hxxps://agenziaentrates[.]net/it/index

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://agenziaentrates.net/it/index
Sample260925-hv7ehs1x9j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347934788971199"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{24CF5229-0B7A-4104-8742-24A049E9BA0F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4048	3164	msedge.exe	85
PID 3164 wrote to memory of 4800	3164	msedge.exe	86
PID 3164 wrote to memory of 3460	3164	msedge.exe	87
PID 3164 wrote to memory of 3460	3164	msedge.exe	87
PID 3164 wrote to memory of 3460	3164	msedge.exe	87
PID 3164 wrote to memory of 5100	3164	msedge.exe	88
PID 3164 wrote to memory of 5100	3164	msedge.exe	88
PID 3164 wrote to memory of 4192	3164	msedge.exe	104
PID 3164 wrote to memory of 5028	3164	msedge.exe	91
PID 3164 wrote to memory of 4192	3164	msedge.exe	104
PID 3164 wrote to memory of 4192	3164	msedge.exe	104
PID 3164 wrote to memory of 5028	3164	msedge.exe	91
PID 3164 wrote to memory of 5028	3164	msedge.exe	91
PID 3164 wrote to memory of 3912	3164	msedge.exe	92
PID 3164 wrote to memory of 5060	3164	msedge.exe	93
PID 3164 wrote to memory of 3912	3164	msedge.exe	92
PID 3164 wrote to memory of 3912	3164	msedge.exe	92
PID 3164 wrote to memory of 5060	3164	msedge.exe	93
PID 3164 wrote to memory of 5060	3164	msedge.exe	93
PID 3164 wrote to memory of 4736	3164	msedge.exe	94
PID 3164 wrote to memory of 4736	3164	msedge.exe	94
PID 3164 wrote to memory of 4736	3164	msedge.exe	94
PID 3164 wrote to memory of 4492	3164	msedge.exe	98
PID 3164 wrote to memory of 4492	3164	msedge.exe	98
PID 3164 wrote to memory of 4492	3164	msedge.exe	98
PID 3164 wrote to memory of 1676	3164	msedge.exe	100
PID 3164 wrote to memory of 2696	3164	msedge.exe	99
PID 3164 wrote to memory of 1676	3164	msedge.exe	100
PID 3164 wrote to memory of 2696	3164	msedge.exe	99
PID 3164 wrote to memory of 4992	3164	msedge.exe	103
PID 3164 wrote to memory of 4736	3164	msedge.exe	110
PID 3164 wrote to memory of 4736	3164	msedge.exe	110
PID 3164 wrote to memory of 4736	3164	msedge.exe	110
PID 3164 wrote to memory of 3532	3164	msedge.exe	116
PID 3164 wrote to memory of 4840	3164	msedge.exe	117
PID 3164 wrote to memory of 1444	3164	msedge.exe	118
PID 3164 wrote to memory of 3352	3164	msedge.exe	119
PID 3164 wrote to memory of 3352	3164	msedge.exe	119
PID 3164 wrote to memory of 3784	3164	msedge.exe	121
PID 3164 wrote to memory of 3784	3164	msedge.exe	121
PID 3164 wrote to memory of 3784	3164	msedge.exe	121
PID 3164 wrote to memory of 4324	3164	msedge.exe	128
PID 3164 wrote to memory of 4324	3164	msedge.exe	128
PID 3164 wrote to memory of 2328	3164	msedge.exe	129
PID 3164 wrote to memory of 2328	3164	msedge.exe	129
PID 3164 wrote to memory of 1480	3164	msedge.exe	132
PID 3164 wrote to memory of 1480	3164	msedge.exe	132
PID 3164 wrote to memory of 1480	3164	msedge.exe	132
PID 3164 wrote to memory of 4412	3164	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://agenziaentrates.net/it/index
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa9c7ec188,0x7ffa9c7ec194,0x7ffa9c7ec1a0
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15458735946601985495,2258308395419810555,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6100741695981401999,11375157123108726214,262144 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,10721478676267253070,17221651140167724903,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14698031402523197086,13049754236708127107,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16569862405558201988,18029583125862181026,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1928598664823191152,10738733771076962520,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7247663218731463287,15444891271916192752,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,397222548505334453,17331671871966432989,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5100,i,16638036843157551976,16122541469153573008,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,11679510462608245428,16229787918919933604,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,8573758170958678180,11784626237198596823,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7181230138104341179,11579331099814943468,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7181230138104341179,11579331099814943468,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5080,i,2849127554581904253,3371518834373865510,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,17161707899963327063,3396682323061690131,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,4413600282402588240,1938963797229306728,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,7148175650919457672,5765962668102217846,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,4526922554937375398,2383926939585327337,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5468,i,3007752210662224849,13970376264119239788,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1700705300729175049,16091173682190130738,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,4151278862029730933,5902448654646608419,524288 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4296,i,10284699175709667777,2014707210944203203,2097152 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6324,i,13484006547858674609,3123315451072610122,262144 --field-trial-handle=2264,i,7215797158375960688,11883235587053348397,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

12209d29-fac4-4ef0-830e-147faf94f028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12209d29-fac4-4ef0-830e-147faf94f028.tmp
Size 27KB
SHA256 c42ab53673014ea0c2c3c68f03009457ba52c74e7a5de4a6cff007d54a967087
MD5 29bb71b303a93ad36693fd744a0ae7e1
SHA1 d54cf1ae3f6292364f85016721962508270f5f1d
SHA512 02c2a644957313f540c0a08cb05b8c5528fc1de2f07ff764f5c6cb2eb052d30e1b5718c5ddb311aee8f30c7bf812efb4c8c129754b980c5dacb2e28dbd39927c
SSDEEP 768:qryQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH31roYZpFX:qryQRbrWvvlpZu1jaXKLf33OYZpFX
TLSH
T181C2F92F640CCB7E4FC01E9DDC6A6F972EA802C766588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 11422ced04840140908763477be41fc998c9dfa1cc0bc8dce46457d381873ef1
MD5 134dcc14a6e5e95db1fccd0bafef18fa
SHA1 0b42af900f7a75b023150a9b77aa8a8037cf93ac
SHA512 c56a74c82b8de3ab6ab51f1bba41ccacd1acf1b5400fd2954b4e51de92bdebd17bc7d020e437c70162e4c7f2ca88a3c44cebec60d660e8a5fecc2d15422a0075
TLSH
T11DE026E904C8C22EA3187447816C470EC2803B0BABCC7E2A6708848D7A83080B283E99
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 efb21c5f988a5d4cd31f6bacb0ff82b76a62a1ef0ec029dbec35a9763f9acb72
MD5 21c0abf480b3c77eaa9a107cd846cb78
SHA1 e116737f70958db78422bec1789f9ad6c9fed819
SHA512 b5a523876bf63a655fccc29ed213e81d23099c45137dfded8c31ad1d5f324390e2194de563b2583a1dffa94d8afd817af60061b8f0366c82f81d11fb05efc5a9
TLSH
T10A61F586FD90E4E3FB989130A9FF258AEA6555B0988F2D3200AEF5FDEF15B9C4004074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592bd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592bd9.TMP
Size 3KB
SHA256 cdd79dc103fd3349bbd42b2e7fa98cbc2a9c8dda696979178377f33f17a4df24
MD5 1ade0e1b418918cb40c0c5a04e8c4433
SHA1 377fc4f93ba8422646dad374d4ef2398925cabd6
SHA512 d49bf82fcc677f06b0da11e40fd650f6425ec14303ce6eecd8faab83419a44ecf5242c3e16546f48cbffcc0dac8460b31085932c319e286b40bf92d488d7a28f
TLSH
T1B561F686FD50E4E3FB989130A9FF258AEA6545B0988F2D3200AEF5FDEF15B9C5004074
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d459737c6c6d23b77d228c53ad9c952b59308a20d8f580227d0ca0a874087129
MD5 79f8cf6777e703c8c24d2e4aef8de76b
SHA1 47bb6ab9da052de386bd8bcc0cacb0ca8a782aa3
SHA512 2ff25cbddc93d32ce663f2991350042e26fda0b4ea3b6d7d8c517ae2fc47ae700443073a74c23334e302968fe3bfe634e34ab6ab8c93d3ef27b978e43d957dd2
TLSH
T16311BDB7C3D5856E890116F05A24AE2BCE1D0606821C7C15D5D4EF27D3F3075E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dd4821b8560f0daed68907247af6acf1a8447dec964490035a54c20180704772
MD5 22ce12fce13146569c5a17025c4ba605
SHA1 5044ccb692ab34fa58f35c0103a990aea221fabb
SHA512 48f478fb99542421b309bac86b0bbd99ff4ec7f930948ad6d30e1f29e4904fae305fb96e95eb9f66b0d90714810c1fea7a8d9fc99cbfe6406e7775abbc18b05b
SSDEEP 192:sxZ7R1WA/fEsUzhIdp/dHW6+WNGYaQnDIgrJ:sxZ7aA/fEsUzKlHbGS9
TLSH
T15C12D8156E28A57B8CCBD24DBB25BF13D6F9103291D51E48EAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 53f548cd48d41bfe7f7068943339e3a655cfb9312397d603ee83f633794fc02c
MD5 960c511a7f0d2c122aab8f8f66798898
SHA1 829346dbaede8b9a07e204b835c20d50f9588118
SHA512 2de4d2f04f5c5cfe450e88b1a636ee923a9fdd11accc9646e8f4a3757a4506d703371451331c154f9ab9ed75408ce4e53bd5486d979d6589e17d3530ab48a5fa
SSDEEP 192:sxZ7R1WA/fEsCXzhIdp9dHW6+WNGYa7nDIg52J:sxZ7aA/fEsCXzKHHbGP4
TLSH
T19222EA566E28697B8CC7D24DBB15BF13E6F9507291D12E48EAFC8A1C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c741d44ab16f66854abf8558f23ca0ceaeb6e43550eec4cae2fbfc43ccac6dbb
MD5 a70d526108db1f7bc78dfd1ec53dbf0c
SHA1 136264282619baed7862293d1335095dfeda6ba5
SHA512 dd9e5d0ad0a261c3db9447709f3a1afb970d744b2dae3c82b41a1ad4f9a960ec201bed9023c41bf0db4ed5984272e92590ffef5c10b6c1f8f0d6af7a8fef7fd4
SSDEEP 192:sxZ7R1WA/fEsCGzhIdp/dHW6+WNGYaQnDIg5UJ:sxZ7aA/fEsCGzKlHbGSq
TLSH
T10622D8156E28A57B8CCBD24DBB15BF13D6F9107291D52E48EAFC9A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4c6072fee974c507299330ed2008a43dd25e37fcba77e04b69d0cfc92c5333f1
MD5 4c1fd204a23f78e5c3b6a72f3bf52c2b
SHA1 076a639573be67188fa123ad3ba534087e936def
SHA512 7deeafc5218bcc803643a625fd72d9fad7feb15166c57b755e04834adfb4592a1e9944221a5f329d89fe1390f079d2436966e422c789f3951c53eb774d0232ac
SSDEEP 192:sxZ7R1WA/fEsCXzhIdp/dHW6+WNGYapnDIg52J:sxZ7aA/fEsCXzKlHbGp4
TLSH
T1B822E9156E28697B8CC7D24DBB15BF03E6F9107291D51E48EAFC8A1C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ca33da4ee621f32e744fff23be3e574918806a92dc43f8af83d130aaf39fb4d8
MD5 4d0d429a4c23b40f7dc9c3f2cc78b565
SHA1 f38b31e8f8c90b85d87c436051c8a8c04d7b21e2
SHA512 88c8f6e54b17292cbc2996605a8970036d3591def1617598c9160469072b228f7eb6213ebe5b895b13e0db30b9c2e28df92f967f6750c4444387419b15b71164
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQzE:KYduKGwC2JSK60NTOKM4eK3ObXRJJ+z
TLSH
T1EA910F8036BB421039BE399891A09B5F524136773119F53B7FBD00568E6BE581CFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c78c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c78c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b00cd16455e673cdedf3a947cb72fa272c61f7d77c8ea556261172c4772d2862
MD5 1a76058a2fb9c79893b44ae9c5bc081d
SHA1 9fc66eb88899f105fb6f31944683820c4127be6a
SHA512 234944ec8dc1a85e057feea3ea44628e7037c89bc80ae023e7f1752c0a26bea98b1e5abd4473553d396d51d588e4ce98585f9c2f27b78b40de53bdc1453a9a15
SSDEEP 384:vBiFiZcI4zsN58TUNTUlIlsqmfSp5u8i4t+Ldf5iNcSRo5:AFQEowgUQklLXwe
TLSH
T1AEA25D375CA4987B6DF79A85F94736139EB440A7C6C8AB94E6DC9B1E00DB1D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e92d4653d7a1aee4af7adf8172ef71aa56d211cbf1287d85282ab45c6d34f076
MD5 11091ae4f9892d497d64a40179dc133c
SHA1 ca9c12686d725f1f2a36c5c2b79a85b6716f56f3
SHA512 09049066fdf007364c40b55e8435370d4d90f4dd8407075296aa8f54654e656a58517ec0f040a620ff1f36fb7618604afadc6d4906a342f9eba265e42ff14fe5
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5ymD3BfPGxvw45RxmJm78lFfxQpLka:SONu6iDCQmiUyVxHq5u88P4ASqO1zU6
TLSH
T10802E739BC783C6B9EF3AD05B48737175F98116FE7942B84C9E81A2D01D769C2306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f30280dd530805ba06d7d9773c2afe9b8cb2161178caffe62a1a55751840ae46
MD5 daa6eca2d772dccedca445b410d13db4
SHA1 9a8beb0424f3b3c07e31b09d3723d7d174c22327
SHA512 61af48075bfd5e6078630515dda355256c279986d1b38ffc93008e12754ea4f4c3f6a05772425676be2e378379312cc87c26d804395bf7619b697a87501f3a2d
SSDEEP 192:uam+xasuheOwQxMGsNntQhnjymDPRcQmiU1F/94p5u88P4tmethwlAA/aiGf5iNu:uZcIhsNntqmfSp5u8i4tFLdf5iNcSRo5
TLSH
T1D6827D365C746C376DE7E481F9473A135EB880A7D7C86F84D9EC9B1E44DA2A4030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 375260d577691ad5275130d7adfb6c5550ba24b24b1895d01e47a6ba71aeb967
MD5 1e05dd57d2eab2b2bedc703a6a25c06d
SHA1 23fc369a07842cc5df4bc7b08f56d096ecfb24fb
SHA512 4dfdb30d0705dc7ba44346bd4323578b35d41d22e3303488731d265457ddfe216c9b3f83997b18d31aa19e3af722ae58e9d59e71672f17cfa91ec7b0c7e3d906
SSDEEP 384:n6ZcIhsNnsqmfSp5u8i4tFLdf5iNcSRo5:4hHQkcLXwe
TLSH
T1C3827D365C786C376DE7E481F9473A135EB880A7D7C86F84D9EC9B1E04DA2A4130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41de0758802dee5072e591e66c21f3bd4ca24b0cb4c073be7568ba95e2ba8107
MD5 1b42e1416cd34df36cbdff76335fa9b9
SHA1 921a77406cf58c2cd60bff3d1e658b355dd6a65f
SHA512 6e8e811fdea3b0d1bc09d45610cc9386326abfdfe7da81a067a1f1d1cb4746e8fe5a0ce7d67608048ef8d24ebc97e22c2fb57d2aa395cd165beb1fff008db4a7
SSDEEP 192:SONy6iDKQmiUyixOq5u88P4tmethZuZA/aU6:SONy6fLOq5u8i4t2LU6
TLSH
T141121B3AA8787C7B6EE3A850B48736135E95426BD7887F84D5DC161D01EF2AC230B523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8366ca71543ae048ed93c514061cb21c1a4fdf9827406a3fb3fe17238ff66029
MD5 bde407709f71cf01a4489a6da0db2fe2
SHA1 92581279997d455794b46b38990374bb82bf4d69
SHA512 18523e44ae8419eb17587f18c16f0d903f5ddb371d7d5cc1f562d1bc94431888016f0b28525ddd914a956975e06768f3057f86942bdf12f216f31ccacf02980e
TLSH
T1D541065CA6ED1148B3727F56AFF6A82D487EB9772F06945D00010E4E0662A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download