36286f20cd79529f261b7b10510ef63ba91fc0ad05fbc3c1adb15d899348f7
MD5 0d0b063b1075d01b9a66bd9bc6114ba8
SHA1 b7ae79e6983623355e14bb991466fb27890617ba
SHA512 43941aec787c01dab0ca7efc8700a3004cf62e9224fc54ba5f294e65d2d33141617df42ae5617fddb6b83311e19d2bbe64c961746691e9b8377103eec32bdeb2
SSDEEP 192:sxZnRiyM/jK1Ml8MFS/f9seIYsIdp8Ps/W6+WNUPoDD/Y05Ls6+DIgrJ:sxZnQdS/f9seIY1ys/bqGD/5xe9
TLSH
T1F952E8116B346A77CCDBD209FA55BF53D6F90472D2941E48A9FC8A1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 7036ba6ab96d8d9815939c530746bca9138065d417ac95256a4eee336d24f554
MD5 8dd18d42981ba09abe0bcd657bb035a2
SHA1 b3e6fe471d429fa15aa609be9a3a1533ff2bf2fb
SHA512 050a928b91725e3b47229e25f151fd2e273e2a5994a9ea5c2df9f35226d637bb532fb0c16f475043a89b61a28d3f966a5574088c6d2a189b9a24b3506e3e8ed5
SSDEEP 768:dMzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hRtro0X:dMzXl8pZ221WRmsYQL0u1jaKu/Lpd8hx
TLSH
T1C3E20A3F244CCB7E4F844EACEC266F966ED801CBA6984D5447FA494C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a7fa5c637f2717feefe9ef31d6d862752729e09f145a09378268294366148d6d
MD5 04e7449df8686915862e62b88b944fac
SHA1 9e38a1af0c4b19c97f6d50a0dc0073857a61e607
SHA512 5d2d8b2a2fda08a08db7c0a7aae63b481bb8a55485f5900c5ff51d6bfc10b846c54dfb6609c84e1f427f65aa0b942438b2a388c2dbd169ee81c5784ab937c281
SSDEEP 96:K+98hdDbb+drKlz9+K7Lzn+v19yXNfqyoKTCI8AKxiSR:Ob3k/R
TLSH
T1FB91624372FB06126C7E2A0996E28A575B4171A330A8ED3F37AD10F51EA6E510DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

978fbc8b-d891-479e-9911-41026a901bcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\978fbc8b-d891-479e-9911-41026a901bcb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fd7d05a3db525faf29ce105ac2d7190d84c05fa5058536fd1f814b48e78ca3c2
MD5 cd9babfbf9a270db12fdac31e2d93c7d
SHA1 9355b3bad6ef51a04ef78c944a035cf8bcd959b2
SHA512 83acc57c8547184023c946172abc0577bd6c818161a7edb4f3fcb1c21bccad2172ccdb14f69e3a4640aa94ba9f27fa6af4f574133e7a7366907412619b1d7450
SSDEEP 384:/ZcIh8NrHATEnAGtK/HiDtw+HBbsD4Kox:XhTEo/+twgrK2
TLSH
T1CF828C7298B89CBB5EE2D155FA4736035EB8806B97CC2F54D0ED7B1C04EA5E8131BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c00b133f347c0ee088f5ab2b93dd110c8cb980bdaad5ce9c20363875626fa87e
MD5 db0efeb26e7a542e0628306a1a4fe0ba
SHA1 5901f8ace9fc90e4c589d118b3cd593dd6dd1478
SHA512 cbf609bfa0c97acc5efc474f07c5fd720a9021dff574c3d6c39859dd9a9b0930aed2acceda4a2f37cfd8f2b0dbc41778a1b458611865ad47d4d019427a4f49fe
SSDEEP 384:AiFiZcIk8N18TUNTUlIlkATEnQ2tK/Hi1Zw+HBbsD4Kox:bFQkIwgDWo/SZwgrK2
TLSH
T18BC208F248D7897AD9AE8747B77E3D024E7CC067B5846A54B3D8561CCC964BFC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fecf2f982a72a3b2625c6696aab274a8fd1563290d163988b1be63fe8a303eae
MD5 a907b43f56df5b0636405c5511446f58
SHA1 5473e3ffa2ea2a3ddb56b5b816f0e4fa3656b1fc
SHA512 2e9ea551f3e5c43b44ddc98c40635953227504f8bca04c81c6a673bdbad9b3253130bb8f9d6846af7ca95a28c24c35a229426feb57a333a007071d101e6cef9a
SSDEEP 384:AiFhZcID8N18TUNTUlIlgATEnQ2tK/HiUew+HBbsD4Kox:bFpDIwgTWo/XewgrK2
TLSH
T19BC208F248E7897AD9AE8747B77E3D024E7CC067B5846A54B3D8560CCC965BFC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4e7eff21b1d8edea56624f5b2e4965d3544f636b07348043b53caf21e1b40854
MD5 427e573bc270c5bc2aeab6893d363e23
SHA1 b9bb17e85dcc7719c37266ab13356b4b639bbe86
SHA512 a3bbd630dd01dde1bdd64eff9f365a866a995ec3392f848bb3146eaa14b5b8ad6b036467fed3c34d21532ca9717bd3f727901f351dff2c77fb2537aad064cf3c
SSDEEP 384:pZcIh8NrkATEnAwtK/HiDtw+HBbsD4Kox:hhEGo/+twgrK2
TLSH
T1E4828D7298B89C7B5EE2D155FA4736035EB8806B97CC2F54D0EC6B1C04EA5E8131BC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bfbd7d19b2b50388c49e0f9bec3655611ea8cb1ce7aafd441832dceb016b0f91
MD5 bc06b076d55502d28bea76cb05129652
SHA1 de53b539acd71d9798614249341486c4222ea898
SHA512 73d4e8632418c77cabb41fca09b3f68f726a54ac44ba7d1e9ae79297b9feae0060fa95811043132f6d9b20d53cd904dbb640e3a81f5b2c2f48c744e3e621c5f3
SSDEEP 192:uGN+6fNVQmiUyxSRvL/GPTFXR8irYBV3ZuqMU6:uGN+61zQovL/HiCLwU6
TLSH
T178121931E8A8AC3B4ED2A964F54736179E64416BDB896F55D6EC3B0C01EF59C130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c27503937bc6e1042666523ca178f76d25947d44e4ec0c0b5b610aec6a38208a
MD5 582628b58459c471b9effcd801527557
SHA1 e75311b04988c6cfe1cb7383d3bcc5848778bde0
SHA512 20874ab21d1fa49808eae7c1b18ffc428696be9ab206bb1c87c2d54945974276ec50bc9d0a7431b685edc176bfb2402714db9933700b273a9339c4e16810b6ee
SSDEEP 192:7GNb6fNNQmiUyyzHRPL/GPTFXRrV7qEBU6:7GNb61LNzxPL/IU4U6
TLSH
T1FC020935BCA86C7B8EE3AE59F58737179FA4206B9A951F44D6E82F0C00D769C1306C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 487e2c4bbf5cc9a7ed2dc89179b2efb89ad5d8cabbcacb8f21ae8d8578e543ef
MD5 e2eee849de1610879764e4e319849664
SHA1 17a4d452a25d63f8b497cd0e36c9278d8852e1ad
SHA512 d15123fc216b226b5400345da4cb2ae908bd428bcb92f98ef3d45b72ca6dc7df3ef40eb9021c9b8d78edfc22726900dbc0ebc45441c875d960ea8ef05327f0a1
TLSH
T1DFE00202D72040EFC13C03744483572037D2C060116943875A1165A43C163011E30A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 55618f83cbc70f8fa3d7f4762f9b0f6ef3f3dd2a8af2814ca104c371c8e8c47c
MD5 034e2dd33a19592fabcff73f4e6dcd08
SHA1 1f1af977aa6be5c087dc3ae07d717437d28bf05e
SHA512 da927f56a404f48d4363cedffd9a07957d6ed42d6d60af356d131b477556804fda3265c3038f43deb03e10d6f23152ae868fc24bfb8dec4c0dbe9be8d716dce9
TLSH
T154E00200D510007BC03C03704483571037E0C04012A64386511111A42C163011530E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59116b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59116b.TMP
Size 392B
SHA256 bf0de3530214716b0ebe6e8beb72a71af2ea209030cbc2272f4485c9352fb9d5
MD5 b582db4e5c0bef7cbc69ff4bfdca098e
SHA1 80607161370bc8711d73057e586cbe1226173505
SHA512 dd1ba44e099914c0672082c45019f7f42d0a7a3c939ccd55f2eb7fdbd739f3e008e2924bc4403c5533fb3e9ee57c2af34429529124c72b02179feebf3e610d14
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download