hxxps://sites[.]google[.]com/view/euro-assistance-groups/home

Analysis

user interaction
yes
max time kernel
209s
max time network
207s
platform
windows11-21h2_x64
resource
win11-20260513-it
resource tags

arch:x64arch:x86image:win11-20260513-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/view/euro-assistance-groups/home
Sample260722-sdq2bagb46

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	sites.google.com
16	sites.google.com
5	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292060740209889"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{B262E53B-5738-475C-B86D-B504C379EACD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3284	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3204	556	msedge.exe	80
PID 556 wrote to memory of 2172	556	msedge.exe	81
PID 556 wrote to memory of 2168	556	msedge.exe	82
PID 556 wrote to memory of 2168	556	msedge.exe	82
PID 556 wrote to memory of 2168	556	msedge.exe	82
PID 556 wrote to memory of 2664	556	msedge.exe	84
PID 556 wrote to memory of 2664	556	msedge.exe	84
PID 556 wrote to memory of 3500	556	msedge.exe	85
PID 556 wrote to memory of 3500	556	msedge.exe	85
PID 556 wrote to memory of 3500	556	msedge.exe	85
PID 556 wrote to memory of 3744	556	msedge.exe	86
PID 556 wrote to memory of 3744	556	msedge.exe	86
PID 556 wrote to memory of 3744	556	msedge.exe	86
PID 556 wrote to memory of 3964	556	msedge.exe	87
PID 556 wrote to memory of 3964	556	msedge.exe	87
PID 556 wrote to memory of 3964	556	msedge.exe	87
PID 556 wrote to memory of 4312	556	msedge.exe	88
PID 556 wrote to memory of 1528	556	msedge.exe	89
PID 556 wrote to memory of 4312	556	msedge.exe	88
PID 556 wrote to memory of 4312	556	msedge.exe	88
PID 556 wrote to memory of 1528	556	msedge.exe	89
PID 556 wrote to memory of 1528	556	msedge.exe	89
PID 556 wrote to memory of 4660	556	msedge.exe	90
PID 556 wrote to memory of 4660	556	msedge.exe	90
PID 556 wrote to memory of 4660	556	msedge.exe	90
PID 556 wrote to memory of 3148	556	msedge.exe	93
PID 556 wrote to memory of 3148	556	msedge.exe	93
PID 556 wrote to memory of 2384	556	msedge.exe	94
PID 556 wrote to memory of 2384	556	msedge.exe	94
PID 556 wrote to memory of 1864	556	msedge.exe	96
PID 556 wrote to memory of 572	556	msedge.exe	97
PID 572 wrote to memory of 2900	572	msedge.exe	98
PID 556 wrote to memory of 5084	556	msedge.exe	99
PID 556 wrote to memory of 2064	556	msedge.exe	100
PID 556 wrote to memory of 4960	556	msedge.exe	101
PID 556 wrote to memory of 1916	556	msedge.exe	102
PID 556 wrote to memory of 1916	556	msedge.exe	102
PID 556 wrote to memory of 1916	556	msedge.exe	102
PID 556 wrote to memory of 4436	556	msedge.exe	103
PID 556 wrote to memory of 4436	556	msedge.exe	103
PID 556 wrote to memory of 4460	556	msedge.exe	106
PID 556 wrote to memory of 4460	556	msedge.exe	106
PID 556 wrote to memory of 4460	556	msedge.exe	106
PID 556 wrote to memory of 4364	556	msedge.exe	107
PID 556 wrote to memory of 4364	556	msedge.exe	107
PID 556 wrote to memory of 4364	556	msedge.exe	107
PID 556 wrote to memory of 3604	556	msedge.exe	108
PID 556 wrote to memory of 3604	556	msedge.exe	108
PID 556 wrote to memory of 3604	556	msedge.exe	108
PID 556 wrote to memory of 2304	556	msedge.exe	109
PID 556 wrote to memory of 4392	556	msedge.exe	110
PID 556 wrote to memory of 4392	556	msedge.exe	110
PID 556 wrote to memory of 4392	556	msedge.exe	110
PID 556 wrote to memory of 3228	556	msedge.exe	111
PID 556 wrote to memory of 2680	556	msedge.exe	112
PID 556 wrote to memory of 3228	556	msedge.exe	111
PID 556 wrote to memory of 2680	556	msedge.exe	112
PID 556 wrote to memory of 580	556	msedge.exe	113
PID 556 wrote to memory of 580	556	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/euro-assistance-groups/home
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffc0236c188,0x7ffc0236c194,0x7ffc0236c1a0
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,4085697966633010687,13627137148854427827,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,7408949433499998585,9166154371301768123,262144 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,7496820635762047780,13229716449759611004,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8204548322577342355,16865583852636920045,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16700098999378085142,4985390205765180797,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,18144914691366895009,6964166363023458691,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4160,i,2132237322413726651,14989189493647569580,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4204,i,12246545664529021779,9469399468269692363,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,4931905233731058911,17296090674095440997,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3192709676731106452,6878102772251127520,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,384105524106292093,7702020894713488114,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,4809305065906872659,2045400362467943354,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,4809305065906872659,2045400362467943354,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15622208009609774445,4127868611184736851,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,2545154773250227419,3143328785263742776,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,9467847921475264001,3337954557437138752,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,13747776651010753650,4114367986445500622,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2816,i,9501471877368278567,18378198176502751029,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,6910219748833599473,17103786172753282696,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6296,i,1893156283033544168,5881938478968782691,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4728,i,2598676476621000219,10025736899253344621,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4936,i,8439749286029701631,11904781055187742521,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6532,i,10313159023219143744,3069352688558283952,262144 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6624,i,1824426437821090004,12249348492326361679,2097152 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=it --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17365823022023297773,15650070974433580216,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11149669202174760496,17156441151318170278,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=it --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,4126761614885876342,10547581642548287497,524288 --field-trial-handle=2144,i,17899046810930505938,6477225008901156641,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4788

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0c50006cd4531318cb0ad03540e30cb9396da48e6ee754c894e54b24f04552a2
MD5 5889b97207794c0c3b108d5d435a1b6a
SHA1 1d111311886c0bb9cd008b0a8bc6a4d766d7b2e0
SHA512 19584b7704ed5eba2f08c74d9c176dbf3881effa21ca5b3c943083deda3ff92967ed0d319d0083fff408c5c19b3f52b3499987a5cbde3b5f918a96c9ede02591
TLSH
T1B151A8110762158BE3A4013090D2122E3B38FD998DD72F567DA855F72A16F3D65224BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7c3499b17ebae97d92ad9873abfbe3b2c2524f5828167d377060a96c204deac2
MD5 4b18254ed20040458500f4105f418d6a
SHA1 e690053aca032f687a831b7e3c85746e8bce021a
SHA512 51ad13b741ae77df5461f1c49478e1c07c67e4b27b27c5e685687de935833b88b45881466c4bdad22bb12771f8040ab64c9ab5f20f85545bbf03e1185a0af872
TLSH
T1FE510B1103A2119BE3B4013090C2A6693B34BD958CD76F567DAC45F62A17FBDB4224BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ddc8c2a1dca69bd06299350be64523bafd81d6115a6a46add253e131b00eb515
MD5 9f76a80495ed693f730f8de29d8f6ae5
SHA1 80789758f76391d39ffd781213e22482024818dd
SHA512 72e704a849f5c9fc2cd0328b572d238b83b3f6144c3a6989a1af54effa59609f9564d0c92913426acfe02c89bfa09616e9a6361facf66ee9368f51419798e534
TLSH
T1C751EB1103A2118BE3A8013094C2222E3B34FD958DD72F6A7DA845F32A17F7D65224BF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6e53990dbebdc2257c4a9220ce16d1297fa7250a85ad49b1583f975013fdf70f
MD5 17b2dbea6909468589fa5a24eb109153
SHA1 b80c66415d05d11c2881f20cc17438929af920a2
SHA512 fe1502105b260d806c538850948d583f13a8dbc9323a2b337b171d49167123cc0a5a7de3cf2108abfbb2d8140c16fb1c19f0ad7915608ef29d0a0685a473ce15
TLSH
T111616EB7C3E9852D891125F89B156F1FCE1A0914432C3C66C8E8BF5B93E2831D21575E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8f901117a3b421af4621386bcf96bcb67cbbc32780966d74550bd0d8dfc5fcbe
MD5 063addf7f54e6c3dcd755fa755552569
SHA1 de2fec8c882b91b5a74f72f1d06a8bad6cc2d101
SHA512 ed343244aab0037dad2739b864f17dac1927448467964ff54671709d83eb1696d29a1384be214c65902c1006bbdd6a490eb8d93f140ef41b007a4135b94b6194
SSDEEP 96:D4+3V9U7JMVtVgVe8oqMxZ0PVmw4wq89ym807lPEm33Y:D4+3V9U7JQDkroqMxZmVmFwqRm8WOyI
TLSH
T1F5D16DB7C2D4C62DC81625F4AB156E1BCE1A1918422C3C5BC8E8FF5BA3E2471E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 975ca458c683cf982a99a1d58441ef7d6e8bebdd6ef5b596bf2eccd7869ca549
MD5 279ea0d483e776ba24278ca4984769ec
SHA1 04eebc13d1b9a45ac963bcd6f35e596d58b6b5bc
SHA512 d1f417e06d930b5e58c66ad9206eebdf30eee1b9a3876c58123701bb35443c77e25319f9bf31b8e5f68f6cc57767c36e428b89ad0f6c848658509cfea9a97bbe
SSDEEP 192:sxZzLFA/fIsOz2AIYBIupu0/W6+WNKG0/Y0s7YC2FPEIg5XJ:sxZzBA/fIsOz2AIYNr/bE/5Y0mH
TLSH
T11C22EA57AE38A93B8CCBD209BA15BB13D6FA1131D1D11E58EAFC960C05E66DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f48be8514ae282fe36718d386428ca0a403958791d5aaacd08e9292a208be4c1
MD5 a53fc77248fe7a8546fac87702068110
SHA1 93f939d39b0995f74775fecaa2bb0df45835060e
SHA512 98a54fb3e929c4f3d9db56dc964879a75ccf6df2cdcb6cf2e27280f0a3acd7881f97af31bae32c31a6b1d8c4ac11e6361911829901f8452a421bce3b59b26a89
SSDEEP 192:sxZzLFA/fIsSz2AIYBIupu0/W6+WNKG0/Y0s7Ym2FPEIgrJ:sxZzBA/fIsSz2AIYNr/bE/5YKm9
TLSH
T17622D9566E38A83B8CCBD309BA15BB13D6FA5131D1D11E58EAFC960C05E66DE230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ffa52b2161ae8e98bd29dd8c10d8a9a4fbce429f3eea00683ec8765fe41489a7
MD5 533baff68e6b3a76c4b9fa6c7e2258b2
SHA1 50f14ddc40612dfb5fe4c2cb55e4bc8c6b3486f6
SHA512 5f132026fd2299fc694867fb5c2748e5e65991d00340f0815e81817eecbcfc613cfd296f6001a7b941221ad6c1fa6b8724119d610b6e85f91aa11a5406e919e0
SSDEEP 192:sxZ4LFA/fIsOzOAI3mlBIupESlolfL/W6+WNwrax1iY+d/Y0szBcFPEIg5uoJ:sxZ4BA/fIsOzOAI2lN+/bwmir/5JmAM
TLSH
T1E442EA57AE34697B8CC7D219BA14BB13D2F51161D1D01E98ABFCCA0C04D67DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e6e76ec09b00e36e3d10db64aa758adfec00f44b136c5ebfbf5d1a1733a54f96
MD5 f59530b775b2d0df20e6dc2391002bf7
SHA1 187b84814ba0c3382dd9ecdfda9cec3e899f0e3b
SHA512 e51cc1dba43c44f817b2dda1c632fffb671a0ef03f3f0e1194219c6d0360bfebf19944134b74ad3eaddcfe686efef24e53d725758747da1c5b69ade886131459
SSDEEP 192:sxZzLFA/fIsOzOAIYBIupE0/W6+WNK1iXY0sEBcFPEIg5lJ:sxZzBA/fIsOzOAIYNh/b5X5Em5
TLSH
T10432E957AE38A83B8CC7D209BA157B53E6F95132D1D01E58AAFC960C05E6ADD230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ff39e727707b04486b0d75257ca85604158f91e5547cde5c9cb9b563192c7335
MD5 0b5ae598f6a0adf8d67e543c630f1a4c
SHA1 854a3a4027642700eff2bb681b515286518bf156
SHA512 c1658c9bf0c44c08ca87d9884a93ccdd3338f8d3959a0fdbc2f648d8610328760572ce7b8039224a670274aa4f95f4849fcd0d04cd3344a6d3e8d7b55a6ec5b2
SSDEEP 192:sxZ4LFA/fIsOzOAIt5IupESldL/W6+WNK1iXY0sEBcFPEIg5lJ:sxZ4BA/fIsOzOAIt1J/b5X5Em5
TLSH
T1B732EA57AE34A83B8CC7D219BA15BB13E6F91131D1811E98ABFC960C05E7BDD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c8aa7f7fe4afb8774c83edc4008075dd20f0a8fc12cef9107143e93cc0651618
MD5 6f0ab9f8e1403c64c04681766fd93ecc
SHA1 4e03205a474742af2ea00400313aec30c7ea34b0
SHA512 cc3bc982129701c917bf42ff4ccf0f597db46d0e32ad63f33036ea9d4169097a6378a76733e01465c029964967c50d4fccd7083ea0a9d8b0ea7f6d5292dbd927
SSDEEP 192:sxZzLFA/fIsOzOAIYBIupu0/W6+WNK1iXY0sWu2FPEIg5lJ:sxZzBA/fIsOzOAIYNr/b5X5jm5
TLSH
T12132EA56AE38A93B8CCBD209BA157B13E6F95132D1C11E58E6FC970C05E6ADD230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ccdce415dded4d3c103cda83d850a170b23024719d0b23d372874df9ab1f9eb1
MD5 6073c214e5f135e4fa1c9609ff06a60a
SHA1 4dfc3967ff310d1c3dfbc47908b03807fb6bb124
SHA512 e64de2e49db4298a421b76aa66367614fb64cc4875e17b9d6b3f0135af4754745034f899022ee87fa9e831f1898a4736832151b50163fd4ff0aa654ebba93901
SSDEEP 48:KAxIlKioYXyNzIVK4EYfyf/aD/SnHSnrSnfSnkPSnrSneSnPIeSnBSnkKtSnBlSU:KAxWKioqWzmK4EiMnaKQEA
TLSH
T15391932336B653222D3D650882A997264693F6637015ADBB3BB840F24E27F205DFDCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e522e00c-f3c4-40ca-a973-b313ddb2949e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e522e00c-f3c4-40ca-a973-b313ddb2949e.tmp
Size 28KB
SHA256 caadd9e3b8ef3ae1f25ce6261fa1e6e9a97b5a70f6924279be5d08a2f5d94cd8
MD5 c7018b54438b545d1adf967504d8fa83
SHA1 8e949eb31f1c4666156852ba62f175ca8e987911
SHA512 4822571b4d4e4ee50d1fc7e019d00f156b75dd1b2a9d09a7b9327eab7770a218a3f8af83bbb4b41ffcf8eb6865d2d14f778edbf846eeba00e2587285524dd95a
SSDEEP 768:Zf/Jh8oF2UkWRmwcQyw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/k601GerogJ:Zf/Jh8oF2UkWRmwcQywu1jaKKjLpkD1v
TLSH
T1DDD2FB3F640CCB7F4F801A9DEC566F972EA802C7A6588D4047FE994C02C77EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4b6757b3a7b9c93a1f21d95e57b5afb1f3500cbd5a2200eb3f133c5a956e3205
MD5 ae78d08cc89d15849dedff707dce2046
SHA1 cc43ba71c2bbe2b68cb4bce80e969226eb1c31d6
SHA512 4c54bd5fcded419207f86a743180f4ab647f0076a2d693d58cebf91da6d700e48735a70db3d9fed392b7821858967d38a8fecf257acde3956926df09ecfe1103
SSDEEP 192:uV48N2UjQJlJJKxn6H3isOQmiU1jPIpB4r/rUH5mwRWDYX4kcFq8iu:J8N2Ujbx6Xif6pur/E56BJb
TLSH
T1BA52297568B86C7B8DA39255F00B32039EB451AB97C81FA8D5ED6B0D04DE6DC1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7850aadd010560ffeaf1db034569db0982929b2433174ef0ade7a5033753af4a
MD5 5806071d1202c89d49316ccbaf469efe
SHA1 cb0ee07f63a34561d49277a8b0b6d8d2ce0e6852
SHA512 0889038409babb1d6f3d68da2bc2647c69e36d3cd8de0e9c158de35913cf31c247917a30e5a9cdd06b7fd106764538539aad62edb4945776889c8b39f9fed716
SSDEEP 384:SdtNn/s3n9S4n8N2Uwbx6XiA8pP2r/E56lJScjmw5l:aj+9V/Rx1FM/EOJ1jNl
TLSH
T1EE927C36AC68AD6B8DE38159F40B36579F7816A783C41F94D9EC6F0D01DA6EC0307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 2f96b3dbfd0b70e93782b0fa59adedd9642d075a89c6c4d5a3c45daa1b03d86b
MD5 d779d4a0bb971b4a0458ec7f82ce2633
SHA1 fb72fd7a39c254974224ebe86aed356634bdf4f1
SHA512 65b069682b0e39109812bf3a2607bbcb1dd66bf6e95725edf444c6f92b8c31913239956788de9c6ed4fa86b5e22fc21ec16a25ac5b9cbee5ffcbe050b892013c
SSDEEP 192:uVv8N2UY8QJlJJKxn6H3isOQmiU1jPIpB4r/rUH5mwRWDYX4kcFq8iu:c8N2UPbx6Xif6pur/E56BJb
TLSH
T1C852297A6CB86C7B8DA39255F00B32039EB455AB97C81FA8D5ED6B0D05DE6DC1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 283f276934330d2760b5aeafd58adecbf5f34d7300d431a42a334fcbbd40fb1c
MD5 f04fc623ad1239dd2930c02bd11dfd59
SHA1 b8a95dcf77d19fe275d169211d85e6627dd36fc3
SHA512 47569e48d3ff8fce6612f7316df3ee4ae0cacd1f6700dae73e34f51ae42bd8f37cffc46f339b915d83fc910f014a18fc493ef7328b0ea62c68c37b894557f7f5
SSDEEP 192:ucv8N2UY3QJlJJKxn6H3isOQmiU1jPIpB4r/rUH5mwRWDYX4kcFq8ScjmqYoJXm8:58N2UGbx6Xif6pur/E56BJScjmw5l
TLSH
T17C726B76ACB8AC7A9AA38115F40B3253DF7851A78BC81FA4D5ED6F0C05DE5EC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 787e18ba87e15a2dd76349be8c3904777834e93471642faa9160a9c3607f541c
MD5 b396a44400722f4a76823bc495675cf6
SHA1 935624d37fc697d985ae6b7b1e2b255a847fbf41
SHA512 8ce6064ed167930ba3ea6bf6eebfe723f2d3d4a30791c8f7110e3392ebc36ede60d4913a28bae200fe28bb10c0137378815f8341dd036893287cdab21f1403ab
SSDEEP 192:1GN76t6H3BQmiUyvHBHw2Qq/rUH5mwRbD9Mm1U6:1GN76MXfsS2Qq/E5CeU6
TLSH
T1F402E9387CA8ACBB8DA3AE05B48777139FA4117FE7955F98D5E81B1C01D769C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ace99cde673d243435d9e26b4798e61ef168949c4613b638a4d883563d0032a
MD5 facfb7b506e1788e35d972759e0202f8
SHA1 6c91ff6c9ff671ec17a32bbc9f42cbdfa6bcf037
SHA512 b264b4688d18068a95a74279a9923657d866e6d6611e594bc02386de5ded1dacef71b4d7ff6687b18c28f94bf6d42f475316ae2932017c8142f4c463c76baaa8
SSDEEP 192:GGNCh6t6H3tQmiUyG0w20q/rUH5mwRWDYXG/9nFq8U6:GGNCh6MXrh20q/E56pJU6
TLSH
T1F6122A35B8A8AC7F4DA39555B04736139E69017BEB896FA8D4EC2B1C05EF5DC1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4278f2fcde20722eeefdf20317c2ebe50e23668f2e08a2173111128ec3e486d5
MD5 e21951d72da4ce01547129e134a2181b
SHA1 545a7f86c5d5c9e9100749a62b10f8ac61f394bb
SHA512 0c702b39d745e6d3a0faef545b7636a61cbb9c6714e6aeb5479813f9277bb98107c9fe6b0a98f68a49d3f37838c63aabb8c268df65a979bd94e3286aade80f1f
SSDEEP 384:atNn/s3n9SE8N2Uwbx6XiA8pP2r/E56SJScjmw5l:aj+9f/Rx1FM/ErJ1jNl
TLSH
T185928C36AC686D6A8DE38159F40B3613DFB851B787C41F94D9EC6F0D01DA6EC0317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8a07414928759851ad5da653c3d4251d94895278aef6a6b9766ca558195ae15
MD5 9a2176c1ff50f76094c338712b20f389
SHA1 7999f6862cc66a2be8f1e7b34eb8c976c4ecd9a3
SHA512 2696df6ffb6be14e18d8e01aea91ee8a2a6a4db3209c894a17ef85641da29774e3510aa5e4eb52179bdaad8b7ca193a78cef8d2587586299f7bfb5966a5b47ba
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a322d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a322d.TMP
Size 392B
SHA256 d8fa780f30757bd6328b99f43026d6804edab7180283cf50ae5a401c9451d823
MD5 142124c95cd9868719f2cdfc61af6d3a
SHA1 71fe6922b1b08c008fc622a6855d627903bc21e3
SHA512 bb415c9f6000b3b297a5936ab2a1fe8e78796a083262b7bd5119902138c2f5be8774659f9d52a73820624739884d1a993e6683de4abec023f23e38854e983709
MD5 SHA1 SHA512

Submit Download

6718a032-04eb-460e-9a97-ecc960a8fd27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6718a032-04eb-460e-9a97-ecc960a8fd27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 1d6ce236ce1b397e0f6c56835719e093668fb5734460d9be3552cdae4dff539b
MD5 55049b82d2d4ac54a2ee2f69a4a30df3
SHA1 d35ce36db2142fd959fb750663d48cddcc3c08f5
SHA512 6d295398c2ebe1d6886e8e24a240872e6b6f71ddc3b79724e3eeba1f2402d8b6c4bc04a540debe1cceeecf82f3e16ef19a1845a0fbe41b253d99cbb48852e784
SSDEEP 384:FBJWJ4Vca12krtuVm+AglBOVjeQ8RJoPighIjUXy7Wg5Pjm5q+GDa50ZQOYAV2cW:9+4VcWr1l8RJcig+jUXwJsq+GDa50ZQd
TLSH
T1B7A24C743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 0f2d97eca94e3d195aee51a139a9a5c1d960b784823da2ee77bd6ae89ae67b08
MD5 763515cbcffa0fc238d4693bbf9eb24c
SHA1 6c4663accadfdc6cda6bc06430b0ba02ab051210
SHA512 0f517c0fbba9df85e9eee074d149106209912e88b19a144be93d012460a3c8030b0adf5f8605e64fcfbfaccffc0e17f2674b51861a8e56077481fd8b226b9891
SSDEEP 384:MBJWJ4Vca12krtuVm+AglBOVjeQ8RJodighIjUXy7Wg5Pjm5q+GDa50ZQOYAV2cW:U+4VcWr1l8RJyig+jUXwJsq+GDa50ZQd
TLSH
T175A24C743AF51319F3B29F759AF1A95A643AB8669C00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download