hxxps://s4w[.]in/eATne

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://s4w.in/eATne
Sample260820-salmesek41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2152	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317113414398133"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{6518196C-21D3-4B67-9BA5-DF2D7DE57F48}	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1872	msedge.exe
1872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	taskmgr.exe
Token: SeSystemProfilePrivilege	1472	taskmgr.exe
Token: SeCreateGlobalPrivilege	1472	taskmgr.exe
Token: 33	1472	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1472	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe
1472	taskmgr.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4272	4348	msedge.exe	85
PID 4348 wrote to memory of 2152	4348	msedge.exe	86
PID 4348 wrote to memory of 4704	4348	msedge.exe	87
PID 4348 wrote to memory of 2424	4348	msedge.exe	88
PID 4348 wrote to memory of 4704	4348	msedge.exe	87
PID 4348 wrote to memory of 4704	4348	msedge.exe	87
PID 4348 wrote to memory of 2424	4348	msedge.exe	88
PID 4348 wrote to memory of 508	4348	msedge.exe	89
PID 4348 wrote to memory of 400	4348	msedge.exe	90
PID 4348 wrote to memory of 508	4348	msedge.exe	89
PID 4348 wrote to memory of 508	4348	msedge.exe	89
PID 4348 wrote to memory of 400	4348	msedge.exe	90
PID 4348 wrote to memory of 400	4348	msedge.exe	90
PID 4348 wrote to memory of 4964	4348	msedge.exe	91
PID 4348 wrote to memory of 4468	4348	msedge.exe	92
PID 4348 wrote to memory of 4964	4348	msedge.exe	91
PID 4348 wrote to memory of 4964	4348	msedge.exe	91
PID 4348 wrote to memory of 4468	4348	msedge.exe	92
PID 4348 wrote to memory of 4468	4348	msedge.exe	92
PID 4348 wrote to memory of 4160	4348	msedge.exe	97
PID 4348 wrote to memory of 4160	4348	msedge.exe	97
PID 4348 wrote to memory of 4032	4348	msedge.exe	98
PID 4348 wrote to memory of 4032	4348	msedge.exe	98
PID 4348 wrote to memory of 4232	4348	msedge.exe	100
PID 4348 wrote to memory of 2460	4348	msedge.exe	103
PID 4348 wrote to memory of 2460	4348	msedge.exe	103
PID 4348 wrote to memory of 2460	4348	msedge.exe	103
PID 4348 wrote to memory of 2940	4348	msedge.exe	104
PID 4348 wrote to memory of 2940	4348	msedge.exe	104
PID 4348 wrote to memory of 2940	4348	msedge.exe	104
PID 4348 wrote to memory of 3036	4348	msedge.exe	107
PID 4348 wrote to memory of 1872	4348	msedge.exe	108
PID 4348 wrote to memory of 3040	4348	msedge.exe	109
PID 4348 wrote to memory of 3376	4348	msedge.exe	110
PID 4348 wrote to memory of 3376	4348	msedge.exe	110
PID 4348 wrote to memory of 3376	4348	msedge.exe	110
PID 4348 wrote to memory of 1608	4348	msedge.exe	114
PID 4348 wrote to memory of 1608	4348	msedge.exe	114
PID 4348 wrote to memory of 2304	4348	msedge.exe	119
PID 4348 wrote to memory of 2304	4348	msedge.exe	119
PID 4348 wrote to memory of 2304	4348	msedge.exe	119
PID 4348 wrote to memory of 3300	4348	msedge.exe	120
PID 4348 wrote to memory of 3300	4348	msedge.exe	120
PID 4348 wrote to memory of 3300	4348	msedge.exe	120
PID 4348 wrote to memory of 4792	4348	msedge.exe	122
PID 4348 wrote to memory of 4792	4348	msedge.exe	122
PID 4348 wrote to memory of 4792	4348	msedge.exe	122
PID 4348 wrote to memory of 1872	4348	msedge.exe	123
PID 4348 wrote to memory of 3500	4348	msedge.exe	124
PID 4348 wrote to memory of 3500	4348	msedge.exe	124
PID 4348 wrote to memory of 3500	4348	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s4w.in/eATne
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc1aaac188,0x7ffc1aaac194,0x7ffc1aaac1a0
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,17534423531871846907,18082684323220271666,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14795203088764374851,18178350999125690461,262144 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,13893496070338963907,4697618040121280923,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,1409993515218226555,14831113108085736537,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1383892226194596998,11569158310851917905,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,227531927862606224,6394910772739930552,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10051062078467928380,3820709947348582980,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12034396294223008201,7268144342510360237,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,16275044950471275591,17757875428375968531,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,4369281963269998008,13645296167081456632,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,4369281963269998008,13645296167081456632,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6028,i,15257629277794527847,1736063441090884567,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6156,i,9696743926745713888,10961830865536624541,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,18234118753036743301,14612032104112843592,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,1163926954872067357,8849747318608079512,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7378659504463134775,6243844289096737731,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4044,i,8049084982023478261,12720898707639514615,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17606112386965136852,15963520508086278191,524288 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6200,i,16773269244154536752,6305824961507650794,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6016,i,2870865802681524620,10722694275468036459,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=696 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6220,i,10023519869684779329,16774739846256634286,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=560,i,293455289101320666,14300893030097572782,262144 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5208,i,12976198201339459770,8096923824835175254,2097152 --field-trial-handle=2380,i,11327566715235294334,16617887290035917335,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3716

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cac55920f8823c4ceaf21e9df262ea5144feec125c060a5abe9067d5317a32d5
MD5 758e232e0cd6d9a81ac6d391eae4c336
SHA1 87b9bddbaf74e9eec5f3f50faec56838c804652d
SHA512 070c7f645a47bcff78d2d6cd584b80ebb96040ad737531962fdbfe7971fda7ba4ce3ef9b1d1ab66f8279fd13535f41075f904d2b233a1a35c9f128131f7dafbb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 58d8205bf257cdbc486a90f71845c147ccb18bcbca6d69b4f0b040d5e91f22e8
MD5 d82dfa300e70af4c2eec5ec3398f7d47
SHA1 c2667b8c549bc728bb05de6c263324cf0e6bc34a
SHA512 e425cfb954566cf785ad0c1080d9d0eb292359a1a813c7a72e3ca37560f6e8b8ef662f897643103c56f9d7dba0a3df29a3879afdaa19fa546991c9dff3896db8
TLSH
T17A618209194E14B5F7611B31E4C10600F9B043B90EB72ED336F8D97EFA2EF23802559A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589ff4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589ff4.TMP
Size 3KB
SHA256 92d8df7f2d84354d7635885e54917e20704ced051ed6198cc1a7487326a0e536
MD5 1861f380b968792ffd5a4b3cbd8673b6
SHA1 55e841ddf2a02d40e147216619b00fc75b64837c
SHA512 2d2fa8abe51f9b6e146eb7c3593dcb8f3c877e4155dfcf8b4520b2f5acc3a492af874e25a1ce5c782ee539e22343f374a2363eb1edd97da2ca8183ea2dae2736
TLSH
T168618109194E14B5F7611B31E8D10600F9B043B90EB72ED336F8D97EFA2EF23802655A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 973d389b48b5d3828ab6425296e6257f08a4f922a6972e59318cbb6f511c9abf
MD5 b80027b4aab0e2eda62e7a8d45c54a39
SHA1 3109d4d5e1f7c9a750a9c82fdcb2002b11a9d718
SHA512 9a22b1664e54adcfa4039f01ef440972088d65e3939686c4e112d8a506ee72c53eb72216381d478a851fadf60e9a6355742c72ebd051ec9f25313959f354ed43
TLSH
T123217CF2C7D5866ECD1616F09A24AE17CE1D0A0642283C0A8AD4FF6B93F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ed80b633194988996ef94bfe752d0056572d2ad7d38890a52960c452f0c86e1
MD5 e089fbe64543165ffa7aad8e80bd1623
SHA1 d6529eef6ebe2d2189ca5d2b0236b0723e68fc66
SHA512 2f0ed38d7932b3a9baa592cf895f1df90a086f38ee6f902e45a42f25f8f53639fd81af7c8faca9f082b3e324353c414f1c95c5251ee96e41ea1835377852a6e6
SSDEEP 192:sxZ5RsyM/jK1Ml8Mk2/fDslVSIdpJHW6+WNGYLl/S7IgrJ:sxZ5GM2/fDslVbJHbGx9
TLSH
T16942E8116B346977CCCBD209FA45BF53D6F94473A2901E58A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c989a644aacd2b501dea563cfe0ff23ce02aab73845aa533dbadca9aa98a61f7
MD5 929aab187198525c166b06f05fb25463
SHA1 d006c4ba995a3947c37ee4ada712e201a2836f68
SHA512 78c4dfb5606ab6d126030089b82d32742e3f58c214e5496acd3ee614c5bc0765542e5c933fb1d57857602f90491ecd6f5fd12a68d389eb163eb0ea0e4a45b6e8
SSDEEP 192:sxZ5RsyM/jK1Ml8UQEk2/fDs2IbIdpCdHW6+WNO+M/YLrXm7Ig54J:sxZ5Gqf2/fDs2IECHbE/9C
TLSH
T19E52F911AA345977CCDBE219B945BF53E7F9047392904E44AAFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1454329e9110490539f81c00c2e5574b57024f4409208330a8a4343e32b468c5
MD5 aa12ee40d56ecea21a884f31ff94a28f
SHA1 630f87486620cd4e28658133402bfb91567a551e
SHA512 d5f3f95df8c27d3b7400a66934db3326914d898d831bbbae9cf0f716112436975ea30e00496b7830634ff7e9bd95659eab6e4a0beaabd57175e24db96cd35c9e
SSDEEP 768:Oks6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNtroGr:Oks6pD1WvxzWju1jahILIsNGGr
TLSH
T161D2FA3B680CCB7E4F841E5CEC2AAE977DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 14c24e71601cfa93da3ae02c0ddbd9401124502659198374972e8041f2a0b1cb
MD5 886fdd01cea9584f3850dc7f2d9b66c0
SHA1 8b223967e13ba1968b96434a78a29d1a5a043643
SHA512 145a792220537d654454d640b8ff782f27cbdc907c6294295ec38be0bf6348f7c1be5e3d11b60d1f813c1c75b533ad922687f195c292dc0b38f47859b9feea59
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFzIVKwEfyI/Kva4bytLIxK8IMrV8b/Vq:KUAAKteP+zWKwEfysKva+OLeK8IY
TLSH
T14CB1360271BB03123D7E2908A299972A5F8276633818F42B77AD40725DA7F340DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee1d39a0-1f95-4a4a-8452-c82ca6654da7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee1d39a0-1f95-4a4a-8452-c82ca6654da7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e4268cf6b46ccce1b6251736965ce21d3a5de3d982890f2e77b763502767c612
MD5 2f449f9198ae711b2733f38b4cea48f7
SHA1 5045033262bcf36bb380a71bdc3bc07016ec061a
SHA512 b2f6df2733750f90ce36da0aa7dfe3df510ffefb2dc1ea82cc134e28e2285e7d4e7d8b7b17cbe97e712aa2d583c537b6f6cd245e080a8b16ed5e5019e3bc748f
SSDEEP 192:uum+xasuheOwQxMGsNkJQxctHI7+3vHnQmiU1CLe4atb0RO2oSBhLMAqT3t4/tyM:QZcIhsNkJNrpaBa9sO7SB2piv+Goy
TLSH
T16F827C316C686C761DF6E285FA87250B5F788067D6C96E90C8EDAF1D00EF9AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 90610e2cfaeb9c4d93b4e70f6739843227bf71b432cb4ee1efe8cf0d7f276167
MD5 bee0724e17140d98c305a7d8534f201a
SHA1 21df6bf9ff7667eba7ad13b6fca1c7051af88844
SHA512 e67848e35de345981c579e5238d641fe6101e8e496dc15d3185de9f0d583f76b196969309c2e3338af529d1f91671ad011309191e6a3205d410bffe7706184ee
SSDEEP 192:uuf+xasuheOwQxMJsNkYpQxctHI7+3vHlQmiU1CLe4atb0RO2oSBXLMAqT3t4/tl:FZcImsNk8NrjaBa9sO7SBopiv+Goy
TLSH
T120827C316C686C761DF7E185FA87260B9F788067D6C96E90C8EDAF1D00DBA9C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aba5c69cc64a43960d15b10096dc412d42c104e047859e656e68315e3b484782
MD5 8faee8935dc39b2ba7568a842ace940a
SHA1 427ee40b836d027021a3463ef31958bf1f6a1d4e
SHA512 e0fd2cc56da0a92bbc8904091b2f1d4ebdebb7ad3f4e78b83a4ef7500de326697e7e522a214253aca3656a928b4d78ab37c6f0f20402ae38e0288bc0fe6e3957
SSDEEP 192:qONp6O7+3hQmiUyuSGttb0RO2osgG3fU6:qONp61oGt9sO7CvU6
TLSH
T183020A39786C6CB78EF2AD45F68727179FA5113BE9922F40D9E81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 928ed6e9f6c6c593613031bd63bd5028171480be1024267efb37e439e90fb865
MD5 508d82b635f81a5435f7a4d1a5292589
SHA1 9f04d286fe05964c7f38e63abe5402998c0a764a
SHA512 273143efe52a13715a30a1ad4aba544fbeda561f5f53d071913545fcd043b7da46d7f783cf13c42f0032f28a3fec0b4994ebf598c7b63d815b6ca41a4397a6a2
SSDEEP 384:LiFPZcINsNs8TUNTUlIl8NrjaBa9sO7SBnpiv+Goy:mFHNxwgVUiO2tpimGp
TLSH
T1EFA27B325CA89C7B6DF6D685FA8A22078FB440B7CAD5AE90E6DD9E1D00DB5DC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e6f27ea3d09616b7036d1ea503af9d5a657d8034dfd8b438822a2937b1b788ba
MD5 fce97988460dfe34f3cf212f33baf1bb
SHA1 fd33cf7a0747c0cc6aab31bdaeab493037b29104
SHA512 9598acd1938b6c158ce1b8407ee93b4dbddfd82a35af9d8422961e94163eb79a7a331c6882379796a9dc1d3c070a3c3c2637e1d65eb7ad4582c320bb16ecf0b1
SSDEEP 192:uuf+xasuheOwQxMJsNkYKQxctHI7+3vHlQmiU1CLe4atb0RO2oSBXLMAqT3t4/tl:tZcImsNklNrjaBa9sO7SBopiv+Goy
TLSH
T126827C316C686C761DF6E185FA87260B9F788067D6C96E90C8EDAF1D00DBA9C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b09eeb417043c079d5ade606c788cbc9adcf9f1c3d87fe9dc012413c78d3067
MD5 4bf7cbb661c4b0359e2e2dc1b6dbbe16
SHA1 2b90c1daf187be8804b68496131c78b0d2a431a3
SHA512 fd1d0f620aaabafb698ac88849c88a5c08d61d5ea9f994421af5006ec2e525542989bdf1729458b8c032bdebdb5041cf23510e3035f1110361df65ee5777c351
SSDEEP 192:LONd6O7+3nQmiUyJSzttb0RO2oSBkcNAqT3U6:LONd6vpzt9sO7SBNpU6
TLSH
T14C121835B86CAC775EE3A045F98732178F65417BEA466F80D5DD2E0C00EFAAC234A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

766d4b85-d69d-4064-a8e8-bf01c8a3949a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\766d4b85-d69d-4064-a8e8-bf01c8a3949a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c322d89869970ad12ded5f1315255ca75255055ca8f3f3a425725092d1417b1b
MD5 c28b082a304ca16f59621c68fa5336d2
SHA1 94b013b5e1784423d94d401e7a0897c9944f41e4
SHA512 076236b928b8ff5e2542bb9f4cf6b0c865ca3f9c659f4027ac2f6c0ebcf58b6cff7e70cb3cc273482bfc4bfef93a316757e716268677050c3a93e8e80750baa1
TLSH
T1EE41165CA6E91148B3B77E5AAFF6B86E447BB9772E06D05E10010E4F0662B40D8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-186-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-191-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-190-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-192-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-193-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-194-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-195-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-196-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-184-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download

memory/1472-185-0x000002B97E8A0000-0x000002B97E8A1000-memory.dmp

Download