hxxps://ctrk[.]klclick[.]com/l/01KY5163T48T6DJZBXZDQCZNV6_5

Analysis

user interaction
yes
max time kernel
66s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ctrk.klclick.com/l/01KY5163T48T6DJZBXZDQCZNV6_5
Sample260811-rmybbavcma

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309315663673519"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C45F5BD8-1DAD-476A-AB90-65EE2E3302FC}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
220	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3040	4116	msedge.exe	86
PID 4116 wrote to memory of 4660	4116	msedge.exe	87
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 4548	4116	msedge.exe	89
PID 4116 wrote to memory of 4548	4116	msedge.exe	89
PID 4116 wrote to memory of 1248	4116	msedge.exe	90
PID 4116 wrote to memory of 1248	4116	msedge.exe	90
PID 4116 wrote to memory of 1248	4116	msedge.exe	90
PID 4116 wrote to memory of 3440	4116	msedge.exe	91
PID 4116 wrote to memory of 3440	4116	msedge.exe	91
PID 4116 wrote to memory of 3440	4116	msedge.exe	91
PID 4116 wrote to memory of 4928	4116	msedge.exe	93
PID 4116 wrote to memory of 4928	4116	msedge.exe	93
PID 4116 wrote to memory of 4928	4116	msedge.exe	93
PID 4116 wrote to memory of 2776	4116	msedge.exe	94
PID 4116 wrote to memory of 2776	4116	msedge.exe	94
PID 4116 wrote to memory of 2776	4116	msedge.exe	94
PID 4116 wrote to memory of 1808	4116	msedge.exe	98
PID 4116 wrote to memory of 1808	4116	msedge.exe	98
PID 4116 wrote to memory of 4704	4116	msedge.exe	99
PID 4116 wrote to memory of 4704	4116	msedge.exe	99
PID 4116 wrote to memory of 4372	4116	msedge.exe	101
PID 4116 wrote to memory of 1044	4116	msedge.exe	103
PID 4116 wrote to memory of 1044	4116	msedge.exe	103
PID 4116 wrote to memory of 1044	4116	msedge.exe	103
PID 4116 wrote to memory of 4368	4116	msedge.exe	104
PID 4116 wrote to memory of 4368	4116	msedge.exe	104
PID 4116 wrote to memory of 4368	4116	msedge.exe	104
PID 4116 wrote to memory of 412	4116	msedge.exe	106
PID 4116 wrote to memory of 412	4116	msedge.exe	106
PID 4116 wrote to memory of 412	4116	msedge.exe	106
PID 4116 wrote to memory of 1060	4116	msedge.exe	107
PID 4116 wrote to memory of 1060	4116	msedge.exe	107
PID 4116 wrote to memory of 1060	4116	msedge.exe	107
PID 4116 wrote to memory of 1012	4116	msedge.exe	108
PID 4116 wrote to memory of 1012	4116	msedge.exe	108
PID 4116 wrote to memory of 1012	4116	msedge.exe	108
PID 4116 wrote to memory of 3912	4116	msedge.exe	112
PID 4116 wrote to memory of 2136	4116	msedge.exe	113
PID 4116 wrote to memory of 4372	4116	msedge.exe	114
PID 4116 wrote to memory of 5104	4116	msedge.exe	119
PID 4116 wrote to memory of 5104	4116	msedge.exe	119
PID 4116 wrote to memory of 5104	4116	msedge.exe	119
PID 4116 wrote to memory of 5060	4116	msedge.exe	123
PID 4116 wrote to memory of 5060	4116	msedge.exe	123
PID 4116 wrote to memory of 220	4116	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ctrk.klclick.com/l/01KY5163T48T6DJZBXZDQCZNV6_5
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,1867804794042967696,13432572727905673758,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16539848627212458645,16762927087451927477,262144 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,14541631761619544976,6214480948206425281,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12832584631358372621,14666156914036382898,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,2430649124693888572,6639056860332568511,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,3744730170188476879,8745668907410379532,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,4547818024255300763,17996643748309093563,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,5702657259621197060,4362699426466216053,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,13896285513102489464,6873504594101049205,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,5691558192606305548,11117601882649837891,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,5691558192606305548,11117601882649837891,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5976,i,1313922503355143112,10873117830752099158,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5036,i,6102535630410677218,6637345221346491814,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4800,i,15735444994843503516,14950844413322516515,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3732,i,10784271685986977651,8877791472511230999,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6412,i,12032788748264291847,17495371298140842316,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,6478443440831172722,9410432882442207965,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,12056273147432336848,6144696514931203679,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,10795566804922007815,9044916309399016767,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6812,i,17761300472084086445,7553608966201255788,2097152 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,11817479709103623414,4215368575978253320,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,17269716737692565757,15179740907968982361,524288 --field-trial-handle=2232,i,7906348637561485196,4347370481222593532,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 22KB
SHA256 2351acf8f21d01d80749f1b54fe3a1e86ecfeb620b49dcba3e677e9145dbec70
MD5 de064ed37f0debc518077c01c64dbfe3
SHA1 b0cff061b9c1d66b0c71f47512c2a7d88136da16
SHA512 06fee27fb81168f827eea2792e0a21c02c9c790ea582204c73fe7c445cbf8fca5834699120dfc62e460f51a90296ad22fcd0d4c1b177cc02e0a75c7d36517f09
SSDEEP 384:lZvuqkhyL+UjGNxR1Hr61IXm8CZQaw6bfnu+wjKZVGsvS8tg5I0e5Aadax:LXeI+UjGfHr61Nn63CuiZ8vEg5IDXK
TLSH
T1C7A2E166C913BD58CD8BD50333475188AA43E028A3CD763E8F6BD560BC21F86E661F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4a91820cfd5d6212dc120ff60011aa5db2295f6819218f971db86a18af1d8e15
MD5 5bda60fa8b9707863701768eaf9605ec
SHA1 afb1f186aa300c3d446d32ca2b73499fae89fa70
SHA512 4d74fa1bd109522af1f33ebda9c9d21c2f6c8235e2ff8b258a037458c9093f38a0a5b9ee540a2875feac9be7c0e3cebc7a5ee94e19eb8e786ab147bbd9651f67
TLSH
T17951737447AE24E0D32D06F0C8E3C6993B3593C5FB4B5F3205705F76AA267A90626F19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c52f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c52f.TMP
Size 2KB
SHA256 4c7e932a979e594d0c5aa4431c0cd39440d2a5c088a716c0f6b09f4dc1505db8
MD5 2b82926d3be08141fb611dce28a665b5
SHA1 c2d955d390ee7836dbe291c0a3db7b334b69ac18
SHA512 2cc064970a9aab758a0ce9327f7972e011601476e02d939447b04216128bca5fe82142b025c6c47d080200f69dde6019776129bcc363aeff73419832dc24814d
TLSH
T1FA51737447AE24E0D32D06F0C8E3C6993B3593C9FB4B5F3205701F36AA267A90666F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 2f255ac78aa9b4cd4061327cc013d78bac3a032b8ba499d394fbbd3456dc747e
MD5 7dbd089ba295bbf76aea78ba1aeeec06
SHA1 f75028fd86912ce1937c849196517fe16024cf2d
SHA512 c9dea80fb45c729b5f840bc192e9137b3de2ba6232debc56a31ae1c609ff894ab72fd8e7089a30616525e83e28ec0a550067b0cdc8abd1974e91d49373916327
SSDEEP 384:DcUep0OXQze9cOCX+fYn0jBeml/p/1wniuoH++gMeIVeKe6ZH6LgudPSDFx+VIrI:kS5xD15V+Bc
TLSH
T1198279B7C7F4AA2CDD6251F0AA152E1FCE5D0918971C7C2AC9E6DF5BA3E1470E100A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2f7f60210138e19ea61ab011fdc5401bbf511ece2ca0078f7766538647a8a787
MD5 cac82e3426a9c4a3dc8ebf388f892b53
SHA1 ffb97850dfaafcab30719706c3ff2788fa4ba675
SHA512 2a40ec9bda1eb152d49154fd1c43b2858d1b00769f7522b19f9b3b4a92fd096f3add38fea81e366685275429f5c08832616455378c29936bea64b77c72b14b14
SSDEEP 192:sxZNRuku/fMsBtOboIdpJHW6+WNGY9IopuDIgrJ:sxZN7u/fMsB0FJHbGR9
TLSH
T1C122B7126E38A4778CC6D30DBB55BF43E6F9543291A41E58EAFC961C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b929d1ad9dd8e7eac9fe0e1588ead1b80c689b353066c62cf2434b94228f369f
MD5 e9a380ebb63eb2135c3bc2993fd75154
SHA1 3d26efdf8935e9a8e7de38c48e77c7e299cfef0f
SHA512 35fb5ed1a0aa08d3a15b2e52b3e10e0bb3c5a5eb54b8d81ee35ecb3382f13d8e752554f27a54bd0e6c73a67bf7879e63b70b4d49c851dc3768d173f5183f504f
SSDEEP 192:sxZNRuku/fMs7tOboIdpJHW6+WNGY9IopuDIg5SJ:sxZN7u/fMs70FJHbGRo
TLSH
T19B22B7126E38A4778CCAD30DBB55BF43E6F9543291A41E58E6FC961C14E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e81744b6fc7b64a22be08e8988741e4cc1e78031efde6f0983f54ce47252231a
MD5 090baacd02aa671c3150a5a96b246047
SHA1 2ed1e23874f8b7c4c993ec68bbac69b6a932e80b
SHA512 28c8837336afd3706ef47c6d832dfc6b4af28a7fdda202a37f4f6f75da7ab58dee9a3a946baf5552d36a02840a2d2ab87e1075e81300d285008c560e9d46d9d7
SSDEEP 192:sxZNRuku/fMs70OXoIdpSJQHW6+WNq6AtbXY9IYkuDIg54J:sxZN7u/fMs7vpjHbveXYS
TLSH
T14632D7526E34A9778CCAD30DBA15BF53E2F9443291901E58E7FC9A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5d8225bb17023f7d0175722bb633e35b8d71b23d8ebb10f2aaf73ba716a246a5
MD5 ba3e761c28d95d1db5e1f76611304880
SHA1 e7b8eb8292b03f31e5a330625b1a581b22db78ce
SHA512 d6ef2e82e87ff46d0fca76612c70cd0cfd9458afba0a8312087360cc7900da33e3e29c28b13fcd6554e104264ca0abc7c12cff3775d38df9a20de6b3a15ae99f
SSDEEP 192:sxZNRuku/fMs70O3+oIdpUYHW6+WNUBl/Y9I6vuDIg54J:sxZN7u/fMs7vWpHb8/bS
TLSH
T13F32B7126E28A9778CCAE30DBB55BF53E6F9443291941E58E7FC961C14E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e4dfef233fea273b419168451bc9d5799fa4a0294f7436a80ddd82124966783f
MD5 a465a64179cfb9b9b4f8516c7f9edbc6
SHA1 098bec92c9e0eed2edd259af134b973c46093b6d
SHA512 77b1588cf4fd3c6c0a28d10fe07694cbda8ccb1a01ee7fe3bd59fc4bbff6582e39e4e5f3ab84fee6ea7eeeb3285f6fcafbbaca87184aa4becc430a6df06aa766
SSDEEP 768:eKyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7kCroFbq+:eKyvIZwWvu+Q+u1jamFLeR7kZFz
TLSH
T12BC2E92B240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 04d3b531fd2e8893e3dfac4e1ec1c9666d61aa4c52e3f1e5518701326b2fbb04
MD5 180b6ec1b1d3e435bad20b4ab8e18376
SHA1 125a77e2db1ac04c2b60a7bf37f009b4dd5680cb
SHA512 aa055487f4db6177babac4766c4a5473657067eb279e18c3ec01f5f499d6c962e3cce6f24a7738ca3b275bcbe8d7ebb3c528b52b183b5821a0864eb5d60205a7
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWKny0KHK+g:mTr7ATg
TLSH
T13E917346B43B06533D7E281CA3668A364E4232A73418E97F7BB800A59F67E155DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5967c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5967c8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 235bba4383f5d8769999b9f0d79ec8fc0756a2aacbe336fd80192fae34a81332
MD5 ee69b73a574794f977ecf18ed1cdd355
SHA1 0cc336e375dfbab34f94580ec4fc837c72098750
SHA512 736b0637c81fae16d8a70c0a390a67f0af71f56bb84d8ff1ada7f0ec00de70190d16e419d3e96ce30874cc349d16725bae82269e7f5fea763202c446ecb2abe9
SSDEEP 384:xZcIhsN6c20zij9Ue+CfOESJry9OOPrXLpe8C/O:ZhbAQfnOEShy9Oi9PN
TLSH
T15C929E7169781C676DF6A685F5473603AEF89077E2C52FD492ECEB0C06C7698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eec9de850708f953ce2e6887ca7238cf43b5a27206cbb8789f0650d3fe4ba09b
MD5 fe466e33f300fd1b88cd7080f01a99ff
SHA1 e67ea3001df14bbc3de032688b1b82c60043a08e
SHA512 87c116786587a118a26539bab17b19d24946063a53afd41796ef89727228cbd34a3459dd3bd430f3ab9a76dc43eb62976a0e2f3b8d3182e351b8f9eade64a9f7
SSDEEP 192:JONys6v+YLNQmiUy16Zh+CGSOImWusP4U6:JONys6vz/FZh+CfOuwU6
TLSH
T1B602FA356D682C6B9FB2AE49F48737175FA8113BE6552F80D9D82F1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 690af62fa00176199a2058d44596d52fbd87e8504137087891f9d48d5adc797f
MD5 2f6c7f85aa76c97b806bfca440a27451
SHA1 2f2cba250a9a0b0792448e0c4ea1f4229a904a23
SHA512 3177a4d221b1c4a3b485b598e4fad549774ffb55f580571f49ff2ee25f8290c04ae48bc68113a6bda0759fe05faacd1be1f69d65686bdc5c44aaae9deee32add
SSDEEP 192:u4LsN6OQc0L0+YLe0WQmiU1gSL4e+CGSOImqnSJrUSJi9qIk32:VsN6O20zij9Ue+CfOESJry9k32
TLSH
T104422A36AC385C775EA79585F44B3603AEB8907BD6862F9496DC6F1C02DB39C230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9e6a92a81c139a23e403c060b6ee6542b8c1cd5a05885ab4c461ac0c025934f0
MD5 ec48549411be3cb9283ab5781160b370
SHA1 a39e1414bdd49a4ba59a11ff69836fb6bd847005
SHA512 acf0e3ab36d0b4b67643936a99a683b3a9f7e8a30b5526e688bcc1cf1b9aea8448e56e3dba63340130cb2b723f479e0150b3fef6161b0418fc5332e72604b3da
SSDEEP 384:CiFPZcItosNC8TUNTUlIlw20ziB4Ue+CfOESJrx9OOPrXLpe8C/O:JFHqHwgjArfnOEShx9Oi9PN
TLSH
T197D219F258E75876D9AD4B47E77E2E025DBCC067F1852A94B388990CCD861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d17040df1107467849761339c0da0ca15cdcccd31af571b60b81db2a11949bec
MD5 79ffd6ec34286ea55e531782c9d63671
SHA1 385b5b3ab4e2c59676d2c2bdeb979a0d7d1631a2
SHA512 9675e459c172bfa5cc421f38a6ce5dfe46dce51f3bd57618f41c6a5b473fcbd969ebc807bd0a830908d0f8e0300f08f710faf27c994f91ed6c6e98bc56f479a1
SSDEEP 192:cONz6v+YLVQmiUy060h+CGSOImqnSJrjCH9qIU6:cONz6vz/e0h+CfOESJrw9U6
TLSH
T1D2120A3169786C6B5EE2A544F4873617AEB85137EB4A3F90D5DC3E1C02DF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cfd58e0dad931b8533198160f247921dc3786a94369ea81a284c4502862c8a61
MD5 acbd0567d8f865baf60943abcc006451
SHA1 569d7061ec00d2c41a43679fda2caa95b9d7c9aa
SHA512 5f125dd2b76bace79f69197bccb944b5c4a711e8b069b60c43ae2c4b0b3b233be96646fdb1174841e654f9eae3b738f99253239b0619ed16c59bef25c96b5afb
TLSH
T1CB41D858B6F91104B3B37E56ABF6646E887E78772E17D5AE10120E4E0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads