hxxp://mrexcel[.]com

Analysis

user interaction
yes
max time kernel
38s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
10/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mrexcel.com
Sample260710-ssftwset4s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281705950260338"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{822955F1-D1DB-4DE9-9FF1-D349CE14D833}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1568	3664	msedge.exe	86
PID 3664 wrote to memory of 4488	3664	msedge.exe	87
PID 3664 wrote to memory of 1476	3664	msedge.exe	88
PID 3664 wrote to memory of 1476	3664	msedge.exe	88
PID 3664 wrote to memory of 1476	3664	msedge.exe	88
PID 3664 wrote to memory of 3804	3664	msedge.exe	89
PID 3664 wrote to memory of 3804	3664	msedge.exe	89
PID 3664 wrote to memory of 4520	3664	msedge.exe	90
PID 3664 wrote to memory of 4520	3664	msedge.exe	90
PID 3664 wrote to memory of 4520	3664	msedge.exe	90
PID 3664 wrote to memory of 1804	3664	msedge.exe	91
PID 3664 wrote to memory of 1804	3664	msedge.exe	91
PID 3664 wrote to memory of 1804	3664	msedge.exe	91
PID 3664 wrote to memory of 2836	3664	msedge.exe	92
PID 3664 wrote to memory of 2836	3664	msedge.exe	92
PID 3664 wrote to memory of 2836	3664	msedge.exe	92
PID 3664 wrote to memory of 1148	3664	msedge.exe	93
PID 3664 wrote to memory of 1148	3664	msedge.exe	93
PID 3664 wrote to memory of 1148	3664	msedge.exe	93
PID 3664 wrote to memory of 2308	3664	msedge.exe	97
PID 3664 wrote to memory of 2308	3664	msedge.exe	97
PID 3664 wrote to memory of 2308	3664	msedge.exe	97
PID 3664 wrote to memory of 4368	3664	msedge.exe	99
PID 3664 wrote to memory of 4368	3664	msedge.exe	99
PID 3664 wrote to memory of 4368	3664	msedge.exe	99
PID 3664 wrote to memory of 3900	3664	msedge.exe	100
PID 3664 wrote to memory of 3900	3664	msedge.exe	100
PID 3664 wrote to memory of 3900	3664	msedge.exe	100
PID 3664 wrote to memory of 1880	3664	msedge.exe	101
PID 3664 wrote to memory of 3884	3664	msedge.exe	102
PID 3664 wrote to memory of 1880	3664	msedge.exe	101
PID 3664 wrote to memory of 3884	3664	msedge.exe	102
PID 3664 wrote to memory of 5040	3664	msedge.exe	104
PID 3664 wrote to memory of 1176	3664	msedge.exe	105
PID 3664 wrote to memory of 1176	3664	msedge.exe	105
PID 3664 wrote to memory of 1176	3664	msedge.exe	105
PID 3664 wrote to memory of 1332	3664	msedge.exe	106
PID 3664 wrote to memory of 1332	3664	msedge.exe	106
PID 3664 wrote to memory of 1332	3664	msedge.exe	106
PID 3664 wrote to memory of 2720	3664	msedge.exe	107
PID 3664 wrote to memory of 2720	3664	msedge.exe	107
PID 3664 wrote to memory of 2720	3664	msedge.exe	107
PID 3664 wrote to memory of 4748	3664	msedge.exe	108
PID 3664 wrote to memory of 4748	3664	msedge.exe	108
PID 3664 wrote to memory of 4748	3664	msedge.exe	108
PID 3664 wrote to memory of 3816	3664	msedge.exe	109
PID 3664 wrote to memory of 3816	3664	msedge.exe	109
PID 3664 wrote to memory of 3816	3664	msedge.exe	109
PID 3664 wrote to memory of 404	3664	msedge.exe	110
PID 3664 wrote to memory of 404	3664	msedge.exe	110
PID 3664 wrote to memory of 404	3664	msedge.exe	110
PID 3664 wrote to memory of 4416	3664	msedge.exe	111
PID 3664 wrote to memory of 4416	3664	msedge.exe	111
PID 3664 wrote to memory of 4416	3664	msedge.exe	111
PID 3664 wrote to memory of 2776	3664	msedge.exe	112
PID 3664 wrote to memory of 2776	3664	msedge.exe	112
PID 3664 wrote to memory of 2776	3664	msedge.exe	112
PID 3664 wrote to memory of 4392	3664	msedge.exe	113
PID 3664 wrote to memory of 4392	3664	msedge.exe	113
PID 3664 wrote to memory of 4392	3664	msedge.exe	113
PID 3664 wrote to memory of 4172	3664	msedge.exe	114
PID 3664 wrote to memory of 4172	3664	msedge.exe	114
PID 3664 wrote to memory of 4172	3664	msedge.exe	114
PID 3664 wrote to memory of 4024	3664	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mrexcel.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ffc09fcc188,0x7ffc09fcc194,0x7ffc09fcc1a0
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,4493090227163039123,1657792847800790928,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,3256986791429426584,6661612601186233871,262144 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,7852735176638471479,5294238736033736127,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3306530070875142390,6614722800940759244,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,142937120394349856,2266056597583161887,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,269393476058406739,7083904754700061165,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3752792254352405924,6763595442523178669,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,13964926006387743091,11676300663204314991,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5284,i,15551720603949437963,17235670964636501356,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3508,i,7090500782263739009,143239867749137755,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2413406571384042334,14729736988663394177,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,8391496439149020346,13978033794537765903,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8989275841717055020,17281329654487972343,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8989275841717055020,17281329654487972343,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3696,i,13181618387315965900,3508061259352930265,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5252,i,17193129293892817149,16086219995697426739,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5376,i,10963458977806908290,12771689231060412864,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4112,i,8690727719919468492,9561220119604257137,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7008,i,5911085033819236094,15314011767250524344,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6812,i,6277420877588085876,6407242712675266457,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4980,i,9180479342817916756,13196145858146834941,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7336,i,8449933588013153819,9674958942937697407,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6800,i,7540728393894081963,5274585130260655849,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7680,i,3643281038920022004,11074028483352815993,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7852,i,8667779358886788654,7705442738202079132,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4376,i,1346281555889707273,17083455774038560318,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=132,i,4910340300826868401,16116047309824373892,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8132,i,1045528479381533064,2695746551317712865,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8280,i,3336822513530720947,13818810484056570669,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8456,i,16187928210242600940,546324157984310933,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8568,i,4310154298901796791,15005302701135415081,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8720,i,14353803578148344195,11210525958811216896,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8856,i,3225640454044656525,6205033254661343512,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9200,i,14611890714429598587,11988793212279537039,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9360,i,1928837129413417242,9663363251583281865,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9492,i,13452175315108291661,14481246942427147391,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9700,i,15615837671647705008,832281738941184531,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9916,i,7072721902461608449,5908245250337375016,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10012,i,9725414134122439768,5607044011619905841,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10216,i,6766470861389833609,4350728296207506900,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10384,i,6495436264563615040,15576919749633179351,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10504,i,3267026562226311065,769788898039428957,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=10500 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10680,i,7326152924868948542,3369568004967708628,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=10692 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,163348392477657148,18169611511278738446,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,13588288937968928141,7497092596673612265,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16632861457951561456,18386761049078844319,524288 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5380,i,15774201417271319287,13543711329634204943,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7428,i,12374703220192343133,3083632510069918295,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5188,i,7537688202990908355,8880959730425276610,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5552,i,17991279197907529014,2752303688701010742,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7308,i,1256899477428906515,11819547497656986087,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9916,i,12847533707056087453,17225114896737633819,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4496,i,11081747751840428574,9554451946224668244,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4524,i,2879670604880422395,8075760423871285177,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7540,i,10940066544173346573,2224420193515902802,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4308,i,4990984255284888225,340223358651111766,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=6796,i,7362867798018736927,4233380855631523912,2097152 --field-trial-handle=2064,i,8406451943377916502,13105177074432309736,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 110KB
SHA256 e99f73320040647739f498f01c58a2de9bf8b2004c0d162ab1e12d373f877b7a
MD5 3ce0e3ed94e5b852b23536e3575e40e2
SHA1 cb08fc13d66cd8b71569e4124be910556128dab6
SHA512 0a2ba843d1d85682c9b8e752985f479c08fa81b06d315259091e7e50a921064f693b2811d32129b16ad104d1e3b40f8e66da8be85d1a9957fb056ade5e4f2fda
SSDEEP 3072:hu1Mxfmb++1JfvZIMqAvFj2rB20V7hK6YVXC9Tg5JpNSku:wKh+3XZIMqeYB201I6bg5du
TLSH
T1F7B312C573BD8B60A895E974C87049869F60EB6972018A7D9955378FF3B2BD3B0C2703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 49KB
SHA256 9156e50b0899e345d361bc1107e1ee89f5cbae870463f4829d0a14bd26a147c0
MD5 fc39c51daf8797392ad660e4dd223126
SHA1 0bcb30b2c1fa10544cae9378d43793fdcafc240f
SHA512 57015e888896d81ba0965f2193a008551c83b3787a1ea1d1f267109357132df761150fe7f578b716fc5cdbedb162b51c502f103e6ae4fac5ae539cd600764dfd
SSDEEP 1536:5jtjDYUOu0fQSniSYZ0IiRRhh75QFr4fhhU+IrEwGIF:phJ50FiDZPijtfw5rzZ
TLSH
T12C3302EB7E8DDA9E1E22063282A24427EEE52C736DC7ECD2111C56C59A8C4725D03FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 55KB
SHA256 75d165ec8f314655b1e9f1aaf6f1fa49d80bcd52ce44ea223e0b625724f3e3fc
MD5 0aedf87fd7790dde45dce1718900e871
SHA1 adf34cf3d9327a8345c60bc48de601625517ba40
SHA512 ea5ca5bae5c6df0afdd6670994b89d57e1b06fb327fcb20324ac0dc0ae13e7f80dab0fff2fbb14afbc849feb5f91379801249effe8ec5bdae0d1e812c0403127
SSDEEP 768:GgSTpBnD4zds775SPw4fyOm0lZOsWpTD4yPJN1k3ghFhtfvWQ6/9e8lQQFxzlKOO:xSFBDOmSPweE0lZIlk3gnX5eVFLdi
TLSH
T1524301F4CF9392B844F634240F2725B7560D9EADE952280A272B44EBB51E1E8C9136DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 22KB
SHA256 0d570d7d93dabc1569df1b78bfb0f72fa259cb76ee29bbd51e34b82bc8582558
MD5 5610a3b9b64da7be674c9f7ec0bb4fb6
SHA1 734eca16ee9a36daa1d73cb75a4000763c8b8d25
SHA512 8577317af72823ba8fc3a08981a3bbe902782881f64a18faeb0c3979f1b4fc9ecb1efe2c69f4fef7dabdf8f50abf6e69928568a14d65eda0a168aaf4ad0ee454
SSDEEP 384:PrqoXOdsERhTCr8yt3bd6gSSUEsE8q/Bfbnc+mbg//sf3PUVWPwjPTir:b0swB03J67SUtcBfb5mbc0HQir
TLSH
T14EA2D02FE4448845C786503AC7EE74127F3836C23A585980A7A94E26C976A3CD8868FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 40KB
SHA256 87cfe2ed0f8d8851ca869f7f49d60d8b975a824bacf39cbeb42c1a320a3be2d3
MD5 a2658339276b4da2cc9d083f35902b1e
SHA1 faa13fd68c2b3d0934006132a87c3d3980959566
SHA512 c4f59e70630256a3f0839c4e7ed65f060b5e7ec28eefc077ea0693e74100bfc9f03c961c916a2064276c09025bd43cd064c5b7396d71f745df7253cf1b3089a1
SSDEEP 768:vJYwQ+a0m8evq/oYR25pUG+LwhZo8FnM1sNjsM:vJPRa0mIcYG9hxFMO
TLSH
T1EA13E135E1F42A5E0AD9F9E383B4D35492C5FA09E7C5D802F9FD2F56BB1002319E6268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 32KB
SHA256 faf2d8c1009071ffa5edd1d77af544b608d0c7fa6798bce4814b1f2109847e8b
MD5 ceeaf797063c001073abbdb4a1551fc2
SHA1 ba431aab81424128c74082c8ef9c20d8fa091f23
SHA512 93c1244725eb4ac048fdc3b859063ab649aade8f1a9747252a09d3f2d8d0ae0861aa5ae68e495c0c69bb2821bf2c5c34290d7b23bfd0ed591c03f7146ba8d575
SSDEEP 768:4KKyksY8BxnzrMZeHaMkjaXl7HTQyq3xzxEB:IyXY8P/+MRXOF3EB
TLSH
T157E2F16CD700399A469674EF4C31CB4579BA09C94AE38DC80FDE3E3D3D18C60E975921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 33KB
SHA256 7abfe476c726b0f672e06213279a4c15e0a32540898ce47ec9d902f3971c3036
MD5 494b9cbb001ab8dfb8dfa6ba0ef350ed
SHA1 bcfeabaf6961c0b3663a0b7a645b4456d91c55b2
SHA512 5a6d9b25f478ecb3d3925468ee832b5a64a756175d7dcf88074dbba66b95618cba70a897e770d9aa1f63cea7dfce85a6cd2399a8976a6b68b8b0ee09ad03e8ed
SSDEEP 768:HfP9ZsfeENuSK37Mr7zVKJzw1o2Zf5mpc1kzt0uHRMi1nXHl4:HdZsR0OPslIo2ZfIKK0SMYXO
TLSH
T171E2F20480A11815F085DBB40762BAC05EDA631A3D897D1DD7490EFBFBE0F5BB21698D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 54KB
SHA256 e53d920f14c794608ee1de2157296d955c0bf5402afc564dacd1fd489aecdcf6
MD5 f0a9723138b4c3146ec9228fe4708dca
SHA1 b1eeff02968699a8773701a2f229907ac0102478
SHA512 e0a6db16e490dba5bec2e84a4bf08341c60d5dc5a914a200f398d3e4b1dd4ab92c934ece12db54054d1991b674adfa711002366f601f54d62fd637c240b9e7f4
SSDEEP 1536:2AmgoLdtJJdWrK8UBwD5R2AK6y2t68waUTvpBPEMA:H/oLdtpjlGD5yO68FUTvwV
TLSH
T1F74302AE008AA1BF790A32D2F5BFFB59C985DF3AD40079397517884AB067031592E3DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 75KB
SHA256 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
MD5 af7ae505a9eed503f8b8e6982036873e
SHA1 d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
SHA512 838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892
SSDEEP 1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2
TLSH
T17D7302E63B6C4943E03D6460708ABE9F104B3AB42FE057E5C876DB7F2722992B71552C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 30KB
SHA256 f68464a53079c8044829cbd174602d3e8fc85f9bae4933298cfac78842393b74
MD5 cf6f72a1ab13b9674de00b5306c32342
SHA1 b2b90fb2e3ede484b630b3f808647ee5d59b70cb
SHA512 8d23292284daa8bf6177b5925f995c9e3be7df8dc04b817f66ed564a15b719c7fb552189734fd4cf5f3a47a0ecc934b47d0cee4db6306075f19ec6d7fb293237
SSDEEP 768:Q4k3rDZpzgtrB/wET/+dT1hFA4wnEV9FwsRiU8D8KH:+f7cxen1hFA4wmT+UiH
TLSH
T1C5E2F15A3D6A5F29EFE149D7A217829AC1346E034AFFFA1BC128D50C79225C7038F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 73KB
SHA256 5f66ef35f19e1bc8bfad52e2139ad510998e759dbb99d825f7876b8c3cdbdee6
MD5 3cacf51428fa145226351f4db893235d
SHA1 e65afd58ec5d9e1aada6996d71482ddcf9f9827e
SHA512 20df0266b4f3f351d860c174140c8f8f730a97b47f4e1fcf71e28503e03a460ff6df97614e48142bb52ff71e5d4d285da3c6401330287a50d7cdfa551448d23e
SSDEEP 1536:kkCI+9iACUcDsSByHXFtZiqVU3/+hnVVtRq+1z0hpTI+AuXkx+R+jy:W9BtcDRyVt8gnVVtRq+J8TI+XUxlG
TLSH
T1AF7302753BBF4E1A45D6FCC453E344184BF578AE6D65EE9F62A3C90EE831C46C00A292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 35KB
SHA256 57ad3bc69c218a19cc3f44dde72302f0c9731f36fdc0d3f8ec3e781925b529ed
MD5 070d7d3386c1c8c50764eef60a294de6
SHA1 d2ecb8d07341b919ef86416d2d89c8c7e4659b75
SHA512 9921b6139eeb7ed515a3de9e62882a6c3d26b3b87c9330985f33ddaec02d8877ced0f61a0df5c0184c65506980eab74c53354f23bdb823e7dda5c846c71ff11c
SSDEEP 768:xWZEZmISDMaa3XrrkytF16QDZ8pZC/71aU6q1FryHd4C:xWOZmIOG33kUF16xpZIav0F1C
TLSH
T156F2F15D6E5FDFB2A2C0F802F0B2042D43C219B456E287ED6602773B1DB8C99B650FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 21KB
SHA256 f27a6476b305b02df8a847aaef823b24781a3554f64d77ecf67b68d69092a013
MD5 20a6461d829e5dadef107f9077c952b4
SHA1 7656eaa4a104b9b19b1f3d5925e457687d350905
SHA512 6463734a05aa5f19a94d3650025da20e88ef04d64541a7980e8915ccb79727ec04d99c14f2709c7eb0537b8eb025053650dc7b9a0c954f8a141c6d07a844f005
SSDEEP 384:I9oPSZpeRAto0IVm4Y+ziPMguUd0HfNGAUY5Ty9QJOfg11T3uVuQ1cVLHIRS2a0G:hIeRXZm4Y+OEguUdMGAXW9Y113uYQ1+5
TLSH
T104A2E086779268AFCF7B63B38444B2B8F09B9F0F60863F4A445514876CEB5FE8048E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 30KB
SHA256 0901163e94730600df4a0bc5996eb8e0533770435f24c5c5c8e95774d8bbe783
MD5 599ba11ee2c425bd425a3312cf15babb
SHA1 b0129b2a0a253a4ca495da89268ae267481222e9
SHA512 72a7774e39ced522f8c2bf950746e16db4dc30910e31e0623effa7ec02b81735e8944caa592cd3e77ea3bc9c068d1805e7416f29ad162794efb28847d336dfef
SSDEEP 768:gb1qMQOlPz2g0NSaAMXDwGPJHOar0YELyzTy:M1qMQOrMTAkkGhHOar0YBfy
TLSH
T1EBE2F148405729C87DF73522C13871D8FA3586FE4A6539A24F81B436A4E196F8C771F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 202KB
SHA256 7e45c5fbcb20d315532a39503e70ea6113eafe708d5af9226a171798f2740a84
MD5 f2c85c72041d8d23090271eb3a9e601b
SHA1 ef5de9f11adae76d0f76f54a8b4e0ed168301b29
SHA512 00fc67186e62144140115d54b76ce09c359212db54a5964190945bfadd144cce72462835aa82b7a52c3ae9854fa303b3400c80cd454baab56a9e8d07a151b380
SSDEEP 3072:sG8437MOw/CkBpnLjdvSADUTeWdGM8GFvpS+XFCUTUi26xIdZcUd1cvN:P7Q/CkPjh3OvmGpiUTUi8dZVovN
TLSH
T148142204599B03E216C062CD9914E4BDC628F8CBFC9BC0BED8EC60F9EA63575C6579A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

336a68eaaf209f48_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0
Size 309B
SHA256 35ef171c471e90cdc8f6175618e4e547581628f451569ac120f4c485acb5043c
MD5 9767594e41069269685bd7ecd68103a5
SHA1 5a3dc53d0a1e9f06390f047c51ef09614547fd7e
SHA512 0e081adf830b586a0564728954902f35d3d7b586f6c1c84e1582112352d652d23d2264c4a475bab6d3cac60c13e5ed53d2bf166ff2a35d9920839c6d8c363251
TLSH
T172E0EBF3501C0A32C8B60DB29E6803BE833392F92CC29D8A0001A01228260BC93C2232
MD5 SHA1 SHA512 TLSH

Submit Download

409531521c2683cd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\409531521c2683cd_0
Size 3KB
SHA256 1bf1d389b81c490b2a1aa92d667897a4fa1c51e58951996b771db7f4a429980a
MD5 faece2798ed96e6cb03b21df0a64a6b9
SHA1 d66d5833086c9c0c6fe2581fdfc1a37e39bcc6cd
SHA512 c3d4330d4fae197af6fc92e70690e23b73253a4e33cdf41c50c9830dd69ae6095457b8439a75e7b72127b34ac6663efa874ebd418fa3c0be5474669febad431f
TLSH
T1C87183EEA344971DCB3253F912529226A33680087FD38B2350C1EB762D842F7699FD4D
MD5 SHA1 SHA512 TLSH

Submit Download

86e4ea748ab23abe_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86e4ea748ab23abe_0
Size 316B
SHA256 82c715ecf940fdea109522dbc58e0380ebce3e9edf852747eded408a5e520dfc
MD5 d67272623916a42ba3c03158c5541657
SHA1 acd4774bc1ae75fea110b50406b0676814eaf250
SHA512 330a61bf23d8c8565942a7d7fc82163ab1ba3a1a365fb2d1de4cc5754a02a440db55ab263f1d3b548287bf038d7ccaaea8e8a15e713ce4d7863b33f0e3a04e1a
TLSH
T15DE072F7200C240CC2F762B0C3EF136FA25B10644D23404EA001A19A3B1CBBAB2C3125
MD5 SHA1 SHA512 TLSH

Submit Download

b021e9a5fa6db3c0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b021e9a5fa6db3c0_0
Size 250B
SHA256 b3e2eaf41ebac4b8c416a70eaca3441813562783e3330dce0b7820660dd222a0
MD5 a668b2d0a0afe23d2034afa7c8e3c3c3
SHA1 e619402a86fa7609872111341dba199cfb54402e
SHA512 fa82017970a0058344da6fb51cc42377303acb3edf19e535b5efca59e2a55c604ba53003ba564aab1af518e31a843bfb1dd449309bc5433e7622c792a2a05d45
TLSH
T145D097E300563440DD66C5F1C3BB191C838701882C66F2600861F12E3F3D0B0A3A3EB9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 006714043dc9a3cd25820733ee4b936f7b5c539bd1b1b3d661aa2405114ae5d0
MD5 4e724c9920ba6eed4410bf7056c05e1b
SHA1 5ab06cd1186908861cfedc3a9395981c870a8dd5
SHA512 204ec96497c9d7e366cebcaed7b87a799188ff782a5bed3f2e5413fdf4c96e3d3fe69e41bdfc968a15f38d875a933df3dfd6dda2e4a74845ba17f7600b8cf451
SSDEEP 1536:rfEEixdvNdb6GZqW3b5PDuVhpBHExvoZsV62UHPq:YZv30maUUC
TLSH
T17EB36226D6A64C2B01F12264EC754383F325436F9286A82F3A7C5D5C2FBD93A6542F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3402083c929294e205ab700af6a5d40c599a6c980785d8fec57a24346af798c1
MD5 70ae9464f03b01b84ba1226a86a74d12
SHA1 1138112dd9442324da8c1c67ec4edd677f0c0bf8
SHA512 587152c5c9e9004761108712ed3c4cfb5c619de34ad8a77ca9f9e1ee014d5a43908e0ee674a3ebae29193c4e2b8cdc33b24e5bf8058bc4caa22d203d8ef7866d
SSDEEP 192:sxZKA/ya/KOMl8MkE/fDsHNZIupebF6HW6+WNDdFegn/Yw4QPXIgUoJ:sxZXsME/fDsHNVE6HbD/N/jUM
TLSH
T15552B5166B34997B8CCBD209FA55BB53D2F5457292940E48EEFCDA0C05E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 acebb157ca037b5c45bbe094d999962ac1769fe744d156bf11d0ed049714f238
MD5 f6c4bda87b7844f62d021cc3e8857e14
SHA1 11803eaa05a39f589c5b049fc94f31c4e598d380
SHA512 fc02046c20062970904bf2e0ba9739c67b39a57c8cd4bd71802834e0e7f7c48816fbe06cc6855383fc878003bdeb50cbaf89f7cdae85fa96d414ec9d64e6ccaa
SSDEEP 768:fS4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dEroh17ay:fS4jeXmWvmKxEu1jacPLZQdPJ
TLSH
T1AAE2093B280CCF7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 21ff36c0e5c646fb8c317185291bff5e8a5989d4abe513d5f31dde4dc5901b79
MD5 a3afb456f5adea0cac428681644ae722
SHA1 8b9a30b512aac1354111a57c27ef0fdaa0b06230
SHA512 1030974ee8f121a806af94b2a4d963abb18070ae44a4a8a877a70a5ed34d8dee5fdc99b8a04ef4db430573b4033fc32bc661bd3c6496b2d50ae8a5fe0e78300e
TLSH
T1DEA002A0F1971B4DC1540FB9619BD6403210EC100981420AE1E5498A8C691488121614
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d7dfa6359bc94a9f4d82ac70649e9edb6f79734c5ee7f54ffa28c2752443c219
MD5 c6b8a44cfaa300a2fed574998c99ff41
SHA1 9e4d88404a18ba124da6c19ef5a0ac471c84b7a8
SHA512 6781cee098f3549a2d2d3413ed7fc71d64818216f4def0050e7812b755715df36e899238b4bb90e906b37031cfa5a83d64c73cbf9154add1cb3db2c13cb0f85e
SSDEEP 48:K4jIdKcE4TyxmIfKrS4Ki9GSo0AkQ0bPIbKkKOBmgk6y0N7oy5yo:K4jSKcE2SmUKrSYTyKskuz
TLSH
T18F914F023ABA03413C7E690881A19B67868275737018E96B7BE914B69F27F204CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 81d47175c484e1fc741f77e4bbdc1e22204cca2aeb6de49e858d98b17f235d87
MD5 b52ec9d3681dec681fb0661fc12c67db
SHA1 c9c5ea18a1ab47de708dc36cc44dd787824defcc
SHA512 e7d5a270ca83c8a7b6f019e7c6b8d15754e199d323667f2daec71f2814eda0d76aaae24b708fd0600ec3764e36cec34012177fa79c4197054df3e506557d9cfd
SSDEEP 192:EONE6hZ0QmiUyQupc/+jVYkjzortY65wOZw9LU6:EONE6oipu+m08tYB2MU6
TLSH
T13202DA35A8786C7B8EE2AE45F48727235FE5112BA9956F84DBEC1B1C00C769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9b28b40a5436d5a412984b308fe45865c46abb71fa13efa1c9efa8b48db115d2
MD5 b8177c9f2dadac32d8ee799e271fdd94
SHA1 6f9fe19e2217e45dcd005ceca9de264c1755160c
SHA512 bbb554f6e7635ce33fb3d83c461f9654a1b07741fde6eb0eafa20fa346312b77241f31105868234df9b97b930c9dd661434d65f14ff730254e42da0a69fca9d3
SSDEEP 384:itNn/s3n9SfsNxBHej0HJ+If+m08tYiKXIxuWHFBtOObjI9G6w7j:ij+9UieY4QVVSGuWl729Mj
TLSH
T13E929E326829AD7B48D2D655F04736179FF8516FABC92F88DAEC6F0C00DB6AC1306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c950818def7b6e52549164cc1fec7723080c80f61d384e5b1cd4fe149a4c08d
MD5 93d008e324ec4a1f7a1d0e7c94c16cb6
SHA1 a7c3832275b7e88646a195480175484fd7cde9c0
SHA512 213a162e145891d966d130e0d225e6092e12fcc7584ddd788f706043ec49431afa24b4e5ff17594c8c41ca1931b31a3dce51a6cd2defa8d37a87373f001c7721
SSDEEP 192:eON06hZjQmiUyAu4c/+jVYkjzortYiKXMFuSuW15cOqlqQtU6:eON06hE4u+m08tYiKXIxuWw9BtU6
TLSH
T10412EC36A468AC7B5DD2A545F08732235EE5511BEEC97FD4E6EC2F1C00DB65C234A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a5966fa08a05418ca3ead9270a473839421a8fe7ee772293873d98d6a285c50e
MD5 8c31444e2c04f311c091e1733b5f33eb
SHA1 1551ed6f7a7cf718006c2561d4f6d2efba7f6b85
SHA512 e344abe003e21b9aafad066cc68fd24c95c6d097602445ab9ee6017dd97892edef5a8ba66b761c382da3e2734549c5808f2394ca976642a2a596badd1eb3388b
SSDEEP 192:uwLsNxqQieh0402ZEOIQmiU1p2X4H/+jVYkjzortYiKXMFuSuW05cFTlqQtU8:dsNxqHej0HJ+If+m08tYiKXIxuWHFBtN
TLSH
T1A8320B326828AC7A5DE2A645F04736139EE55027EEC96F94D7EC2B0C00DB69C234AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f05de49-ecd3-4e5e-8425-b4e3bc7e1004.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f05de49-ecd3-4e5e-8425-b4e3bc7e1004.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 473f6dead85819c86d658a580a092f27c27fe0a69a71ea567005732efa9c2dea
MD5 e17775856b723243046e0bcb4e22cab8
SHA1 005062c39e74f923273b820435e47b7ea7e003b6
SHA512 8e76c77ba141a7d4a37daf0bd8d8910f588a8a2a5024c4a13ad054bec1c8438ca4c3fb9b6feb3bb8c427948cde8051ef93fb93977c517568b12a8e6a10533701
TLSH
T186412E58A6FE1148B3B76F1A9BF6A56D447BB8332F0BD45E50110E4E0A63F40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads