hxxp://verisureitaly-41088[.]zendesk[.]com/?entity=32896852

Resubmissions

10/09/2026, 12:54

260910-p5a8dscn5s3

10/09/2026, 12:50

260910-p27r7aha676

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://verisureitaly-41088.zendesk.com/?entity=32896852
Sample260910-p27r7aha67

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
352	https://try.abtasty.com/cross-domain-iframe.html	4572	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335182418398159"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{736D299F-A76B-46F0-B1FC-056014886FEA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1028	4008	msedge.exe	89
PID 4008 wrote to memory of 4572	4008	msedge.exe	90
PID 4008 wrote to memory of 312	4008	msedge.exe	91
PID 4008 wrote to memory of 312	4008	msedge.exe	91
PID 4008 wrote to memory of 312	4008	msedge.exe	91
PID 4008 wrote to memory of 636	4008	msedge.exe	93
PID 4008 wrote to memory of 636	4008	msedge.exe	93
PID 4008 wrote to memory of 3008	4008	msedge.exe	94
PID 4008 wrote to memory of 4864	4008	msedge.exe	95
PID 4008 wrote to memory of 3008	4008	msedge.exe	94
PID 4008 wrote to memory of 3008	4008	msedge.exe	94
PID 4008 wrote to memory of 4864	4008	msedge.exe	95
PID 4008 wrote to memory of 4864	4008	msedge.exe	95
PID 4008 wrote to memory of 1152	4008	msedge.exe	96
PID 4008 wrote to memory of 1152	4008	msedge.exe	96
PID 4008 wrote to memory of 1152	4008	msedge.exe	96
PID 4008 wrote to memory of 3268	4008	msedge.exe	97
PID 4008 wrote to memory of 3268	4008	msedge.exe	97
PID 4008 wrote to memory of 3268	4008	msedge.exe	97
PID 4008 wrote to memory of 3824	4008	msedge.exe	99
PID 4008 wrote to memory of 3824	4008	msedge.exe	99
PID 4008 wrote to memory of 3824	4008	msedge.exe	99
PID 4008 wrote to memory of 3032	4008	msedge.exe	102
PID 4008 wrote to memory of 1788	4008	msedge.exe	103
PID 4008 wrote to memory of 3032	4008	msedge.exe	102
PID 4008 wrote to memory of 1788	4008	msedge.exe	103
PID 4008 wrote to memory of 5060	4008	msedge.exe	105
PID 4008 wrote to memory of 4656	4008	msedge.exe	110
PID 4008 wrote to memory of 4736	4008	msedge.exe	111
PID 4008 wrote to memory of 4592	4008	msedge.exe	112
PID 4008 wrote to memory of 968	4008	msedge.exe	113
PID 4008 wrote to memory of 968	4008	msedge.exe	113
PID 4008 wrote to memory of 4864	4008	msedge.exe	120
PID 4008 wrote to memory of 4864	4008	msedge.exe	120
PID 4008 wrote to memory of 4128	4008	msedge.exe	121
PID 4008 wrote to memory of 4128	4008	msedge.exe	121
PID 4008 wrote to memory of 4128	4008	msedge.exe	121
PID 4008 wrote to memory of 4860	4008	msedge.exe	122
PID 4008 wrote to memory of 4860	4008	msedge.exe	122
PID 4008 wrote to memory of 4860	4008	msedge.exe	122
PID 4008 wrote to memory of 3884	4008	msedge.exe	123
PID 4008 wrote to memory of 1168	4008	msedge.exe	124
PID 4008 wrote to memory of 1168	4008	msedge.exe	124
PID 4008 wrote to memory of 1168	4008	msedge.exe	124
PID 4008 wrote to memory of 4844	4008	msedge.exe	125
PID 4008 wrote to memory of 4844	4008	msedge.exe	125
PID 4008 wrote to memory of 4844	4008	msedge.exe	125
PID 4008 wrote to memory of 4660	4008	msedge.exe	126
PID 4008 wrote to memory of 4660	4008	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://verisureitaly-41088.zendesk.com/?entity=32896852
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc32c5c188,0x7ffc32c5c194,0x7ffc32c5c1a0
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,3784807131062385324,5865865108874108040,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9195054471037008661,10351323651731163713,262144 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,2538272008959135932,13644807956947387362,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,537782455416607012,645750645881621499,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,5848133078740825884,4053485211928502369,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,16452937504299274359,593683265332114643,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3876178508356359070,12444527369796061953,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4912,i,895182659596824120,5878333102102580006,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,16416620173085206189,7980135257576279509,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,13761027120104168820,4089759577809472974,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11223874797231399576,1515135715065278443,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11223874797231399576,1515135715065278443,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13357444660803037351,2259670436965064235,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,655248410829889916,14781037611452251621,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,7414618737876696037,4406847325667516801,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,16748373312198360933,12991308233244943641,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6404769641153078988,18416937763407830554,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=756,i,3268800617944609110,977228185280603291,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6496,i,7522481270790339518,16254926813130848774,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,17213019301684301571,15659104916082003135,262144 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5348,i,12043840421511518976,8502864205014902241,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3444,i,14758927697219678172,16240326731975343095,2097152 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8895196045687053598,18307627181772996820,524288 --field-trial-handle=2260,i,1592184358912465564,3102682144591421843,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31622d8b8f2d6ca0e8467506ce2a6712d764afae5cb3f02afc77be754e31a895
MD5 e6b40a1a44a205515098b332aaea58ca
SHA1 bc51cc66a563b9be5a2aacfd492a28d6b232e009
SHA512 789681ba60fa4bec2180dd36edc5406027a85289e4a7944421c47b07930122869ba0f4b4d7f1d37339ba4022a3267ebc22d1279c99582bf1e4f47e4801cf1a8d
TLSH
T18571B3392523A560EFC006303FE24576F5B882DAF12FAEB60D17D8733A0471163AEAC5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4ab48f578a016b5de9280851c185e050aaa4404dd83adce7673604735055effd
MD5 dc7c30ce95532fab9086cadb01ba8d73
SHA1 ad600e6cc1689baf7a19d7e15549d4565a5c4296
SHA512 5c1ea9da0895f242c52159520da9817ad720edefab4ea4f8c8cf8589bae008b085fe04bb31982574617502d10d293f8342db75d6d42997bc5967abe7115b4761
SSDEEP 96:j3ZgmnYvhSbsBvMx/GV+Lqp6UlLQzLbOpnT0IwlTtgtl:j+ggYm+ePl/CTtAl
TLSH
T1CA81C4386622A550EFC043313FE245B6F5B841DAF29FAEB51D16C8773A24712236AEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1977e44257c1fe217bb6848409e200d7bf1574a2b154e22dbb3031c155530dd6
MD5 7e21af9e38188a5f4cce1aae6971a36c
SHA1 43c34fba27cfc7555b642c2b03af55bb4507287f
SHA512 e26e14d96f90822a685a66aae65d0c185595e3c9644660301dc04cef2835e828536301672efb4c706dec954f31993dd34081c91bc424f01dc4574b89d31103d6
SSDEEP 96:HAbklZrmwQHvaS8s/I5x/GV+W2jp6UlLQzB1OfYxYoIwlTtgj:C259rm+1PllY/TtI
TLSH
T140A11978665AA450EFD003323FE20476B4B851EDF19F9EBB0C02C8373A12B422359EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2ddd80b8fbf54902d71d3900768885c7c4b9e70aa95b74dd2897d15c85282ed
MD5 1da74fd1c24444ae765d540e9f03d65c
SHA1 0b78d38be20978e7267b0d600f7bce9741fbf387
SHA512 d3ba213da17f01b684e12f85133fe5b29a7f0fceb83a1cd1fe4b37e0ff9e344c454ec17e196887828a157b86f2fffcb292675bd9a44291520918d4b6509ac544
TLSH
T16D517BF387F0862DDA1152F0AA14AE1BCEAC0525872C787989E5BE2793E2475E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a50baaea30814122280bc64fcb50855d2b8e5850a9e36c830bd07309641a5cc9
MD5 0ca66a10a53c233e03b2a54fe3ef2fa5
SHA1 c92ebd356008063d02ca52d62c9ecc7dda9464eb
SHA512 b0e5ba8a50d3669df8f4e5d80db0614ed4911c6b6b358688371dcee50db4925e453a7ef091aa6b553cefa907221d1ed8659f7cda133f08f1381c185e84cde6ea
SSDEEP 192:sxZaRKWM/fbs4QwIdps3HW6+WNR4//YCI1/HrIgrJ:sxZanM/fbs4QRCHbK/kD9
TLSH
T13822DA126E34A97B8CC7D219FA25BF13E2F9503295D41E48E6FD861C04E7ACD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fbdc3bc329c92c406ce53dd387bfdc14825db6943fea6c24c692cc13b5effa54
MD5 09f8db153baa51e9db089411d771489e
SHA1 60017dc10dcba144376414c8215825d83254fb54
SHA512 7863ab7f424cfe546966d88bf5b565b0c4ca26e57fa4f87f785a3ddc162cad7fa5eeb98f627b15c99d5420fba965a6cc200d84de9e009184b2dd2fd2ebbef9b3
SSDEEP 192:sxZyRJWM/fbscRvwIdptH3HW6+WNRKwFYCfeVHrIg5mS6fsJ:sxZyiM/fbsavRZHbrF8DmfQ
TLSH
T1AC32C912A938A97B8CD7D21DFA55BF53E2F9503256901E48E6FDC61C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac1adf16dbeea3c0a9a2de67cd3db9eae20227574bb2c69f61be9d6d76535364
MD5 6614ce1da6a9aea202674b87a997ed48
SHA1 8c4d7d088e521ffa740da519763672a577518af0
SHA512 c784b0e0458155e4ed58165df8ae4100cd49cb3e7c52a4b80fb135ae185f8858824e8d82e119e74a87efcd1ed0e15114464127ba24ba5914ccb430eafcdabd9b
SSDEEP 192:sxZaRKWM/fbscRoNwIdps3HW6+WNR52XYCql/HrIg5mS6fsJ:sxZanM/fbsaoNRCHbaX8DmfQ
TLSH
T1F232EA12AD38A97B8CD7D209FA15BF13E6F9503295951E48E6FDC61C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fdb81216f4ba503fd5143ffda0c167276d757568a01dcd7b702ffde6283ce0b3
MD5 f0fd55ed213acda74c46888d57b6dd02
SHA1 3221ced609031ec5f9f9c3475dc51b4267a6f670
SHA512 2f5fbe57a83c79b071f6ba24bb11b53c51a1875be7598663f1575be6f073ab6c607cf7585d7cda77db635dc32d76568e6af4baf04bb36ff8e1a13f556ef8f0c8
SSDEEP 192:sxZaRJWM/fbscRoNwIdpm3HW6+WNRsCZYCVeVHrIg5mS6fsJ:sxZaiM/fbsaoNRQHbHZCDmfQ
TLSH
T10932E912AD38A97B8CDBD219FA55BF53E2F9903255901E48EAFDC61C04E7BCD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a797728dca3474b34a145e6a816946f53cd0a1b035a866092ae3e86f1ddc7bc7
MD5 1824d434926859ffa5aa5b8c2909bb22
SHA1 ebd3d7199122245fc03d0bcceeaff9c4bc147bfc
SHA512 a2715313d231e98d5d2fb1fb84e0b30401e833273713080187fcb3606a039baf78fb3ed9432df78d42972b82fff3aea3fbd90b1c065b2a78bf2d6a0361723f35
SSDEEP 192:sxZaRKWM/fbscRQwIdps3HW6+WNR4//YCXl/HrIg5mEJ:sxZanM/fbsaQRCHbK/5Dx
TLSH
T1C422E952AD38697B8CD7D219FA25BF13E2F9903295911E48E6FDC61C04E7BCD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 787a8e74fa507ea3c90552f3076a852b0df9338b5fa377bb135816246af84fcf
MD5 c8ccfbc00a1bd073a8d5058693115be4
SHA1 c09f7a1a2181f578d092a71fdb9cfd3f2e2b79c8
SHA512 717de2ff19b8e15967f7e3d011c0224f8213398fb0fd8f85ce6355350d272dabd07d3f884624124262b054544afcacf629256a07b34697ab125c46ca5324aeb4
SSDEEP 192:sxZaRKWM/fbsGQwIdps3HW6+WNR4//YCI1/HrIg5muJ:sxZanM/fbsGQRCHbK/kDv
TLSH
T11222D912AE38A97B8CD7D219FA25BF13E2F9503295951E48E6FD861C04E77CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2dab3286ead191e4c4ae1e404758917efcd0c0dc1f3572609acdbc1d64bbb0c5
MD5 db160b43ddeaeaf61c04a2a99b53b91b
SHA1 e45ee0e8f5317dec6abdfc9b14168315c65701e3
SHA512 6997dc179a946c8c18920bf030942887c960945756b54faf63712cf0718152ae865cfed69ed9f0f491306da3a2828836176e9188563d7f8102b7e074b357fa0c
SSDEEP 768:BbqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKroroG:BbqbUj+WvSCs6u1jaaZLbWrTG
TLSH
T195C2E93B340CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a8e574847b53174c8af510e0ee465ac0093a754e\index.txt
Size 248B
SHA256 b502cb8f52dff61c6620b74764dd33276dfb24e618d5e2b29efd6922b44501b1
MD5 3b8c18818b09c9dc11dab576f27669d0
SHA1 a34bea23706ebd1ad5291a8122c98a36b62fda0f
SHA512 de1ff1ca1bfbb681cbb256de7db83766b1080c9702d6c5aac3c216c1a7c6cbb24ee3b84c3581d5e338c403e993e07e09fbf17e8ea11bddf7f0df81cfaf2d609f
TLSH
T103D0977326508758AF3A88C20C3EA290230B7C2A2C889C7CA81A3025B5BC220D329C08
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a74b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a8e574847b53174c8af510e0ee465ac0093a754e\index.txt~RFe5a74b4.TMP
Size 164B
SHA256 6726d85fb6aaf72660ca3e81f63faa10224745a40d0648c52f2eba08cf77fa5e
MD5 bb10bce8eae2844c575d2421711d5b5e
SHA1 fac2b8fca5d2bfc986fa733aaec05e3144c17a5a
SHA512 652abf97c52006dfbb60d763955fc7bef8620bc79760b430d1518081331c5959fce63366f021dcdb757176aaabff144bfc8d36ea06b568f58ce269b980ebd888
TLSH
T11CC08CA32A4182ACAE3D808249BEB2C0731B2C98AC845CA4E4253019747C121931CE08
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29e19c89a2d2355fa0b6bacae211d4cc0bce9b0fcd9a7bec92877323b78c3cbd
MD5 edfc35b96073250cc6b1e07953e3b2fe
SHA1 90fa353cd5f4e5d15648841c26c8d709971a8107
SHA512 174e81975451f57cd2119e5b8eb15359dd7e26e01e05de17d12a6376cc28df0e43de48d1d24254a248a304812621e0a6e0da9c9b0aabea502746ef2b3b9b7c60
SSDEEP 48:K0TQ3D5FRkhFmPIm7kKfBX5jsnTRtZkpt6PI6bkK/BH5kLz08aRz5yxoIvKx2ENz:KEIgKJB0QKp+ayoAKx22vKKgI
TLSH
T123910247B43B520238BD7458BAA696764F9531A33014F9AF3FB900660E27E614DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7de026a-4cfb-4de0-b227-8e4c574e1086.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e7de026a-4cfb-4de0-b227-8e4c574e1086.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 57434ed16f10daf97ecbc2202a61a99918f83caea31ffa5d8ee65118ea789b2f
MD5 579a6edbe105dd138a2bc3ea9f93bce2
SHA1 403a5ba62f5f048780c6ff8aef50830897185f84
SHA512 9e258c59984885deda1e12c28f972a3e0d847dd73dffa2472fa304f1d2a99622c74cd43b4dd61086e0881caf414ff028d0d728848e163842b95660e5fb777fbd
SSDEEP 384:xZcIhsNfVtv75mjEa+NOjW5xuvzxV+MhdpcBoS:ZhsmYaIOjW54184pcBh
TLSH
T151828E316D7C5CB75CF7A144F88736178EF880679AC86A90D5DDAF0C01DB6A8130AC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dba0afe18399133c9d465c39e53caa5a8011b69f303ac2cc45878c4c4dfa58f5
MD5 3a9c374816f8949aec2335084ba3a495
SHA1 ba7ecf10f9e5a94985ff238b6e9ef31c1bf99aca
SHA512 58441ecfb5e97538cbc9fd638838aaaa7aad0a64809f4eaee207c6d7643b6707e408b3e854864311b6f2e7a0c7ed476bd03ba70cb126892a3a215ca45a24b989
SSDEEP 384:UiFiZcI6/sNB8TUNTUlIl8tvJ5WjEa+NOjZ5xuvzxV+MhdpcBoS:vFQKAwgqWYaIOjZ54184pcBh
TLSH
T173C217F258DB8876D8AE5747EB7D2E038EBCC067B584A550B3C95A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b01da7d2dc201f90e8b33f4da5a2cfe8194fa39d893bf2b31ccf46893fd5e98
MD5 bee800587218e0b5ef5d106842abe262
SHA1 556825947cf8e298a6b7a5920cdef9c05c4f0451
SHA512 cd82420096c89f8dc9c1a29011b5b8be4b67cbde254b583e979713d7a87403e207d7c0b3e79649e3dd4d7b603d46672eae3b468ccaabbf0aef5ac84cedaa48dd
SSDEEP 384:4ZcI+/sNf8tvJ5mjEa+NOjW5xuvzxV+MhdpcBoS:GGDmYaIOjW54184pcBh
TLSH
T119828D316C7C5CB75CF7A144F88636178EF880679AC96B90D6DDAF0D01DB6A8130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2e84e8e648b256be022d8c07ccf3863126eb94ef1cc7ae4a9e3b2391362f2c7a
MD5 c55e43c2f1e9f8ae027a0c6451d2d839
SHA1 5cb715909e70e164d1fa70ee446ad61e1cf52931
SHA512 2c38c0d0d1bda9d58873eb7b9c35ce9f47b8aa8003ffa15d8756816a01d08154f828bfca0c4d7b191a66525ebae00a503a177ea5b15b2a2aa6c05607c953ae56
SSDEEP 384:4ZcIhsNf8tv75mjEa+NOjW5xuvzxV+MhdpcBoS:GhlmYaIOjW54184pcBh
TLSH
T1EF828E316C7C5CB75CF7A144F88736178EF890679AC96A90D6DDAF0D01DB6A8130AC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f958c9af8baf88845834354b1feeacfee299653648c242987fbe43d951c53dd
MD5 581402d9ff69b970f746fb4a29e495aa
SHA1 da53ce46a8f8b7c8c9fb4239809ebc5f6d43e24f
SHA512 2413532a8a666579d67ba6133f3770591e24d49ecb96c2d1da97e7efc5386e050025913b9d58bf8e06b36705c4acbad3f17b1abd4dc64fae22b71e3cf2617c14
SSDEEP 192:NONC6DbOQmiUyNZxxBa+jROmDRkUNz5qUU6:NONC6CMXxBa+NOjU5U6
TLSH
T1CC122B32697C9C775DE3A954F48732179EE44167DA8ABF90D6CD1F0C01EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc9162fdd9df02a1a0eb310778cdb6f5bcbf0e4a95a3931edec9152cc4039dda
MD5 7d91fc49074e69f1fd8225b7fa360434
SHA1 88258062ed883d41b193f1dba762a3c510582191
SHA512 d799c3b12fc084aad767e2b026bc534cf19c4c8083d1eb3ac9141bed97dd6597482b25e5dfb6ebf1f915e3f8d8d1fe15e4616f8d641ec7a02f338ef2563a537e
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop51nD3BfPgvE5BzatIRdy+88OmlmsR1H:vON76Db6QmiUyJxHBa+jROmDRuRgiSU6
TLSH
T16002D73569786CBB9EB36E48F88737279F94107BDA966B44D6D81F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

881fa1bf-913b-4f26-ab8e-37914af44c83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\881fa1bf-913b-4f26-ab8e-37914af44c83.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7a27ddf51261ee24d8dbe4112d255cec92d9dd5f0858611f955b54109aa2e63
MD5 8335ba6381d1d927b0e129adab449872
SHA1 46616c65e6c2fd7e7e91b60c4e8aaa3d085508e2
SHA512 3730da6a85fafb80522e824f3d9390195430e8b9f5c62c26a48bbc36ede328f90c46dc8217d620998f2e4c3e68f0319e52b1f0da101c9f124bc213eb758b1184
TLSH
T100412858A7EE1148B3776F5AABF6A86D487B7C771E06D49D10410E4F0A22B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download