hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=CN3MUa3i9aqqpIvmh7L4PpcvD8QPrzJ34iQGB07TNtBawkB8QAiAAYMn2pozQpOQPggEXY2EtcHViLTYyMTk4MTE3NDcwNDkzNzGgAZirhc5CqAMEyAMKqgScAk_QlOkl7_LPHyihFKLClVMBZETNfoHb-RQmMm7xBORkqWJTMKU929AgzzbSD5UUHVSn27qTzbtQxTR9WZOSa7aAIXtYb_Wlf6cnCtsDsk74uHmpI5MCAeaamqqhwRmPlx0-quYUB31nIFDdfEVQxMeljuNzjpb8P1QUQgE0lqI4pV0YXH71Vlp7Av8y-mzmygfx3Kf5px_HwRqmqs0tZXd2wW1r8bRQUAFHqEorXoU2wYreyvFbqZv1EPEt82EuZ_yhJ1OE8K3aBHj5eQQkeiDBbNS0sEbBTa6Jx_qejRIYx5fTzQ7J4Nh8ZXLCUYapML09yMRPrldLKrXxtW1jnUdgy4RP5eONSwTJhj2GIkyqcZpjLY_FRkt6lr0TiAWjl4jGWpIFCAgTeMuvns4doAZugAeY49WtHZAHBKgH8sCxAqgHuMSxAqgH4baxAqgHpc-xAqgH552xAqgH6J2xAqgH-dOxAqgHydqxAqgHqeCxAqgHptSxAqgHqNIbqAex3BuoB7CbsQKoB66xsQKoB_2ysQKoB8jPsQKoB8nPsQKoB83HsQKoB_HRsQKoB_zVsQKoB_vVsQKoB4zWsQKoB4vWsQKoB5risQKoB5visQKoB53XsQKoB53UsQKoB4HGG6gH_K-xAqgHvtmxAqgHq8UbqAe3obECqAfVqbECqAfn2rECqAfetbEC0gguCIBBEAEYXjICggI6D4BCgMCAgICAgIACqoCAEEjZoNI1UBRYoNnctZmXlwNgAZoJMmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvsQlzvAmLxvpUbsgJAMgJigKYCwG6C0EIAxAFGAQgCCgBMBxAAUgAWE5gAGgAcAGIAQCYAQGiAQgKAKgCAdgCAqgBAdgBAYACAYgCBroDCXZpYXRsemFhYdALEtIMAhABmg0BEqoNAlVTyA0B0g3hAmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvP2djbGlkPXtnY2xpZH0md2JyYWlkPXt3YnJhaWR9JmdicmFpZD17Z2JyYWlkfSZjYW1wYWlnbmlkPTI0MzA2MTI1NzMxJmFkZ3JvdXBpZD0xOTg0MDYzNjcyNTcmbG9jX3BoeXNpY2FsbF9tcz05MTkzMTgzJmxvY19pbnRlcmVzdF9tcz05MTkzMTgzJm1hdGNodHlwZT0mbmV0d29yaz0mY3JlYXRpdmU9ODI2MzYwNzIwNDcxJmtleXdvcmQ9JnBsYWNlbWVudD0mdGFyZ2V0aWQ9JmNwaWQ9NmFiYjg0YzhlYWMyODMwMDExMzRjMDhlJnN1YmlkND1HLTRZSDFXTEM5QjkmZ2FkX3NvdXJjZT0yJmdhZF9jYW1wYWlnbmlkPTI0MzA2MTI1NzMxuBP___________8BiBQBsBQDwBWBgIBA0BUB2BUBmBYB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpFxfsx-tJXB_muhcGKAAwADgB0BgB8BgBwhkCCAE&gclid=EAIaIQobChMI6ordtZmXlwMV-RDbAR2l5TA-EAEYAiAAEgJN4PD_BwE&num=2&cid=CAASwwHkaKvqOsoeYDintrq5jh4NqlBU12Gzxs1kow-bQN5Wmg7fYUCtxTUfZr0BzLK44yABJNOaQ0NN1jc2gOEN7xxduhSx8HlykUj4bN6VEg_pW9haf_lYWBbK9LklFn82TXHsiQ94caYr1WP2a3P6fXUk137H5j0m1Y4ivZH9kY3sqVrKTI6UhYVjMyNMMsguwnL4u9pi3pNDPtCPOsNLlritjMZbzn9YwykUAr1OlmpVQeY1L9Vy7O4lqEN4Zqa6XgCW77g&sig=AOD64_3792L7A7pt6xKWXVJ8LNLVQ-nF3w&ms=%5BCLICK_MS%5D&nb=0&nx=%5BNX%5D&ny=%5BNY%5D&dim=%5BDIM%5D

Analysis

user interaction
yes
max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 21:02

Sharing

Behavioral task

behavioral1

Sample

https://www.googleadservices.com/pagead/aclk?sa=L&ai=CN3MUa3i9aqqpIvmh7L4PpcvD8QPrzJ34iQGB07TNtBawkB8QAiAAYMn2pozQpOQPggEXY2EtcHViLTYyMTk4MTE3NDcwNDkzNzGgAZirhc5CqAMEyAMKqgScAk_QlOkl7_LPHyihFKLClVMBZETNfoHb-RQmMm7xBORkqWJTMKU929AgzzbSD5UUHVSn27qTzbtQxTR9WZOSa7aAIXtYb_Wlf6cnCtsDsk74uHmpI5MCAeaamqqhwRmPlx0-quYUB31nIFDdfEVQxMeljuNzjpb8P1QUQgE0lqI4pV0YXH71Vlp7Av8y-mzmygfx3Kf5px_HwRqmqs0tZXd2wW1r8bRQUAFHqEorXoU2wYreyvFbqZv1EPEt82EuZ_yhJ1OE8K3aBHj5eQQkeiDBbNS0sEbBTa6Jx_qejRIYx5fTzQ7J4Nh8ZXLCUYapML09yMRPrldLKrXxtW1jnUdgy4RP5eONSwTJhj2GIkyqcZpjLY_FRkt6lr0TiAWjl4jGWpIFCAgTeMuvns4doAZugAeY49WtHZAHBKgH8sCxAqgHuMSxAqgH4baxAqgHpc-xAqgH552xAqgH6J2xAqgH-dOxAqgHydqxAqgHqeCxAqgHptSxAqgHqNIbqAex3BuoB7CbsQKoB66xsQKoB_2ysQKoB8jPsQKoB8nPsQKoB83HsQKoB_HRsQKoB_zVsQKoB_vVsQKoB4zWsQKoB4vWsQKoB5risQKoB5visQKoB53XsQKoB53UsQKoB4HGG6gH_K-xAqgHvtmxAqgHq8UbqAe3obECqAfVqbECqAfn2rECqAfetbEC0gguCIBBEAEYXjICggI6D4BCgMCAgICAgIACqoCAEEjZoNI1UBRYoNnctZmXlwNgAZoJMmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvsQlzvAmLxvpUbsgJAMgJigKYCwG6C0EIAxAFGAQgCCgBMBxAAUgAWE5gAGgAcAGIAQCYAQGiAQgKAKgCAdgCAqgBAdgBAYACAYgCBroDCXZpYXRsemFhYdALEtIMAhABmg0BEqoNAlVTyA0B0g3hAmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvP2djbGlkPXtnY2xpZH0md2JyYWlkPXt3YnJhaWR9JmdicmFpZD17Z2JyYWlkfSZjYW1wYWlnbmlkPTI0MzA2MTI1NzMxJmFkZ3JvdXBpZD0xOTg0MDYzNjcyNTcmbG9jX3BoeXNpY2FsbF9tcz05MTkzMTgzJmxvY19pbnRlcmVzdF9tcz05MTkzMTgzJm1hdGNodHlwZT0mbmV0d29yaz0mY3JlYXRpdmU9ODI2MzYwNzIwNDcxJmtleXdvcmQ9JnBsYWNlbWVudD0mdGFyZ2V0aWQ9JmNwaWQ9NmFiYjg0YzhlYWMyODMwMDExMzRjMDhlJnN1YmlkND1HLTRZSDFXTEM5QjkmZ2FkX3NvdXJjZT0yJmdhZF9jYW1wYWlnbmlkPTI0MzA2MTI1NzMxuBP___________8BiBQBsBQDwBWBgIBA0BUB2BUBmBYB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpFxfsx-tJXB_muhcGKAAwADgB0BgB8BgBwhkCCAE&gclid=EAIaIQobChMI6ordtZmXlwMV-RDbAR2l5TA-EAEYAiAAEgJN4PD_BwE&num=2&cid=CAASwwHkaKvqOsoeYDintrq5jh4NqlBU12Gzxs1kow-bQN5Wmg7fYUCtxTUfZr0BzLK44yABJNOaQ0NN1jc2gOEN7xxduhSx8HlykUj4bN6VEg_pW9haf_lYWBbK9LklFn82TXHsiQ94caYr1WP2a3P6fXUk137H5j0m1Y4ivZH9kY3sqVrKTI6UhYVjMyNMMsguwnL4u9pi3pNDPtCPOsNLlritjMZbzn9YwykUAr1OlmpVQeY1L9Vy7O4lqEN4Zqa6XgCW77g&sig=AOD64_3792L7A7pt6xKWXVJ8LNLVQ-nF3w&ms=%5BCLICK_MS%5D&nb=0&nx=%5BNX%5D&ny=%5BNY%5D&dim=%5BDIM%5D

Resource

win10v2004-20260911-en

windows10-2004-x64

9 signatures

150 seconds

discovery

Report Analysis Logs

General

Target
https://www.googleadservices.com/pagead/aclk?sa=L&ai=CN3MUa3i9aqqpIvmh7L4PpcvD8QPrzJ34iQGB07TNtBawkB8QAiAAYMn2pozQpOQPggEXY2EtcHViLTYyMTk4MTE3NDcwNDkzNzGgAZirhc5CqAMEyAMKqgScAk_QlOkl7_LPHyihFKLClVMBZETNfoHb-RQmMm7xBORkqWJTMKU929AgzzbSD5UUHVSn27qTzbtQxTR9WZOSa7aAIXtYb_Wlf6cnCtsDsk74uHmpI5MCAeaamqqhwRmPlx0-quYUB31nIFDdfEVQxMeljuNzjpb8P1QUQgE0lqI4pV0YXH71Vlp7Av8y-mzmygfx3Kf5px_HwRqmqs0tZXd2wW1r8bRQUAFHqEorXoU2wYreyvFbqZv1EPEt82EuZ_yhJ1OE8K3aBHj5eQQkeiDBbNS0sEbBTa6Jx_qejRIYx5fTzQ7J4Nh8ZXLCUYapML09yMRPrldLKrXxtW1jnUdgy4RP5eONSwTJhj2GIkyqcZpjLY_FRkt6lr0TiAWjl4jGWpIFCAgTeMuvns4doAZugAeY49WtHZAHBKgH8sCxAqgHuMSxAqgH4baxAqgHpc-xAqgH552xAqgH6J2xAqgH-dOxAqgHydqxAqgHqeCxAqgHptSxAqgHqNIbqAex3BuoB7CbsQKoB66xsQKoB_2ysQKoB8jPsQKoB8nPsQKoB83HsQKoB_HRsQKoB_zVsQKoB_vVsQKoB4zWsQKoB4vWsQKoB5risQKoB5visQKoB53XsQKoB53UsQKoB4HGG6gH_K-xAqgHvtmxAqgHq8UbqAe3obECqAfVqbECqAfn2rECqAfetbEC0gguCIBBEAEYXjICggI6D4BCgMCAgICAgIACqoCAEEjZoNI1UBRYoNnctZmXlwNgAZoJMmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvsQlzvAmLxvpUbsgJAMgJigKYCwG6C0EIAxAFGAQgCCgBMBxAAUgAWE5gAGgAcAGIAQCYAQGiAQgKAKgCAdgCAqgBAdgBAYACAYgCBroDCXZpYXRsemFhYdALEtIMAhABmg0BEqoNAlVTyA0B0g3hAmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvP2djbGlkPXtnY2xpZH0md2JyYWlkPXt3YnJhaWR9JmdicmFpZD17Z2JyYWlkfSZjYW1wYWlnbmlkPTI0MzA2MTI1NzMxJmFkZ3JvdXBpZD0xOTg0MDYzNjcyNTcmbG9jX3BoeXNpY2FsbF9tcz05MTkzMTgzJmxvY19pbnRlcmVzdF9tcz05MTkzMTgzJm1hdGNodHlwZT0mbmV0d29yaz0mY3JlYXRpdmU9ODI2MzYwNzIwNDcxJmtleXdvcmQ9JnBsYWNlbWVudD0mdGFyZ2V0aWQ9JmNwaWQ9NmFiYjg0YzhlYWMyODMwMDExMzRjMDhlJnN1YmlkND1HLTRZSDFXTEM5QjkmZ2FkX3NvdXJjZT0yJmdhZF9jYW1wYWlnbmlkPTI0MzA2MTI1NzMxuBP___________8BiBQBsBQDwBWBgIBA0BUB2BUBmBYB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpFxfsx-tJXB_muhcGKAAwADgB0BgB8BgBwhkCCAE&gclid=EAIaIQobChMI6ordtZmXlwMV-RDbAR2l5TA-EAEYAiAAEgJN4PD_BwE&num=2&cid=CAASwwHkaKvqOsoeYDintrq5jh4NqlBU12Gzxs1kow-bQN5Wmg7fYUCtxTUfZr0BzLK44yABJNOaQ0NN1jc2gOEN7xxduhSx8HlykUj4bN6VEg_pW9haf_lYWBbK9LklFn82TXHsiQ94caYr1WP2a3P6fXUk137H5j0m1Y4ivZH9kY3sqVrKTI6UhYVjMyNMMsguwnL4u9pi3pNDPtCPOsNLlritjMZbzn9YwykUAr1OlmpVQeY1L9Vy7O4lqEN4Zqa6XgCW77g&sig=AOD64_3792L7A7pt6xKWXVJ8LNLVQ-nF3w&ms=%5BCLICK_MS%5D&nb=0&nx=%5BNX%5D&ny=%5BNY%5D&dim=%5BDIM%5D
Sample260930-zvfegavset

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{EC379266-7050-4D1E-836A-4324F02DE805}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{83E2E59D-CA10-4E66-AC76-4FC8B8CD580F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1264	4448	msedge.exe	89
PID 4448 wrote to memory of 5040	4448	msedge.exe	91
PID 4448 wrote to memory of 1984	4448	msedge.exe	93
PID 4448 wrote to memory of 1984	4448	msedge.exe	93
PID 4448 wrote to memory of 5624	4448	msedge.exe	92
PID 4448 wrote to memory of 5624	4448	msedge.exe	92
PID 4448 wrote to memory of 5624	4448	msedge.exe	92
PID 4448 wrote to memory of 5572	4448	msedge.exe	96
PID 4448 wrote to memory of 5572	4448	msedge.exe	96
PID 4448 wrote to memory of 5572	4448	msedge.exe	96
PID 4448 wrote to memory of 5712	4448	msedge.exe	95
PID 4448 wrote to memory of 5712	4448	msedge.exe	95
PID 4448 wrote to memory of 5712	4448	msedge.exe	95
PID 4448 wrote to memory of 3724	4448	msedge.exe	98
PID 4448 wrote to memory of 3724	4448	msedge.exe	98
PID 4448 wrote to memory of 3724	4448	msedge.exe	98
PID 4448 wrote to memory of 2580	4448	msedge.exe	99
PID 4448 wrote to memory of 2580	4448	msedge.exe	99
PID 4448 wrote to memory of 3896	4448	msedge.exe	100
PID 4448 wrote to memory of 3896	4448	msedge.exe	100
PID 4448 wrote to memory of 4628	4448	msedge.exe	102
PID 4448 wrote to memory of 5868	4448	msedge.exe	117
PID 4448 wrote to memory of 5868	4448	msedge.exe	117
PID 4448 wrote to memory of 5868	4448	msedge.exe	117
PID 4448 wrote to memory of 3748	4448	msedge.exe	118
PID 4448 wrote to memory of 3748	4448	msedge.exe	118
PID 4448 wrote to memory of 3748	4448	msedge.exe	118
PID 4448 wrote to memory of 936	4448	msedge.exe	119
PID 4448 wrote to memory of 936	4448	msedge.exe	119
PID 4448 wrote to memory of 936	4448	msedge.exe	119
PID 4448 wrote to memory of 5136	4448	msedge.exe	122
PID 4448 wrote to memory of 5548	4448	msedge.exe	123
PID 4448 wrote to memory of 6140	4448	msedge.exe	124
PID 4448 wrote to memory of 4012	4448	msedge.exe	126
PID 4448 wrote to memory of 4012	4448	msedge.exe	126
PID 4448 wrote to memory of 6008	4448	msedge.exe	127
PID 4448 wrote to memory of 6008	4448	msedge.exe	127
PID 4448 wrote to memory of 4988	4448	msedge.exe	128
PID 4448 wrote to memory of 5832	4448	msedge.exe	129
PID 4448 wrote to memory of 5832	4448	msedge.exe	129
PID 4448 wrote to memory of 5832	4448	msedge.exe	129
PID 4448 wrote to memory of 5572	4448	msedge.exe	130
PID 4448 wrote to memory of 5572	4448	msedge.exe	130
PID 4448 wrote to memory of 5572	4448	msedge.exe	130
PID 4448 wrote to memory of 5704	4448	msedge.exe	131
PID 4448 wrote to memory of 5704	4448	msedge.exe	131
PID 4448 wrote to memory of 5704	4448	msedge.exe	131
PID 4448 wrote to memory of 5800	4448	msedge.exe	132
PID 4448 wrote to memory of 5800	4448	msedge.exe	132
PID 4448 wrote to memory of 5800	4448	msedge.exe	132
PID 4448 wrote to memory of 4944	4448	msedge.exe	133
PID 4448 wrote to memory of 4944	4448	msedge.exe	133
PID 4448 wrote to memory of 4944	4448	msedge.exe	133
PID 4448 wrote to memory of 4348	4448	msedge.exe	135
PID 4448 wrote to memory of 4348	4448	msedge.exe	135
PID 4448 wrote to memory of 4348	4448	msedge.exe	135
PID 4448 wrote to memory of 1520	4448	msedge.exe	136
PID 4448 wrote to memory of 1520	4448	msedge.exe	136
PID 4448 wrote to memory of 5516	4448	msedge.exe	137
PID 4448 wrote to memory of 5516	4448	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.googleadservices.com/pagead/aclk?sa=L&ai=CN3MUa3i9aqqpIvmh7L4PpcvD8QPrzJ34iQGB07TNtBawkB8QAiAAYMn2pozQpOQPggEXY2EtcHViLTYyMTk4MTE3NDcwNDkzNzGgAZirhc5CqAMEyAMKqgScAk_QlOkl7_LPHyihFKLClVMBZETNfoHb-RQmMm7xBORkqWJTMKU929AgzzbSD5UUHVSn27qTzbtQxTR9WZOSa7aAIXtYb_Wlf6cnCtsDsk74uHmpI5MCAeaamqqhwRmPlx0-quYUB31nIFDdfEVQxMeljuNzjpb8P1QUQgE0lqI4pV0YXH71Vlp7Av8y-mzmygfx3Kf5px_HwRqmqs0tZXd2wW1r8bRQUAFHqEorXoU2wYreyvFbqZv1EPEt82EuZ_yhJ1OE8K3aBHj5eQQkeiDBbNS0sEbBTa6Jx_qejRIYx5fTzQ7J4Nh8ZXLCUYapML09yMRPrldLKrXxtW1jnUdgy4RP5eONSwTJhj2GIkyqcZpjLY_FRkt6lr0TiAWjl4jGWpIFCAgTeMuvns4doAZugAeY49WtHZAHBKgH8sCxAqgHuMSxAqgH4baxAqgHpc-xAqgH552xAqgH6J2xAqgH-dOxAqgHydqxAqgHqeCxAqgHptSxAqgHqNIbqAex3BuoB7CbsQKoB66xsQKoB_2ysQKoB8jPsQKoB8nPsQKoB83HsQKoB_HRsQKoB_zVsQKoB_vVsQKoB4zWsQKoB4vWsQKoB5risQKoB5visQKoB53XsQKoB53UsQKoB4HGG6gH_K-xAqgHvtmxAqgHq8UbqAe3obECqAfVqbECqAfn2rECqAfetbEC0gguCIBBEAEYXjICggI6D4BCgMCAgICAgIACqoCAEEjZoNI1UBRYoNnctZmXlwNgAZoJMmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvsQlzvAmLxvpUbsgJAMgJigKYCwG6C0EIAxAFGAQgCCgBMBxAAUgAWE5gAGgAcAGIAQCYAQGiAQgKAKgCAdgCAqgBAdgBAYACAYgCBroDCXZpYXRsemFhYdALEtIMAhABmg0BEqoNAlVTyA0B0g3hAmh0dHBzOi8vaXJvbmNsb3Vkem9uZS5jb20vc2FmZS9hbnRpdmlydXMtc29mdHdhcmUvP2djbGlkPXtnY2xpZH0md2JyYWlkPXt3YnJhaWR9JmdicmFpZD17Z2JyYWlkfSZjYW1wYWlnbmlkPTI0MzA2MTI1NzMxJmFkZ3JvdXBpZD0xOTg0MDYzNjcyNTcmbG9jX3BoeXNpY2FsbF9tcz05MTkzMTgzJmxvY19pbnRlcmVzdF9tcz05MTkzMTgzJm1hdGNodHlwZT0mbmV0d29yaz0mY3JlYXRpdmU9ODI2MzYwNzIwNDcxJmtleXdvcmQ9JnBsYWNlbWVudD0mdGFyZ2V0aWQ9JmNwaWQ9NmFiYjg0YzhlYWMyODMwMDExMzRjMDhlJnN1YmlkND1HLTRZSDFXTEM5QjkmZ2FkX3NvdXJjZT0yJmdhZF9jYW1wYWlnbmlkPTI0MzA2MTI1NzMxuBP___________8BiBQBsBQDwBWBgIBA0BUB2BUBmBYB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpFxfsx-tJXB_muhcGKAAwADgB0BgB8BgBwhkCCAE&gclid=EAIaIQobChMI6ordtZmXlwMV-RDbAR2l5TA-EAEYAiAAEgJN4PD_BwE&num=2&cid=CAASwwHkaKvqOsoeYDintrq5jh4NqlBU12Gzxs1kow-bQN5Wmg7fYUCtxTUfZr0BzLK44yABJNOaQ0NN1jc2gOEN7xxduhSx8HlykUj4bN6VEg_pW9haf_lYWBbK9LklFn82TXHsiQ94caYr1WP2a3P6fXUk137H5j0m1Y4ivZH9kY3sqVrKTI6UhYVjMyNMMsguwnL4u9pi3pNDPtCPOsNLlritjMZbzn9YwykUAr1OlmpVQeY1L9Vy7O4lqEN4Zqa6XgCW77g&sig=AOD64_3792L7A7pt6xKWXVJ8LNLVQ-nF3w&ms=%5BCLICK_MS%5D&nb=0&nx=%5BNX%5D&ny=%5BNY%5D&dim=%5BDIM%5D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff957a5c188,0x7ff957a5c194,0x7ff957a5c1a0
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16884386134531233126,14920742910618108615,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,5734831728249101096,50370824442727413,262144 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,12377171907892873322,15917699928059268257,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,12439710743720405586,17791662531907748933,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,309085671489030884,6532703857821747845,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4872,i,17077202250190443747,17089279818048797015,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,3866245248397283961,6223209265911377196,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5027994358108929078,12345102838254007013,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,18005880003026026956,12524659281107218485,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,18005880003026026956,12524659281107218485,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6004,i,7012397233836864304,2392790003254335120,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6336,i,17570028787123850887,4181811967879116221,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6632,i,2416962362132731605,13331699458716262207,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,7709315844770207737,4147694410736217159,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,17290595935983699813,8866609394424081156,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,4307026445576116881,10098097177230791374,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,14123204104269880201,7818712277971113812,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,11101857577746383460,9633161899182297771,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,18020748938550275552,6650083964689767229,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7440,i,6959247986049193226,8279073351986261575,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7228,i,18017621125306921897,9132780260041957226,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7684,i,7311380140011453890,3500561123157574167,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7068,i,17735210825397476110,1581002706018096017,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7872,i,7256849056799002230,5884853407425000254,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8000,i,14041625676887129643,6408476384664322998,2097152 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8396,i,3258186753189111288,9535864186571621871,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8692,i,4334988827869723900,9523737197209590101,524288 --field-trial-handle=2288,i,9536929384705197289,14502196178906276716,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:8
  2⤵
  PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

5089d3d4-918b-40bd-aabc-3d35f50bf91c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5089d3d4-918b-40bd-aabc-3d35f50bf91c.tmp
Size 12KB
SHA256 291757da2c612554bb822fbb52b5d30dab3c1c7e96051631ad8c47882ac2e8a2
MD5 5d9b98f7d33682ee4bdd3d00ecf81c34
SHA1 02298f80253bf36b4f188332e412f442fee77f23
SHA512 e75650543bfb0d0ab1012df944f7a9551ffa2b8e1a751203f9ca565b7d5041c123ef8348219c537c3bfae387958c701160bd5e924bca4570694f6d2222c92859
SSDEEP 192:sxZ+Rzku/fzs4QZLX8Qzodpp2VrgHW6+WNS0lXYot/dSU0Ig5NteJ:sxZ+Cu/fzs4OYT3Hb3X3VSXftq
TLSH
T14742D6156D28A97F8CC7D319FA55BF53E3F91032A1811E48AAFC8A2C15E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1f209afb8be0e8b946cde45133a7d6eee7472d7d1774388f25b5cabd3fc4bacc
MD5 e5185a5f6cf39b4f727085a316aaf25b
SHA1 7ba88a7bd5901b5efa0c1e89ba6dce5a01ebd373
SHA512 b15d758fed3c57e3370d513497ef78cae8c58e4c3984c5eb3666a9fc64f35fc65215ce7c60aa5dceea4b8f5ab9e0f031a23fc3be233dd612f9155394203d81d6
TLSH
T1E6F0F4A6D821EC7B08FD0B7960944B4AE760232B2A41AC4F3B3D910C8FB163B468582C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 d3ef0e6c4e7782136314b9096d4f365adeca179e26b1d262dc8f1d4b1a741364
MD5 078bbbdd91bf8a579ed9cdf718167cf0
SHA1 2ded7c9d085f5dc5165476b1b234c3c25168ad61
SHA512 911e72bfb52c27a0744ccd539d32b3725a307602f71443e1ec11f8ce40f59a7253a89ddfdbf588143180578a61c8cbe4ba76149921751d2e728a908220ea8cfd
SSDEEP 96:DhL1fmIqGQ64DW57rbLjYG8H9iuCAp+ohnQWX7x9lyG/RQsbTBhHIEfA:Lfvi67rbLcfAJe/hnRly+/bTHHIEo
TLSH
T1F5C184896D9B6057FB6B403FC2E0C64B3530E4BE6C5A6E372454CB7A7C62AF94981234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mcafee.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 3304b36747657f3ad59c521cb4c51863757447e670b5c3c96ef3b8b6ed717891
MD5 c686ef2610fb1ab4735e529d0071cb51
SHA1 cc8a3705387ce05181592aec40db602bc8598b44
SHA512 052341e67b0e5cdd2b74814ffbb4251224674d561d16ffdd3fd92ab202709921b39e0f2a20a6a21102eecf6b1e42ec277ebca86186e0df33c5fcb7cdaa77f7f0
SSDEEP 384:D1TZXiE4ehetP6YElbn5RA4PeeJe9u6eN/2M5ey6RIIHcd9Fayu1wNuGtrCfoEh6:WvMFN3my
TLSH
T1F8C29DFB83E4827DD91156F4AA14AE1BCF590524531C3C2AC9E8BE4BE3E2472E15274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f13f82a1a66872e2622edbb4998e220f65e8fc22415fea05fdbb40512061cce
MD5 8a5a61b61f2fe3ddb871882c24040979
SHA1 d0613bdec641984e27ba49108dbca153683286de
SHA512 caaff59a8393db8e97acd3b108821df65a236685c893c63e3a923376bed53ea8fc93ffcd82c1be554f1cd646fe377357d07c423a0af548872938624d129bdd73
SSDEEP 192:sxZ+Rzku/fzs0aQZLX8Qzodpp2fHW6+WNSLp/Yo7dSU0Ig5NteJ:sxZ+Cu/fzstOYTeHbs/fSXftq
TLSH
T19642D7156E28A97F8CC7D319FA55BF53E3F91032A1811E48AAFC8A1C15E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5364431067875660c9e7fd9e098506c95d36c51e565607a560dea5b56aabfd79
MD5 0dd4bb24d2ead46dcd709066c0254ea9
SHA1 912335987e7d7e1da76aa55095978b7a00c6ceb3
SHA512 c8db3bfc87c65fff0f149e95d8e3ee82f9b4dacc0b002099bf329c31d180cba68c1ae758d2e361ad31f4335fa13bcbfc22f4c073d29f0cbe1fb03a02fa25eaff
SSDEEP 192:sxZ+Rzku/fzspaQZLX8Qzodpp2fHW6+WNSLp/Yo7dSU0IgjteJ:sxZ+Cu/fzscOYTeHbs/fSXjtq
TLSH
T1C342E7156D28A97F8CC7D309FA55BF53E3F91032A1811E48AAFC8A1C11EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d0c1e35ac76ba47f1b5f6ff73fdc82132c280142ef139035347345a9d60305c3
MD5 151157567be67fbd6d255d455f2635cb
SHA1 444468097e3a1bc7b67c567933f763b5085ccb21
SHA512 7939f9a96b60e332bf014b5c97a322514d9611a0d72f45ced760ade44ebb8d11359a71d6a899f3380fe81991f5c3cc0d1a82227d4dc55f91bb43aad6f895eb1e
SSDEEP 192:sxZ+Rz9u/fzstQZLb8EY4odpp2VrgHW6+WNSOdZYo/dSU0Ig5NteJ:sxZ+Tu/fzstO8EM3HbZZjSXftq
TLSH
T1C352EA167D28A97F4CC7D209FA59BF53E2FD503291815E48AAFC8A2C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e3940bbcdd10e3d37ce281fd400fbc88dd47270ca5f41d7a8adad1fa07c8f5e0
MD5 dc4b8a48b68df5b91a0b23ae3d41e137
SHA1 4aeccb3b10ab8682a134f16dfa2275c84bbad2c8
SHA512 4c2214f426dd1ab8b82e63a19a7520117edeebcbcba5ae67a916fc215a3d02efbccfebf5b1ef4e5b66e04db013593cafd20da6b0462ee98ca075aa4b1b8b24ee
SSDEEP 192:sxZ+Rzku/fzstQZL88EY4odpp2VrgHW6+WNS0lXYot/dSU0Ig5NteJ:sxZ+Cu/fzstO3EM3Hb3X3VSXftq
TLSH
T1B942E8167D28A97F4CC6D209FA59BF53E2FD403291815E88AAFC892C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dfdd931641752cadc98a08a6eb6facf4d76b1fc510ed7a7118b71a0804aa3117
MD5 5aa44433bf2fca4d71ce1c4e9b1013ee
SHA1 c8d9d89af0e5d1c34c7282c2d4ee603aaddb71c4
SHA512 5b07b870de208f3ceb26ed7dbd0d33fcc6baa5a159f9b8bfe49d7e08124d7a0a367b4e8d58e4ab7621b16358fc7ff7b2205dfa6c09ade2ae2e56868d2b09ccc3
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgX:ST/2dXOJhJlpfnpp3tNXVrN3mFDw
TLSH
T1F3B2205571BB421039FE290892B5872E168231B37159E62B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f606f20c9aee24c38925cd5b7ac5738f7ea4ad28ea13908f3dd8f49463ce4778
MD5 865126fea07a48c415f1b0a0494bead0
SHA1 de416d0919076d0f0aad95ba7aa769bf42d25695
SHA512 e90e8019493b2f42592b0c39cd93ee6d86b9ec3245b9d44da3f68cfa028db9ad7571d4233791428af463660576ca27988c49ec2a76906bd5e7b4769892a63925
SSDEEP 384:nRiFiZcIC3sNi8TUNTUlI4kaKM0b+wzWfLBCUz5o+RYoFuCiHtgOIwZOysLZgL/a:4FQC3PwgAWFEBCUy+RYoFPiHXsjIS
TLSH
T17AC24A36EC98DABBECEA4F95A74A7603DEF44153D58C9AC8D9D81D1C00D74AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1e0f387f69c8498998c06da16f8b3567deed33b1fba6dad4aea2a2b137f9d5d5
MD5 adae054734ee4ebd250ce7be63b29258
SHA1 37ddc73029a2d4382edbc0ee76fd698a782ead0c
SHA512 2bcc3238e4a2654e7b9f70770e6c68d94e9d022a9013fd169fc882fea0d3bec583b0189860833f50c4bced2128e65771d172862984eccfc959c4cb0ae395bebf
SSDEEP 384:nXiFiZcIC3sNi8TUNTUlI4kaKMYBywzWfLBCUz5o+RYoFutiHtgOIwZOysLZgL/a:SFQC3PwgAsZEBCUy+RYoF+iHXsjIS
TLSH
T198C24A36EC98DABBECEA4F95A74A7603DEF44163D58C9AC8D9D81D1C00D74AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b72486e72107f10c65ccddc3cd6d01397be155359b5c89ed86b09de6c7aa88c6
MD5 c6f6571c4f0038e6f51aa42817c7aca3
SHA1 38fa7a33cd22db6d69e2600e55c1ce7bd5e23ba6
SHA512 4b7d56a4a7883a48a6dbac47be490f1239a1ffad3d7f73bb0d3aa8554c2c020b9a264be735d4770ffcbe251e6e38950070de6cd6666e48b57673cface6031f41
SSDEEP 384:nWiFiZcI63sNB8TUNTUlIm2aKMis4wzWfLBCUz5o+RY9FEsa+VY68gL/7IzVoA:9FQ63AwgcpHEBCUy+RY9FEhgGP
TLSH
T157C24A36EC98D9ABECFA4FD5AB4A7A03DEF41163959C9AC4CAD85D1C008359D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0eae98469a4c114ed1ad7de00dcd5b125bb82e1dd8fca9b383b41e88e351bcb6
MD5 01dc32a9462ad918f2c3b01608fd6fdc
SHA1 1a5f2b58f45e71f1972e01d1d28a246b444e972e
SHA512 1f0f7f24f8bac6426b5f8209f036c9be5f09427f1ae9179da41254837cbcebf7096f8ad0c34311253d024f436929eef66e60ccc9f898b11152806fe793b7cdd6
SSDEEP 384:nDiFiZcIlc3sNi8TUNTUlI4kaKM9YywzWfLBCUz5o+RYoFutmHtgOIwZOysLZgLC:uFQm3PwgA0ZEBCUy+RYoF0mHXsjIS
TLSH
T13DE2A2F698D799B7E8EE4B87A37D6D0299BCC113B5889584B7D41C0CCC864BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 00d999ff486993af9ff97e7331124434125b41d889712a5ba05e7a11f868bc1a
MD5 710f0381c64a5b944da5089d71b39324
SHA1 46dd1c3021238c732db046e63a597c8b4d856363
SHA512 03903f85d1b37740f362991fb1e6f060838d4ae5f24e38fe85ce939f9d243d6017e9ae0fbf650f2584498aae5afa4dd5a3699d8b11e6a1a2587ebd0aac89348e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 934e2338185b16b82cd601c32ffbe31cde88843f39aea20f5c5c10ba5e5db1cd
MD5 435aab3ccf92271b3d79587fb01b7bbf
SHA1 05e098d081b3cdadf5dcc7af17b9bc5608c39fbe
SHA512 2bf8b80043c66a34a94316922aaee3a4ff766f75a00b2e2a3e3c3a617aa238e8fd999090327f03d5af19e9237641fbd79752a68bb8482a289c9aac8cdf896a79
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe595eef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595eef.TMP
Size 392B
SHA256 2ff8d8d0daa0a2fe1afd99e538a9a3610cdb1a71b160fc3ad6fa8eafd8d81de0
MD5 81cfcdd7e967b04728937cbd2de31650
SHA1 eecf67841d01350c1a988a6fae075070f3a132d8
SHA512 67c1bf4632ae146146f426d9d28bd24bb6bdfa2f226b1727859c24eeaad0852205319e4afc2ab1d078eb2a20b4552caebc87bc89717a9d6adc0dc2d9e205238e
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4da274adcff6f873c1e35530f8c09367d8ba2f83643edaa2e0baa87689b5f675
MD5 a966a5b0008a302a530564b50cf2fe74
SHA1 42164dcf5cf76f36e22601f3e3decabe13648554
SHA512 6d8f959e2f9cd072f1bc99a5dcf2116d50bd46db5183a72faeea35bc91dd540af8003de08569666b4bef959c255c0dbaad7a5c5cc24fff57c6a9af82f14f4488
TLSH
T1BE41DA68A6E9114CF3B76E5AAFF6A86D487EBC372E07D49D10110E4F0662B40C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4628-216-0x000001DE6AAE0000-0x000001DE6BAE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads