hxxp://docsgoogle[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://docsgoogle.com
Sample261026-rrt5fsts7m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{F1629DD9-64C6-497A-BAF5-246B7A6E23CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5196	4648	msedge.exe	84
PID 4648 wrote to memory of 1648	4648	msedge.exe	85
PID 4648 wrote to memory of 1160	4648	msedge.exe	88
PID 4648 wrote to memory of 1160	4648	msedge.exe	88
PID 4648 wrote to memory of 5924	4648	msedge.exe	86
PID 4648 wrote to memory of 5924	4648	msedge.exe	86
PID 4648 wrote to memory of 5924	4648	msedge.exe	86
PID 4648 wrote to memory of 1236	4648	msedge.exe	89
PID 4648 wrote to memory of 3568	4648	msedge.exe	90
PID 4648 wrote to memory of 1236	4648	msedge.exe	89
PID 4648 wrote to memory of 1236	4648	msedge.exe	89
PID 4648 wrote to memory of 3568	4648	msedge.exe	90
PID 4648 wrote to memory of 3568	4648	msedge.exe	90
PID 4648 wrote to memory of 4932	4648	msedge.exe	98
PID 4648 wrote to memory of 4932	4648	msedge.exe	98
PID 4648 wrote to memory of 4932	4648	msedge.exe	98
PID 4648 wrote to memory of 5628	4648	msedge.exe	100
PID 4648 wrote to memory of 5628	4648	msedge.exe	100
PID 4648 wrote to memory of 5628	4648	msedge.exe	100
PID 4648 wrote to memory of 2428	4648	msedge.exe	101
PID 4648 wrote to memory of 5584	4648	msedge.exe	102
PID 4648 wrote to memory of 2428	4648	msedge.exe	101
PID 4648 wrote to memory of 5584	4648	msedge.exe	102
PID 4648 wrote to memory of 2308	4648	msedge.exe	104
PID 4648 wrote to memory of 2476	4648	msedge.exe	105
PID 4648 wrote to memory of 2476	4648	msedge.exe	105
PID 4648 wrote to memory of 2476	4648	msedge.exe	105
PID 4648 wrote to memory of 3664	4648	msedge.exe	112
PID 4648 wrote to memory of 3664	4648	msedge.exe	112
PID 4648 wrote to memory of 3664	4648	msedge.exe	112
PID 4648 wrote to memory of 4628	4648	msedge.exe	115
PID 4648 wrote to memory of 5860	4648	msedge.exe	116
PID 4648 wrote to memory of 5856	4648	msedge.exe	117
PID 4648 wrote to memory of 5876	4648	msedge.exe	119
PID 4648 wrote to memory of 5876	4648	msedge.exe	119
PID 4648 wrote to memory of 2740	4648	msedge.exe	124
PID 4648 wrote to memory of 2740	4648	msedge.exe	124
PID 4648 wrote to memory of 2740	4648	msedge.exe	124
PID 4648 wrote to memory of 4724	4648	msedge.exe	128
PID 4648 wrote to memory of 4724	4648	msedge.exe	128
PID 4648 wrote to memory of 2664	4648	msedge.exe	129
PID 4648 wrote to memory of 2664	4648	msedge.exe	129
PID 4648 wrote to memory of 208	4648	msedge.exe	131
PID 4648 wrote to memory of 208	4648	msedge.exe	131
PID 4648 wrote to memory of 916	4648	msedge.exe	132
PID 4648 wrote to memory of 916	4648	msedge.exe	132
PID 4648 wrote to memory of 916	4648	msedge.exe	132
PID 4648 wrote to memory of 4068	4648	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://docsgoogle.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2a8,0x7ff8ae91c188,0x7ff8ae91c194,0x7ff8ae91c1a0
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,971537757530919189,12827201854833503774,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12235798964273679157,6255129958767800114,262144 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,5012091133032387583,2159080943175294598,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16262236116507436047,7829617955113681891,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3258141192035945054,4715761096356382451,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,9733588766727330851,8252856437597188737,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3608,i,12302190159884560993,12628262638547218385,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,17254336530019152362,17939005635238795565,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12515133980752754168,15230185646845040887,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,1154976550178112358,3884687909425687167,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,1154976550178112358,3884687909425687167,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6148,i,2532242736861814608,12770085643239606997,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3408,i,639704254157407995,3156746131086467540,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4204272939758567788,16205791682848494195,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2737442536608235301,1570272031824815017,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,12728372658455463851,2623636236138481992,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,6023931262993983848,2950831159886583693,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5152,i,11539832015277794096,2629526709904831952,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11102282087049878540,6539278697399485441,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7552344420265607840,13779494543152679438,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,16738765004510859516,4431394922031449704,524288 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6024,i,12312757959458106684,15972864569739636797,2097152 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5312,i,11848793648771272459,16360112142383397054,262144 --field-trial-handle=2248,i,7519111140934046949,11073970147617313240,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

48e7c80d-f5ca-4ff2-bd0a-0909fbabaf64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48e7c80d-f5ca-4ff2-bd0a-0909fbabaf64.tmp
Size 12KB
SHA256 30ed05f9b43cd31955b03679a88c625f7eebe93a72873d814b87ebb34a2fe7c9
MD5 7d51867e431f2505ca669e4feba245eb
SHA1 d382c4b4e6ca83c787f348d726b18cc57f743939
SHA512 0607901a1917afa89022c6a9682aed9a5a02248a57153b344cfa5d06c02726bcdf616012317af88cd439d0d098e83456f1d583574922a3fc023e14a619f0ccca
SSDEEP 192:sxZRRpkW/f7sfaQZLE88zodp/8HPdf6+WNPS4/YonQoSGhIgjt6J:sxZRAW/f7syOvfkHFcV/rScjt2
TLSH
T12A42E8166D28A97F8CC7D60DFA557F53E3F9503290810E44AAFC8A2C15E7ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63e6324f-7647-492e-91aa-3621d176f956.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63e6324f-7647-492e-91aa-3621d176f956.tmp
Size 414B
SHA256 f5758dc9b25e22130f1d19da55deeea3975b80a931ee181341b56bab0955964d
MD5 6bebe39bbfc075cabc6a51a8e90bcb4f
SHA1 90854b6685b80c847a3aecd6d2f608e93f7c0141
SHA512 900884363d8d6a259aa5f41025230582b3641e83cd126688cce0c657e55023bf668d5d881fc1998f436281d4664e33b42534797eb6d1686ea35783bb2e7f40ce
TLSH
T1D0E02BAAC815FC3B1DFD5B7D54540249E75423672A409C4B3B3DC0088FB0537518686C
MD5 SHA1 SHA512 TLSH

Submit Download

78cdb90c-8ae8-4d44-b90c-c1ba41cca725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78cdb90c-8ae8-4d44-b90c-c1ba41cca725.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86126b71-2c61-4644-b94d-824a138d9db1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86126b71-2c61-4644-b94d-824a138d9db1.tmp
Size 12KB
SHA256 420a481d57707ee373a799428078ae466aeb4f10452adc8f927719277b1b4960
MD5 db7b1bd989b707c68cd618df47a5d559
SHA1 e113110387b840f53c8edc8e071c8ebf820d863f
SHA512 e6e8e678fb911ae7aba7dfc58723eb73d761177936eac245bc163448ef14e496baa2bc245b02f78237b472bfcc79ac0b87e48ec005e93d8a5c68eb5e11a847bf
SSDEEP 192:sxZRRpkW/f7syaQZLE88zodp/8HPd6+WNPS4/YonQoSGhIg5qt6J:sxZRAW/f7s7OvfkH+V/rScAt2
TLSH
T1EF42E8566D28A97F8CC7D61DFA557F53E3F9503290810E44AAFC8A2C16E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97d103db-bf8c-4406-ba94-f09d795b8384.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97d103db-bf8c-4406-ba94-f09d795b8384.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9b5932ee-c5ae-4436-b800-5f7ab1d55c70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b5932ee-c5ae-4436-b800-5f7ab1d55c70.tmp
Size 12KB
SHA256 78d535d7bedee7ef7fd627c041765f99427d4ef27c4b6a718a326870d70c625f
MD5 5286fb2c2554ecee6ceb4eb0470a2ef9
SHA1 52cec5b9586db9b05898ba149d51f200dbf1f75e
SHA512 6eb0024c8fd151f5bb6945672f813c3d109e22b3236ecff8c148d3c10d3942677e8af0024f474f6df64fdd9a386fe99bd3e7064b5a41c2c40a980f73fc460a54
SSDEEP 192:sxZRRpkW/f7sUQZLE88zodp/8HPd6+WNPS4/Yo4QoSGhIg5qt6J:sxZRAW/f7sUOvfkH+V/iScAt2
TLSH
T16542D7566D28A97F8CC7D61DFA55BF53E3F9503290910E44AAFC8A2C16E76DE220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7a57d9599b1c609e7440460220fdf3556c63db4f19602e6e7b14950923d9319f
MD5 d66414674769967914ae3590c78e96ed
SHA1 c8c4544988bc17188c4374569111936174e2ff9f
SHA512 698b0f46e5774907b16e7636e6657ec8483287ec05fe56ba6db331b16c47d2bfa837f8b3398e9472419df9b848ee0671414dbb9e7eb9b41af73f452308c7ac69
TLSH
T1A5E07DE444CFC3AEA208749B097CF30C83A1365ED6C06ACE7704C585F4065C0BBE2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 480e0c551a7b01fa2ca8570bec97f33fb52e563d7910c8e691e85e21b118cea0
MD5 9ab6d56334317930ee8a144dde68a30c
SHA1 1203333e5f264cd3c208e375bf67895ecc204975
SHA512 4ff06ab2b22fb6187d82fbf1bbfa0a1575409feff61f973b107088e06e4ef7e1ba45fc0aee71be83b0f915453c497c3ca4339e15caa1e2911278ec028855af07
TLSH
T161E026C415CFC23EEA58645B017CE30CC781B69FD2C0A9CE2B08C985B806548E7C2691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2364e8c1f00beb0f28655e7587a078c29094eafe36facbd0252c78d02c7871b4
MD5 6c3b468776e7c0cc8a770d2922a95eb8
SHA1 ac1c2b1f1bf4ced53d843ce58e7e40ffb466191e
SHA512 a873565ae3bd613a8005e3cd3c30816e4407b2796ae9fd445d7ce619fab418b5d3a0c1a2163f3c5ae8a16fd2e91d040582c0acb703c587d44baf6d07046b6a6d
TLSH
T1EFE0CDD435CEC26EF30C6447416DF38C8794367AD6D4798E3728DE88B247544B6D3690
MD5 SHA1 SHA512 TLSH

Submit Download

ca314378-930f-456d-8a84-b423597ee7ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ca314378-930f-456d-8a84-b423597ee7ad.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6fd98489-278c-46d4-9396-d1183b4dc48e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6fd98489-278c-46d4-9396-d1183b4dc48e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

eccdd4ea-e79c-4f55-a245-8ab06c7480a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eccdd4ea-e79c-4f55-a245-8ab06c7480a1.tmp
Size 1KB
SHA256 9e53b062fc324abc09b1436c97804e7b631e4a815a4275d7432c01274a2095da
MD5 997304b0fb76367844da64441e468056
SHA1 4d6560223326ad7ba628be32f9089ca258e3627f
SHA512 69e67b4568a7584bc12d92c72b37b21b8ef5d97a205976a65b5468b16eecce00b2b4984d46da81a1ea1514017551b9f11119b9415cf4ac864d397304359ca2e3
TLSH
T1F731ACF383F4856E8A0196F0AA18AE2FDE2D0515432C7D9A84E4AF2BC3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

f1da2818-567b-48f5-8756-300b92fe8f2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1da2818-567b-48f5-8756-300b92fe8f2a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4ff4f43d8995f66039181bdc11e5cebadc80daa0b522259121d0055248d8f05b
MD5 99e9b940426a91af3ae91f0a6393f62e
SHA1 64bdf9131ab40ebc28b4f9e71e2738f9f08bee7e
SHA512 b3e444bbc62e4973f3a98a249d1a773c09cbf6214e09171a57f85c9c81109162fea7d4ece3c80c0462ef343b26726309691a799b0c99d32480c28b0f23171ad5
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg3:ST/2dXOJhJlpfnpp3tNXVrN3AvD2
TLSH
T1F9B2321571BB421039FE291C91B5872E068272733219E66B7FBD40B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c54ee423-93f4-448b-b866-dc164cc18489.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c54ee423-93f4-448b-b866-dc164cc18489.tmp
Size 26KB
SHA256 840d135668a9e94718b30ac088d9cf36754a49c2fe0e6063c718a9ee6b0d18f0
MD5 75ee7f568d615db9bc4f39b61030cf88
SHA1 d1c403c93100ae32dc7c694d57613f8f0d754508
SHA512 53de0260c34d88c06b031f842617df330dfcdcc7c23895bab7c60c2303e67c2575944960ee0bb786b27bbf795a9e744ff33efce63999b87985bfa18857ff0331
SSDEEP 384:n0iFzQkUSvO3sNg8TUNTUlI4taKMPk1w2fiBCfkhEyj8ixK2IWgL/7IzhIIlI:PFdO3dwgfm6BCfkhDgiQ54Ly
TLSH
T108C23A36E898DEABEDE78F95B74A3643EEE04213C99C5AD4D6C91D1C00CB1ED1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec0866e1-e725-46cf-a433-bfdfd1ac6eea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec0866e1-e725-46cf-a433-bfdfd1ac6eea.tmp
Size 25KB
SHA256 b902f792c40c48c3cd7f075f6b8630c2504dc55143a9503ad5152a38fc3dbbdc
MD5 127daa4b0670342de648e01732c2efc9
SHA1 0fd19bfbe309877b70fddb8a56474917dca029cd
SHA512 95ccddb12deb27265b5604831655c7d984baa9eff1c4c2e5421fae3deb280f9dbc9a030d051df5784f272e69be2f56a567bbf0fdec9db68be368fd5cbc4efc97
SSDEEP 384:nKiFiZcI63sNB8TUNTUlIm2aKMiT4w2fiBCfkhEyPFwsa+VYwSgL/7IzLon:BFQ63Uwgc4nBCfkhDPFwhgAc
TLSH
T183C24B36EC94DDABE8FB4FDAAB4A7613DEF00163959C5AC4D6D81D1D00871AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fafc6c21-f682-4941-a2fa-834924c492ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fafc6c21-f682-4941-a2fa-834924c492ff.tmp
Size 26KB
SHA256 c25528a6c62174e3351a5d6152b57dcee5b990e452575c3382168c9c5133f791
MD5 243745ca9398bbcd9df38ce4fabc2e23
SHA1 a12f2dd05269f9e0c57ef46bacbd0e7c80b6e2eb
SHA512 f4bb1bf8bac9135e4e29eeae5465cffbc05407b9456a8e98fdfa80bf7b4d106f39af775b9992f72f00b2ef242f846090bd663f8197f0974eb117d0f0c749c52b
SSDEEP 384:n5iFzQkUSv+X3sNg8TUNTUlI4taKM3k1w2fiBCfkhEyjLmxK2IWgL/7IzhIIlI:QFdk3dwgf+6BCfkhDPmQ54Ly
TLSH
T1A0C24A36E898DDABEDE78F95B74A3A43EEE04223C99C5AD4D6C91D1C00DB1ED1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd127189-3992-42fb-b16c-b96b89ce3b4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd127189-3992-42fb-b16c-b96b89ce3b4d.tmp
Size 26KB
SHA256 4ca1fbb2eda9391a0a918c3efb129762346b6894980c9f6279faa8228f822d97
MD5 3c6d4cd2f19085dc471288e683405605
SHA1 865e719af90199a0a5810189ae06c9a33b60652c
SHA512 694de1c430354e77a1a3f346e3c210dd7685ca7fa0bfa907bb5611f04e09d9405a817cf7eb85c87b4abe40b2891b2645b71f5763588f3aee6216cc03bb22776a
SSDEEP 384:neiFzQkUSvO3sNg8TUNTUlI4taKM3k1w2fiBCfkhEyj8ixK2IWgL/7IzhIIlI:1FdO3dwgf+6BCfkhDgiQ54Ly
TLSH
T1BCC23A36E894DEABEDE78F95B74A3643EEE04223C99C5AD4D6C91D1C00CB1ED1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffa409eb-ebe0-4443-ba40-271b77b49e0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ffa409eb-ebe0-4443-ba40-271b77b49e0f.tmp
Size 26KB
SHA256 5c4fa0124bdaf358ec1efb7193beb66c169e103cbe3c54b597a4d4cfeb4f2f09
MD5 062f5b9c3026ba894cef0df962caabd3
SHA1 42f1ea92f1660c10da995a25694e4d7564a00cd3
SHA512 1769528904ef23e246fdc71658e9e31b4862721593b8607123cdf573376176178ad43506688eb8e198f6e5606c3044f3eca2d27295db43e0aa16df252824038e
SSDEEP 384:nZiFiZcI63sNM8TUNTUlIm2aKMcn2w2fiBCfkhEyjXixKsa+VYwSgL/7IzLon:wFQ63twgcgxBCfkhDTiQhgAc
TLSH
T165C23A32E894D9ABECE74BD5AB4A3603DDF4426386CC9AD4D5D91D1D00DB1AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 90d2c1a21a72864ba4bebf6e593ed21f8ce4df358506f302c25443da2eec7b55
MD5 3cc39e4a9d3de1fb00b013bc841950c1
SHA1 67de45970c324a88ca883594a3ada35b5e6e3e79
SHA512 c7cff119c2b860e5e31d6e3f6ce066d61f98b8261285aa49ef05a6ae1fc8a0f9b397106bd5c4d9412c8fb54469813370ec6ac5815db81723857a355a4fcbf9b7
TLSH
T1B6412D58A6E91148B3B37E1A5BF7646D847ABD771E0AD49E10110E4F0672A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2308-204-0x000001DB08EE0000-0x000001DB09EE0000-memory.dmp

Download