hxxps://ddec1-0-en-ctp[.]trendmicro[.]com/wis/clicktime/v1/query?url=https%3a%2f%2fl[.]gotourl[.]es%2fl%2f22d02734aef04cd58ae4246d426fc0c3c67615a7%3fu%3d13476008&umid=5468d876-d854-47d6-827d-c55287674cd6&rct=1789553935&auth=a19147867c62704a4710b7b3ee6749b3a5dad23d-017ae0c3f41d9bff5bb37db66d11c1208cc910c8%3E

Resubmissions

16/09/2026, 12:29

260916-pn445sysaw

16/09/2026, 11:57

16/09/2026, 11:55

16/09/2026, 11:52

16/09/2026, 11:24

Analysis

user interaction
yes
max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fl.gotourl.es%2fl%2f22d02734aef04cd58ae4246d426fc0c3c67615a7%3fu%3d13476008&umid=5468d876-d854-47d6-827d-c55287674cd6&rct=1789553935&auth=a19147867c62704a4710b7b3ee6749b3a5dad23d-017ae0c3f41d9bff5bb37db66d11c1208cc910c8%3E
Sample260916-n4physxxhs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340334461764953"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{D8369BD8-4190-492D-AB7F-A968E11ED0A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1656	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	taskmgr.exe
Token: SeSystemProfilePrivilege	1656	taskmgr.exe
Token: SeCreateGlobalPrivilege	1656	taskmgr.exe
Token: 33	1656	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1656	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe
1656	taskmgr.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4568	4204	msedge.exe	83
PID 4204 wrote to memory of 4492	4204	msedge.exe	85
PID 4204 wrote to memory of 3664	4204	msedge.exe	86
PID 4204 wrote to memory of 3664	4204	msedge.exe	86
PID 4204 wrote to memory of 3664	4204	msedge.exe	86
PID 4204 wrote to memory of 4132	4204	msedge.exe	87
PID 4204 wrote to memory of 4132	4204	msedge.exe	87
PID 4204 wrote to memory of 4068	4204	msedge.exe	88
PID 4204 wrote to memory of 4472	4204	msedge.exe	89
PID 4204 wrote to memory of 4068	4204	msedge.exe	88
PID 4204 wrote to memory of 4068	4204	msedge.exe	88
PID 4204 wrote to memory of 4472	4204	msedge.exe	89
PID 4204 wrote to memory of 4472	4204	msedge.exe	89
PID 4204 wrote to memory of 3924	4204	msedge.exe	90
PID 4204 wrote to memory of 3924	4204	msedge.exe	90
PID 4204 wrote to memory of 3924	4204	msedge.exe	90
PID 4204 wrote to memory of 4524	4204	msedge.exe	91
PID 4204 wrote to memory of 4524	4204	msedge.exe	91
PID 4204 wrote to memory of 4524	4204	msedge.exe	91
PID 4204 wrote to memory of 1988	4204	msedge.exe	99
PID 4204 wrote to memory of 1988	4204	msedge.exe	99
PID 4204 wrote to memory of 1988	4204	msedge.exe	99
PID 4204 wrote to memory of 4584	4204	msedge.exe	100
PID 4204 wrote to memory of 4584	4204	msedge.exe	100
PID 4204 wrote to memory of 2156	4204	msedge.exe	101
PID 4204 wrote to memory of 2156	4204	msedge.exe	101
PID 4204 wrote to memory of 772	4204	msedge.exe	103
PID 4204 wrote to memory of 1496	4204	msedge.exe	110
PID 4204 wrote to memory of 4128	4204	msedge.exe	111
PID 4204 wrote to memory of 1848	4204	msedge.exe	112
PID 4204 wrote to memory of 1636	4204	msedge.exe	114
PID 4204 wrote to memory of 1636	4204	msedge.exe	114
PID 4204 wrote to memory of 2668	4204	msedge.exe	115
PID 4204 wrote to memory of 2668	4204	msedge.exe	115
PID 4204 wrote to memory of 5096	4204	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fl.gotourl.es%2fl%2f22d02734aef04cd58ae4246d426fc0c3c67615a7%3fu%3d13476008&umid=5468d876-d854-47d6-827d-c55287674cd6&rct=1789553935&auth=a19147867c62704a4710b7b3ee6749b3a5dad23d-017ae0c3f41d9bff5bb37db66d11c1208cc910c8%3E
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffac5bdc188,0x7ffac5bdc194,0x7ffac5bdc1a0
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,9598761413380639922,13656637533639929806,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,18246614734328734249,2317820512265996914,262144 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11256758975938679215,12596817433777238971,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2925838914261413219,901396270524482261,2097152 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4658020748944009566,16346423852759974162,2097152 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,16682690220068010826,5515398750152375016,2097152 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,15546763372527012424,10012463496942271197,2097152 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4516,i,11299008185993948605,10782675980769055451,2097152 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,14580994016840621289,1092622083379063825,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,14842450175668167532,13012135098413226047,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10981870858872779630,392026409143277693,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10981870858872779630,392026409143277693,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,7469677099846970230,6591890740251766495,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,8421296171256238912,11504764088281992083,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,17753568043509099308,322224305481954062,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,15832402267682917237,13373926073271000094,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,8921691894379211315,10801236591122972475,524288 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3600,i,11816686124120956842,12521228445178304318,262144 --field-trial-handle=2316,i,10140899236607381736,3449347858754429791,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f3eb7aef088b57ca1716d197f89e2661c4553f4b29ee0ed7dc706f2fc9392e8
MD5 732e82e05ee795c359e8002e2ea11735
SHA1 8fbc4b30da59b02485f8a55632f95abb5400770a
SHA512 2b3dca0b8da2ff4a6f7b4347852dab44991a5c08cab80d31cdd08ecac74db87144c3b129e75c384482636c723bf2604a6c4b19631cc4313bc27df122e1f2244a
TLSH
T14461C5C01EBAF5A9FBF80374D6DA13A738F488B8358B2F52005BC1B9640B72159D4317
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a18.TMP
Size 3KB
SHA256 35962481be68899aceee9a659cb74b7afce6d0a94659e2a4f2856189beb0dcb1
MD5 77b848528c7dc11a917d743994aaef38
SHA1 c6d55f9e7d93c70d533b88fb2db0492c70c0a09e
SHA512 ea8c95d4689a4615e405131a7728e2df66b1cd94c38e54b8899100d66cfab750ea38196a64aacb779be2106406936f855948d30304a70063a33e37a270cfa1cd
TLSH
T19061B5C01EB9F5A8FBF84374C5DA136738F498B9758B1F52105BC1B9640B72559C032B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 957dfacfc101f47ebd3606795e1534f84fc48ce03a265bd3a5b55dde9df674d1
MD5 bbf848f920bfabd9f43b8739ed6cb423
SHA1 fc893ada61707587d2ac2f8113567a28ee42a11e
SHA512 f0de5d9d9676506c9e23a74ca3d92aa89e64c70f7ba0f8eaace9d502df8c1237d0b9d5f5bf2142ec3502c88b3052eb6ade2bfd452a6b83208eb040b10767d857
TLSH
T1365169F782D8896DCA1257F0AB287E1BCE2D091543683D29C9D4BF9B93E20B1E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dac1ad4575a0fbc55e4a33232cf505013a346d73862462fdfda0e915601ef88e
MD5 b8e6d2e37fb10b8877e15503247fc5e4
SHA1 93694232a5883f83a649e8dabe063f49c76997e2
SHA512 75fc87635d9367ba60d586132b602db3f65983b81ba3a61c76f4ed49cc0447bfccd974d49c3910fea396b10644833629d59d73445ac7a2f85fe279b0037e3dbf
SSDEEP 192:sxZZRUWj/fAs8IoIdp47HW6+WNH6B/Yg+98IgrJ:sxZZRj/fAs8IZ2Hbk/L9
TLSH
T1A622B9166E24A97B8CC7D31DBA55BF53E6F9503251911E48AAFC861C04E7BDE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48d187ce2bd9c0f1c339aafbbab3935fb8cc02c7c006c33ca76cb1bd50b89350
MD5 b2a4d81dba5e5cbc33047b056d90b9ff
SHA1 2ff978216d29e860f582b60378e1219fc3730576
SHA512 2d72691a13225ac4c7969bd638d25f51a9b0bed440e0cb9d759427fd914306061e48f0e268ddc87444bcebaed7fe10c78ec9c3cede1e3559367a654862143ebf
SSDEEP 192:sxZZRUWj/fAslIoIdpS7HW6+WNH6B/YgE598Ig5nJ:sxZZRj/fAslIZYHbk/+ov
TLSH
T1E122B7166E28A93B8CC6D31DBA55BF53E6F9503291911E48A7FC871C05E7BDE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b052c48cc658699168c4d306194d502bb0c202dfd9ba1d3997ae50901f585cb5
MD5 6abaa64add4d0389fe15e33b50c7ad27
SHA1 d788f9edfe561ccc087da7c1ea745f4cab19b326
SHA512 784ac543504442e035205c7918328423b878a01e74015a358791d3783e70e07fd0a508e4541a788f6b7a37d9cc13377ab8459201847f75e01756d63812cdd366
SSDEEP 192:sxZZRUWj/fAslIoIdp47HW6+WNH6B/Yg298Ig5nJ:sxZZRj/fAslIZ2Hbk/3v
TLSH
T13322C6166E28A93B8CC6D31DBA55BF53E6F9503291911E48A7FC871C05E7BDE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 197a25c71d3aa924dc786ec9420ce7f76ae83782c59018f7428f98626df5016c
MD5 c09b481aabf460a797a8ff3bb52a0561
SHA1 dae362a18eec0f7c6ea49631d2767fa5d672d1e0
SHA512 d56fea72ef92673909452173f634a28099c40bcec5ebbb816a7bc9a4f0f1aec404a03b09f27ff13db9629dd229968aa5ec3095b68d70c89c6a0f89ac0ae6f0f0
SSDEEP 192:sxZZRUWj/fAs4IoIdp47HW6+WNH6B/Ygq98Ig5NJ:sxZZRj/fAs4IZ2Hbk/XZ
TLSH
T11122A8167E28A97B8CC6D31DBA55BF53E6F9503251911E48A6FC861C04E7BDE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 99aca78196a544d5535987f809f5596ee15839f60c6f409a265051cc2a8208ee
MD5 a80c1914c03a85c1af73d1877a5d623d
SHA1 b96ce50da0b32410c786a18b4247c60f1083bc0a
SHA512 4184307ba1ea1b9b48effb611e23dec9849374b4bdf3c6c203fce7137c5ad3bfadca47dd06bf8ecba30cfda23cfbde2af1d3dc8ac1a0dcf4b6db83c05983997e
SSDEEP 768:noichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzIrovmXp:noichfPWvPZplu1jan+LKgzzeXp
TLSH
T1BDC2FA3B640CCB7E4FC01E9DDD5A6F967EA802C7A6588D4047FA984C02C77EE512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 901c61158e49af0dc18c91d8ddce2d8763638f8eb82a5ee667417c219fa7e6f8
MD5 5161260f5b780b816e34d1a5b0da5395
SHA1 363b56c43d73d893e86bd67dfa6bafef6316e4b3
SHA512 c83ba8284dc38eb5578dbdd9b891ab059ccd8b7833cc0d1a34a9ff3fca8a7cc29c46b4b1886e64ee0af97c10557d56c9a4d41bcca2fc3d57d7345ac0b9bcbe1e
SSDEEP 48:K0wfWaAqefbWt2ISyfK9O1UfxoPYVGu0yLVUplXD34brOrIS94K9d1P4x9oYePjn:K4HmKg4Gyq8K7qEsQKl+eOz
TLSH
T1DD91130532BF261138FE294891649B5E024131B3326DF93B7FAC1492AD6EE451DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598534.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598534.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8cc87e1bf3b8e41144fcb6ba3407243057239e7f1a23a5ca6995eee203d6982f
MD5 2bcfd3881cd1a7b1ced45a0a93a811a6
SHA1 09058a1c11419f0d45f3d297f6204a7bf2145859
SHA512 a032024fac330ec7d105d6f45c636ae7f61f0680ac656a46706d164320541acb7c20894ed7f098ea579e0e43fbf074ee6759df6efc5891549f6da297242d96d1
SSDEEP 384:HmiF5ZcIGEsNy8TUNTUlIl4Ji52Uy2VBGYX5EOFN8EK7O6R2Feolh7U7of:tFRJbwgIihnGYuOFmn7TRYeE
TLSH
T16FC24CF248E7983AD9AE5753A77D3D038EBCC057B585AA50B3D95A0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a773ab2fe2ced6ef3a921f38f4184a6b8216501f0f1dbd52afa2cf56aa81c21
MD5 8be4d79a88b48ac73cca04f334c3b3a8
SHA1 fa79f2103c80c21c105658349d05b6f04b8df0eb
SHA512 79f0a1f92c20dabdc0de3fdef9da53ad41c6096b4317fb1ce1554527102295a1eed1faeff2f8da267ec6b76169c9556ef362651ca53fe8649b0279de5ec0efac
SSDEEP 192:LJONs6DphmqQmiUyCqCRq8wGYX59ezvCnyRykk7VYU6:lONs619DjRRwGYX5EOHKU6
TLSH
T10D02E939E8B87C7B8DE36E45B58B3A139FD8112BAA956F44D6E81E1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 607528f54ec8dcef5a4482e90ae83dbea39b9dbc7fc9cba846089b53bf51ea92
MD5 165e7509aad4749b85de39d105453ea9
SHA1 84d3254d72d2d8719a33583c9c1bfd2b74aad454
SHA512 47c6986b2ffde1c2c5990a63c5897ac54e932636dc28faae1cf2059883abf5e2cefce6246bad4c093f40d34f750aaee1b39ef6e2c566233249720563492a3d30
SSDEEP 384:4ZcICsNqJJi52UL2VBGYX5EOFNTEK7O6R2Feolh7U7of:GCBiMnGYuOFRn7TRYeE
TLSH
T1F9828E7198B8AC3B5CB79152F58B3A139FF8902797C96F40D6ED6F1D04DA698030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4914a0587b69a458912426e88541374f74a0fdbc69aaf4275520f3598b168bdf
MD5 ec17c1b590f80f4c12e12fc7a470d9b8
SHA1 651cca99f044b16ab6079acbe1c921ab9f7de662
SHA512 5dad9d52fef0c72856b965113ac000c81059158b52e2fe39ba48f930f73a866f75c26b192369a8b9d361dd27df62d00f8b6abef57a09d4c06d958acc1bcaf10d
SSDEEP 384:PjZcICsNq4Ji52UL2VBGYX5EOFNTEK7O6R2Feolh7U7of:zCciMnGYuOFRn7TRYeE
TLSH
T1B0828E7198B8AC3B5CF79152F58B39139FF8902797C96F40D6ED5F1D00DA698030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f75484e0d132fd72f4eea55818d298bda9d05c50b92d7c7f4f474b445e24a38c
MD5 ae78191b37db858d698f2bd7d919b85a
SHA1 f73e17205bc76385a393f1c0d012181d21582d6d
SHA512 ab7a9b9843bc2e225017ee88b6e63d435c44d889f3df906abc630160fc55f61a908090b5d4cf2115cb228204f47bcf579e7fba8297a71728f671689f6aff35d9
SSDEEP 384:5ZcIRsNqNJi5YUL2VBGYX5EOFNTEK7O6R2Feolh7U7of:RRRiSnGYuOFRn7TRYeE
TLSH
T187828E7198B8AC3B5CF79152F58B3A139FF8802797C96F40D5ED6F1D00DA698030A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 288852bf416d36d3ae6a339b3d2d0400f12d47b425ce4e42e37bc17fbcab31ca
MD5 8f4bbc36d31cebda0f45fee046dfe14b
SHA1 0cfced244fd8204d8f56df4f2dcb0455937f9303
SHA512 044b9697895929aaeb4c0c0fedff1da1b736028a63c26513dce72b125245aa9ea182984ea73d8f433b05d756cee813892d2fccc4f86405adff88027e19cc2a21
SSDEEP 192:LJONb6DphnqQmiUyCnCRnwGYX59ezvCnyRWNdevkIIECr/5bU6:lONb61sDCRnwGYX5EOFNfEKU6
TLSH
T17A121B35A8B8BC3B5DD39951F48735035FA45117EB897F50D6EC2E1C01DF19C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d91626ef-1757-41ac-9a5f-eec7eaa82204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d91626ef-1757-41ac-9a5f-eec7eaa82204.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 45d16733d2dfa0e5278c5874df9719d228d8f8beaa2e524c125cdc5ba9b5f007
MD5 7a1af981357fb4ac8b4ec99984a07aa7
SHA1 128a7a7895d9943bbabc6ae92533c1d85a0b0c1f
SHA512 58f76aa81140286656b7f5c885ac8f86258ca1988875662def4c1fadb7bb577816a2026371113cfdddb8f6931fe738e5b37bd3765c7311c023ec0bb78a0b1f23
TLSH
T1C5412698BBFA1148B3B36E5AABF6686D047F79772E06D55D10110E4E0A63B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-209-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-198-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-205-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-207-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-208-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-200-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-210-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-211-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-206-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download

memory/1656-199-0x0000022249F10000-0x0000022249F11000-memory.dmp

Download