hxxp://youtube[.]com

Analysis

user interaction
yes
max time kernel
107s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/07/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample260728-aadygatejd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296704297499884"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{CE70AF44-0C91-4B7E-8685-E477EBE6ED8D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{B584F08C-0C45-4D3C-9A86-D201E9111806}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	taskmgr.exe
Token: SeSystemProfilePrivilege	3140	taskmgr.exe
Token: SeCreateGlobalPrivilege	3140	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3180	4944	msedge.exe	80
PID 4944 wrote to memory of 1368	4944	msedge.exe	83
PID 4944 wrote to memory of 5208	4944	msedge.exe	84
PID 4944 wrote to memory of 3288	4944	msedge.exe	85
PID 4944 wrote to memory of 5208	4944	msedge.exe	84
PID 4944 wrote to memory of 5208	4944	msedge.exe	84
PID 4944 wrote to memory of 5388	4944	msedge.exe	86
PID 4944 wrote to memory of 4376	4944	msedge.exe	87
PID 4944 wrote to memory of 3288	4944	msedge.exe	85
PID 4944 wrote to memory of 5388	4944	msedge.exe	86
PID 4944 wrote to memory of 5388	4944	msedge.exe	86
PID 4944 wrote to memory of 4376	4944	msedge.exe	87
PID 4944 wrote to memory of 4376	4944	msedge.exe	87
PID 4944 wrote to memory of 5656	4944	msedge.exe	88
PID 4944 wrote to memory of 5656	4944	msedge.exe	88
PID 4944 wrote to memory of 5656	4944	msedge.exe	88
PID 4944 wrote to memory of 5576	4944	msedge.exe	89
PID 4944 wrote to memory of 5576	4944	msedge.exe	89
PID 4944 wrote to memory of 5576	4944	msedge.exe	89
PID 4944 wrote to memory of 1700	4944	msedge.exe	90
PID 4944 wrote to memory of 1700	4944	msedge.exe	90
PID 4944 wrote to memory of 4684	4944	msedge.exe	91
PID 4944 wrote to memory of 5560	4944	msedge.exe	92
PID 4944 wrote to memory of 5560	4944	msedge.exe	92
PID 4944 wrote to memory of 992	4944	msedge.exe	93
PID 4944 wrote to memory of 992	4944	msedge.exe	93
PID 4944 wrote to memory of 2040	4944	msedge.exe	94
PID 4944 wrote to memory of 2040	4944	msedge.exe	94
PID 4944 wrote to memory of 5916	4944	msedge.exe	97
PID 4944 wrote to memory of 648	4944	msedge.exe	98
PID 5916 wrote to memory of 2488	5916	msedge.exe	99
PID 4944 wrote to memory of 4128	4944	msedge.exe	102
PID 4944 wrote to memory of 5600	4944	msedge.exe	103
PID 4944 wrote to memory of 5560	4944	msedge.exe	104
PID 4944 wrote to memory of 5508	4944	msedge.exe	105
PID 4944 wrote to memory of 5508	4944	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff981fac188,0x7ff981fac194,0x7ff981fac1a0
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,13986340875044562435,1123600403425313337,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,3983012650771092587,17900744630436234684,262144 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:2
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,13768545070862487904,10821863166810283999,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:13
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3040,i,2128360756576099429,6877275364991035675,2097152 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3044,i,13435444315316410183,950287842676496659,2097152 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4808,i,1641292728342329995,8334673895976472217,2097152 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4948,i,3928396082497792,7478293455434822050,2097152 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10106268465379398342,11379235098740555906,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:12
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,6691212244569584139,8869256375303378808,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,14305490973525942215,18390561004831960269,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,2896225190449807978,15448275292286429507,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5746034726612395677,17649483325697931243,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,3918468393548633833,13448318039644948291,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1839526159022532746,3724378878056324564,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,3918468393548633833,13448318039644948291,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4233266916409898780,927030223589048891,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,12889517498799661998,10185331661188254816,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,9663081846443727804,6835513190246699551,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,1550852151159366218,8066331292398360392,524288 --field-trial-handle=3748,i,2574987358462551524,13743044435815726889,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3084

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1ce6eadde7995dc0f01d65847a3f08a49db1f2101cea213848996d15df7a87ca
MD5 d80dcb448e31f171e9bd7428795c6a2a
SHA1 14c5d6775859cda5a3e646dee9e266988097d57d
SHA512 094c8315fb6e6f9764046d796440c815c9c079c6f938b071dc99f0a6f5302f4d7505a74ae7ad3673f5f0c28749d7ae5c8604ab4bc130d15e8f7e7937b834a9c5
TLSH
T1ADE02BAEC971BC2714FD0B19E055074AEA5013572680855F3A3D490C8FB472A468681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75c494e209f1a09339fccaaa3ee6e1d0456c41be4dd6ce9f6b0d7d0d8bcd916d
MD5 91bce2cb92e76f1418efa6c3a1f1c7b3
SHA1 703717aa86aea473748ce7a1962db09b08068f27
SHA512 8066889b4966273a36533448c88ac0d1eddff72399cdfa03d8256681c27a43ae9bd404852bf1574ce59f42f081af890b74aa6f79a82b92db40bbe74ec32ae0c7
TLSH
T1CC812CD241B303E7EF512AB7F0E1282E733096A8F7030E464DE7B8B96D1E751D5A6408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ec20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec20.TMP
Size 3KB
SHA256 b4ea34b485846c425a8a8031257e0bddb77d089506eb54b955d8a875230f1ff0
MD5 d14b72dbe2d8340049417ece66d1bb36
SHA1 a432db19fe1055263e7a61861778f4f913799ee0
SHA512 65a7c440cf8272530629977c289cbf9820b9583d3ca526d24a6b2a34a8e1720b3fcc93a5ed90fd172bdff0ec0fcb035ffe4d14b5e91dad80cf5a94924aa5a1f1
TLSH
T1F671F7E042B303E3EF621AB3E0E1193E773099A8EB031E450CE779B96D1DB61D526408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 45c208d0dfd6706693d767e74b685b70a73e7636d17f81a472b45475ee52f3f0
MD5 bc0f85cd064eb3011071c5fabe5169c3
SHA1 28c2174e16fbc9ae6f2bb59a718af91856529a7a
SHA512 5bcbc3bfd269354f40552cb07a1887d5dc7a88c33de47903c8101336e1c5362c0c08c8c77de3c8fc874d66de445c2d7b792025aaf71426d77ba8606f6edad13b
SSDEEP 96:D19Ou0VumuIuuu8uCubtaaij6EzauNugueufuHu5UuPhu/QGugOwJ:D1QZhnhrpUaaij6Eey1DOczyCQG6W
TLSH
T181A19DF3C3E4862DD81156F0EA583D2BDE2D0924832C3C6AC9E4BE5B53E6471E245A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a83ad0628b3f762164738f9942d725d7ab7328ec7428923e1c7a0b81949a8d4a
MD5 0911803fb3e188f887ea6000da5a51c0
SHA1 1893e095f776307683bf312d4b30dc44bb280aa2
SHA512 c6406f5631276b39ed8d17ce08be9358600a14fa55b09ea44b8d0dcb9d8635cf9a0a0319ba09daaa0b6c9afc0bbfe8a1793e406ab6d9be64dba938a387fdbe07
TLSH
T14631A0F783F4856ECA0195F0B618BE2FCE2D0515432C3D9A85E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ec1ab54f5dc05fd0880b98e6de01b2565747ad3d99a9db04c39c0f3764e7c4d5
MD5 c8683c81d618d981ab75f7ec972e9818
SHA1 668183ea0836bf5a625beba70e6b2f5599edc81b
SHA512 cf699503377e044575a82db551de5a585f2cb3c30104613501ac0c2fd2cc881f58c1975235b76c48a40063ef1cd8747f1983988ef4fd9576c474c45d681b6dc8
SSDEEP 192:sxZGvXRfzyMqZjK1Ml8MFva/fPMs8AH/xE0CXULYAzodpRB0G1x/W6+WNnOn/Y0F:sxZoUdy/f0s8AH/60LID/bU/533jB
TLSH
T12762E816AA34597BCCDBD219F955BF53D6F91422D2904E58AAFCCE0C04E7ADC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e5a0511d-c11a-4c09-a420-1591c963b692\index-dir\the-real-index
Size 2KB
SHA256 6a079ccd83e2b41dd2a5dea1d97ac38f0c3c0b9bac7dd2e7635e16cbdc704330
MD5 86c69f8122daf50532c5c9e3d7073d13
SHA1 d4b8f2e6fbb806d199385362fa2cbb2a55c5a5f2
SHA512 2bb176673086173c6c39ef8f1eabc2c7e9ae2324bdea87c264c8383e3bd17365de9acc2a859934f54dd7bf00b76cf7ca7291bdfbc1dd288834861dd9655224b6
TLSH
T1D241744CCC80ABADEC7451FA2D9815F667752D38FC59C2624094B1B13403AA81B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c88b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e5a0511d-c11a-4c09-a420-1591c963b692\index-dir\the-real-index~RFe58c88b.TMP
Size 48B
SHA256 57c0491fa9a950cdd8599c74a0b54097ab441163f90aff06642d7181fba09997
MD5 a54e625bec1b2c4927f7fa07e03c2153
SHA1 dbccf5870b44d8f0a26eaa40afb9b2618ea80e6b
SHA512 ed02fc155688ff2288be5d89664a530c51bed0c37a99cb15f65d8929557c257b2188e1250c46d9f7899d037582e7894af5f1af4d1152f1a02eecf9f0d44a2fdd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 af0e455d3807f80a429e906e149b6e3359b66d90cbc93ee3a033345fce970acf
MD5 6a7a368b8cc8777900f8752f4c2c36e8
SHA1 db4bd82fb481dc298727e87d419c7dd3b3b72d96
SHA512 0286229ce512c24ee7078fd98d3b04a91e5387bd1788bdf163dfd233a7a147f0f12f898c92a20eb48aaa4ed91f448e1a1aca73eb39ab68d504cef20128ecab69
TLSH
T118D023DB0531EACB19749E88503C694D742EDD44DC84CCE56F04711974B8102CC82579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 60a8c197fea74b26dce7f2a20d83bac80ba6118b7ac704abddf8c5764e4b1064
MD5 571338459b5f309543861a8cee2ede87
SHA1 fc30af30bf1475c270a1139892b82c6a64bcd49a
SHA512 9af17b2b216852b246a3f3c66c966983753e978618ce2b9fa5e969416d31ee5124a0a50f0e4cb569e6052a97b84c897796554d4c19a50084d4da4195ee6fb853
TLSH
T1FBC09BE31910D7DF0D749BC8213C565D952F4548D4D8CCF4AB0874017434513444197A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 3095ef26c6d7bc497ee703c05f1fec3052f79fcd945916e55eac2004c124d950
MD5 c8f016a52f718828203bad86bc74da30
SHA1 f7bf46e8585379b4eed05480c01ad8378ec279da
SHA512 1c106f9e5d3d729108060f5795fe5148130ddb0bf6db0948cc3f3859d36d97d6b59e054d367300014e0facdcccc3686e5da2e05604ad6727fddb60da3d82a978
TLSH
T11FC09BD31D10D7CB0E7497CC313C6A5D952F5548D4D8CCF4EF0874027174513445197A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5871ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5871ef.TMP
Size 137B
SHA256 823575e2c0f1f514b7fb669f1b9c687f0bcae82439b001c8120e9145af97d462
MD5 e91194fd5277e75399a16940cdb33ffb
SHA1 00ed97d44173a6f802d9dbb6e6cc764bd9d87d1b
SHA512 f6619506cb22fdaa60c33c45c1c40a99208a380f0b89e98b058bbafa7d3546298385ad6dd2cc781934897d5df418447e5ede91a054dc951ac9afde485bd95dd2
TLSH
T197C09BD3191057CB0F7556C5213C564D953F4C99D8C8CCF4AA0974017034513844597A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 bec3d02b67c30267134aba0ac67fa05ae8b7a7315a9210455508590186f6eb24
MD5 545777798f7d92c811317141f49d25b8
SHA1 e80d52ea92663671411eff7197da2d71f712117f
SHA512 45ceb7748d93ded4419977f6e9944f1e3e13d872db4eeb420362210caad87f3a2bc9bb8c6495e4ff1d4b597a647b6f16f1eb98abfc3384137cdcc28a6d3b0a6d
TLSH
T11AB00216C51E5146C9000BFAEA8660AD37E56D5F0702352144BCD1F8F9652D471A625D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c0da.TMP
Size 72B
SHA256 ca11506ccbaa0826e31a1a48b2d79294d51918a0438884a10e36ea58aca02ca7
MD5 310a2519714097cf617e2069603a175a
SHA1 6ff068d3ac801c5660a69078bc9d4982ae4822de
SHA512 ad0384c6134954b4d97430a3c89e3f8b49abcf0351d87745fdfdd8ca5b6e4e129e8f9f1c994d8ffedc5df005c64fed05470ae07cf2627cb09619ed2c1e7e5b06
TLSH
T158A00252824B251DC50906B6140B6360134288997600561644D0D498EC911C0A561549
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d4b486944cb63b679ec76e3c2f3bce6525258876cde6ecc50461a409b0302192
MD5 877753989279ce18fa7e9a9809a4e40a
SHA1 ca618d84b8e0365ad4c3269ed62ef30a82b869e3
SHA512 cc6dfa4c41e12cdb8121790a655a35ae7554634b39aabccba6d18f5976bacde901a3c5025c8742ebea4d018c33515bef971e82bddf5b03856a95e2fc942e75ef
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Svp:AFBHhTofhno2mB21q3Llbfe3sLDdeEp+
TLSH
T150B27E57717B12023C3D290CA6A19B370E8272A3355CA56F77B800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2f9ad61abb24e9e1f5ea01a6d473f6e8d736e9db622e9d765a9473495fc345ab
MD5 245502a48283e8ed53566c5e1dfa2f24
SHA1 cd4f1cf2dd10ea8c71e6139a951fe1e562c6cfee
SHA512 376608fc676d7110c89db8d8657d96841e526cd54887aeb9480067e8449bc34ead68345ee84b256a9e820f04a4ce5e3232e4791d861c2e603fb3e4b77c909389
SSDEEP 384:nUiFaZcIn38Nd8TUNTUlIR0ymSpIjGfbwocWK1Rbi/fOOObjI9G6w7/UzHy/7Igh:vFYn3GwgLwocW1fO29MN
TLSH
T1CBD25A32EC64CAB7EDE78E99B74A3A07DEE45163C6CC9AC8D5C85D0C00975AD430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a3b7221418d04a9dcacf1baca6bf8a1d61aeea3290ff6e9ac98d74c0f83bdb13
MD5 9049ece40f3735727fe60da27dbae14c
SHA1 db3c1a7672be30375bc58d982b7724b3ed66eeb6
SHA512 e1d2f7d09ff5915175b71e3fbeaee580c2585d283a08043fca3a863ebced5302a2a39cfb8a33470d93a4cba974552a3d91039cc4528c53cd8cbc313267ad7be5
SSDEEP 384:n9iFaZcId38Nd8TUNTUlIR0ymSpIjGfbwocWK1RbwOOObjI9G6w7/UzHy/7Igh:0FYd3GwgLwocWJO29MN
TLSH
T121D24A32EC64CAB7EDE78E99B64A3A07DEE55163C6CC9AC8D5C85D0C00975AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a82e8e08a99bfb6d95384d564422c3a5cf021c7c71be4b176580c6a656a85eaa
MD5 28f42015e98d37f7401ce928fd230f27
SHA1 ee206488fbd7cada6662754a411dc333331096ca
SHA512 1e2ea583c7ea7cb1998444e9a8f6cf7c673b9d5ba918bec81492913683ee46dd8ea679db9d3357ae0082f42e30be6355441745bdb55c07463184f9bdee63e060
SSDEEP 384:nUiFPZcIN38NLS8TUNTUlIR0yP+IjGfbwocWK1Rbi/oOOObjI9G6w7/UzHy/7Igh:vFHN3QSwgiwocW1oO29MN
TLSH
T1DBF2D3F298D789B6E8AE4B97A37D2E029DFCD153B6885684B7C45D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8a64e42535f7abf97ba1bcf97599810c9528d1bd952439e79b447b460f996f15
MD5 62419fe133f01225bafe51ac1f38aaa0
SHA1 08b11b2f1a378219881279eeafdc32e96558103a
SHA512 2a466fcd738537250704b91abb75a77a2f47034b3696c3f9b002edb2a2446700f37c694ec840570706d961c4686fba90f8fa85049655c47ae7891f263a6e3623
SSDEEP 384:n5MiFlCcmyWCP38Nd8TUNTUlIRGymSpIjGfbwocWK1RbwOQ3RHy/7IgU:tFEcpP3GwgdwocWJOQ3V
TLSH
T1FCB23932EC68CAB7ECE74ED9B64E7A03DEE45163C68C9AD4D9C91D1C009B19D530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b410767959888a6a7ca2ac33a223e59932d1b4a9884f93cfbb0582bbaab6f500
MD5 dd9fa5fbb890a961a41a7784b3c648e2
SHA1 154d5634518b315c69b9beca574817d06dfc6b99
SHA512 14822b68b6a2a4f532ff9ef1bd31a952be0565645404f52160b3dfc5e79dfbac2b99adcd8b32f6f8921962f80c7eb3cc4dd40abc8720c7540466669ed6a2316e
SSDEEP 384:n5CiF9CcmyWCs38Nx8TUNTUlIxBydcdFjGfbwocWK1RbeOhkP+lFYS/5xHy/7IgX:zFccps3WwgLhocWpOhkoFYS/C
TLSH
T147C25B32EC98CAB7ECE64FD9E64A7A07DDE04163C68C9AD4DAC81D5D00DB19D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 58607ddca7206fe2ae3e0d17734327f008ae4a7a8fd4fe9eb43b88ccab9206df
MD5 d80195d219ac060fcd25d0a4eb553eb5
SHA1 816975d5c228bc1f90112e617a598629d6696d7f
SHA512 3ba42536ec182ea9692586af7eca94120cddaaca7530ce4a4493741065b0b16d1351ef28090d6c8f5840bf9ceb8e72135c1b21af91ce14fcc2035a55db693949
SSDEEP 384:n5riF9CcmyWCs38NV8TUNTUlIxBydvLo9ajGfbwocWK1Rf9hkP+lFYS/5xHy/7I8:4Fccps3iwgGkiocW89hkoFYS/C
TLSH
T197B24B36EC98CAF7ECE64FD9E74E7A07EEE0116385889AD4DAD80D1D009B19D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9250b7036301c155efdef876c7adcf4c2618048ed856c420fd1545564cc33fa5
MD5 16f4023157e5499b4dd2ba2c1f91811c
SHA1 e41dce36a30fba1bf8e12d192d731aed4ab4c20d
SHA512 6645c2317b625c2db2a279f6aceff7c9be51750c210b76befffa7da2a6e5688671994c25dd212366e0b2762e7388cf7f6d1756d1d69a054f08244e175779fa2e
SSDEEP 384:n5MiFaZcId38Nd8TUNTUlIR0ymSpIjGfbwocWK1RbwOOObjI9G6w7/UzHy/7Igh:tFYd3GwgLwocWJO29MN
TLSH
T1BED24A32EC64CAB7EDE78E99B74A3A07DEE55163C6CC9AC8D5C85D0C00975AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-424-0x00000243EB030000-0x00000243EC030000-memory.dmp

Download

memory/3140-303-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-304-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-305-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-306-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-307-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-308-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-309-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-270-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-271-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download

memory/3140-272-0x0000016FF7B30000-0x0000016FF7B31000-memory.dmp

Download