c125d8215b3d3bd2fc9c95195ee2029453e2a962faee6052c8a3f44f259071c8

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pre2/index.html
Size 6KB
Sample260507-pg4vsshs9p
SHA256 c125d8215b3d3bd2fc9c95195ee2029453e2a962faee6052c8a3f44f259071c8
MD5 29783bb8ac2603d7a62d6b56bdfdf5c6
SHA1 79c5325363100de2f1b7742ad88df15118f2e85f
SHA512 2c2fe8588a3961bf7973cf3e2ad1bc7989bd80ccfb4be04cfa8e1da58b56ab2606864c00a648e5081d76a2e5c65fd53b11f7b6d5f01e0b660f20ced2a42fca57
SSDEEP 96:LofpPvFb0B0dDwRgwWz2ELfgKiBFi2Pi9bKADUs:LofpPvm2d0RexgKiLi2i9N
TLSH
T172E19425A9C504456A33A374FBE3A345F3164427F6018BAC7BDD62924FB218886B7FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4540_1200486446\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4540_675917387\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226306870280157"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{43354B36-A331-439F-BF5E-9ACFC610F83E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4680	4540	msedge.exe	85
PID 4540 wrote to memory of 5288	4540	msedge.exe	86
PID 4540 wrote to memory of 5320	4540	msedge.exe	87
PID 4540 wrote to memory of 5320	4540	msedge.exe	87
PID 4540 wrote to memory of 5320	4540	msedge.exe	87
PID 4540 wrote to memory of 4536	4540	msedge.exe	88
PID 4540 wrote to memory of 4536	4540	msedge.exe	88
PID 4540 wrote to memory of 3788	4540	msedge.exe	89
PID 4540 wrote to memory of 3788	4540	msedge.exe	89
PID 4540 wrote to memory of 3788	4540	msedge.exe	89
PID 4540 wrote to memory of 1060	4540	msedge.exe	90
PID 4540 wrote to memory of 1060	4540	msedge.exe	90
PID 4540 wrote to memory of 1060	4540	msedge.exe	90
PID 4540 wrote to memory of 840	4540	msedge.exe	93
PID 4540 wrote to memory of 5076	4540	msedge.exe	94
PID 4540 wrote to memory of 840	4540	msedge.exe	93
PID 4540 wrote to memory of 5076	4540	msedge.exe	94
PID 4540 wrote to memory of 1280	4540	msedge.exe	96
PID 4540 wrote to memory of 5776	4540	msedge.exe	104
PID 4540 wrote to memory of 5716	4540	msedge.exe	105
PID 4540 wrote to memory of 3312	4540	msedge.exe	106
PID 4540 wrote to memory of 3340	4540	msedge.exe	107
PID 4540 wrote to memory of 3340	4540	msedge.exe	107
PID 4540 wrote to memory of 4660	4540	msedge.exe	108
PID 4540 wrote to memory of 4660	4540	msedge.exe	108
PID 4540 wrote to memory of 5052	4540	msedge.exe	120
PID 4540 wrote to memory of 5052	4540	msedge.exe	120
PID 4540 wrote to memory of 2976	4540	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pre2\index.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff4932c188,0x7fff4932c194,0x7fff4932c1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4923427342845901899,11104195742261640759,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4295099271514525020,17269637572917288176,262144 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,12962540347622528357,763244825608914141,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9868746415298161947,14008417218507745101,2097152 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15782910080894289650,4167664112927768483,2097152 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6739724130042949594,17050270929722988591,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3879382386038015309,13060471882732976033,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,15742447486786277622,5109287606505639662,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,15742447486786277622,5109287606505639662,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14762563031266262580,11148857358399594617,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10103062458736354855,14003791147657690664,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,1168003363533527777,11403745009120882943,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12272091776417773029,2421695823205754514,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4393266146209948724,17330943478889939427,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5180034128962077551,9478845531239010876,524288 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,17018605239719616598,11053471009923069916,262144 --field-trial-handle=2240,i,12112745961655888873,604964284797444107,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 351fca3c10f47b0eb203c0a4e73787e637ad69fda2978329c0e2d8638ee008e4
MD5 272ad2cef781a671327d5013656abf98
SHA1 8a7a365e77ccc9e5c3bef79a08a277f8142823fb
SHA512 94a0fd98080ecc29c0bcae08cbf9f0a9def629de31f6b39c00537d74c2e89c916f70135e513e83256d71771e4e91f1606a5123ec677e705fef437f1a994ac2fe
TLSH
T196E02BAAC921EC670CFD1B5D70A48646E74413572A81590F3A3C81088FB0A3641858AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 248bb26c1fc84dd80c8fb8481f5975f51d84a594d0833b17bf4f7440fbcc13e1
MD5 dd8c2fc5136cfa55ad62c882a310f535
SHA1 d25d5327e00337b99b760436f9f61c7d04016930
SHA512 775f81b1540416b5a5485d34f591d643b0ccb4c2ebdfdf175a86522cb75a468967d4240cebe98c93663ff33bc96bc52cfa825c3e7c80b863424347d194d1c4c3
TLSH
T19651C0F7C3E886AD891156F0BB187E2BCE1D0955432C3C5AC9E4AF0BA3E2570D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e1570417a2635815a4692c599a033189edb2d9970495c47c5999f893aa8635de
MD5 3276723280c5005eb22dc5438c29b6ea
SHA1 5d1f1ee283597cb5dcccbd63170fab84f041a225
SHA512 144b8caf5172bec121d21bd72e2969b9f96aa1caab21878ea612c8f32b22c5c7869463294ff5b0e5b5632932bda1e241a391f17c4daf898d36b4ab7402455778
SSDEEP 384:sxZ/BqSC/fUs0jhfSuV52CDHbGKYVMLdSE:sHISC/f8j95v24HbGKYVMH
TLSH
T1D072F816AA38A977CCD7D219FA457B93D7F9113392504E44A9FCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f12195aed79ae9b2dc6dbc1af3a79f26aa6a93b0c10054d0c891cf3915c83b4
MD5 31b356bc33a3b3f23d7ed65d5dfadab7
SHA1 55d331c70d7258702da8b2a2e1fc927625c2902b
SHA512 fa13747ac4ed687f4fb76365258d09784043a2de3b74c4100c60c805a8cc1aac1fab18478fbbaf6b575ab78c5cf42d5949a106c5b1e04d5237d8a181e37cfcb0
SSDEEP 192:sxZ/RwyMqZ/K1Ml8MkC/fUsDhfS8+HST552pzodpHjHW6+WNGYxYaeeuAM+wIgjH:sxZ/BMC/fUsDhfS8V52CDHbGKVMLjH
TLSH
T18A62F9166A38A977CCD7D219FA457B93D7F9153391504E48AAFCCB0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 dfdad9b1f86549004b9afa5024c80e703e64423b2ba9eb57b0fce13246dbd1de
MD5 60a34facefce9b93d33c13a5f87b8c66
SHA1 dc2018e9809fc42dceaf85d655984a7d11f8c2dc
SHA512 b0b94aafc5e6c920d8af3ab0be33831337d48cb0f4580853a75fa001dea7087b3a420941fc2ba886e62db1852d129c0d8faf39ee9695aee8b230c0825a67d4d7
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6DFkLlMeNtFroe:Jdc+txWE/VRWvV/qHu1jazDFkLO6t+cf
TLSH
T176F20B3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d3d5df143dc8518795a06dc95e18da90aa7f0f39b41caf378c215cbe338bc016
MD5 74f1a85a1ba790b5c86bc849f3ede7c3
SHA1 15ef4d9899be4b5a8f5ed2918687d8791ad5c3cb
SHA512 d4be58a658efe061e358ce7518b9835a0dec95376a764be77e5115d411844a2c2f1958283f70e2643692bcec1b809fa1a986ff3a82d65f3f427ac7a9cde9fc99
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xfsXb:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDV
TLSH
T14CB22910313B07C03A7E699E9595B86E62C270633058A83B7BF840A64F6BF14DDFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ada3fd106f05adec2fb509f87005b0c99ccc878837c14c72411934de6b3086f0
MD5 d237fc2451a8b9bd07fe646aac24a743
SHA1 c35abd7fb58e71032c1ae0f168159be3edc12209
SHA512 a5a6da5ae0ae5d142df9758fb1f6a7ede7cdda6333abd1dfb8abc3e1dbef39433dfe3718b64cfe24f679ef06a15691cca5a8cd2e440bdffd23763213e4bd6f9e
SSDEEP 384:nFiFavqMg3sNSo8TUNTUlIm29JC9v3vfEPu4utSr8NZdnS4mtmR+srNlk+5vI+Y:MFayv3IwgmcPm0r8NZdS4smskE
TLSH
T140C25B75EC58D9ABEDE78FC9A7497A17DFE001A7D58C4AC8CAC81D0E109729E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fcc078521316eea89d9d6cd78facdc9409973255d3cb278392117f2fde4ffc3e
MD5 32fc330475296c4407f01284086ba081
SHA1 a029d1b60d5e8e51979b32988c65addf53895287
SHA512 b87bdbcecaad7d16abd2709342fe10affe2fa1673ee80a640954eac9a67322800deea81acab593d550873821e5baf35b6fb459626f46ca0121c81801e8c77a44
SSDEEP 384:nIiF9CcmyWCV3sNRZ8TUNTUlI4+x69J1QD3vfEPu4utSrkeSNcc9Dn1PDiUrNlkW:TFccpV3uZwgHx7QPm0rLSNcc9Dn551
TLSH
T11AC25B36E868DDABEDE78FD9F30E36079EE011AB858C49D8DAD84E0D008719D174BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fa6f9edd14c4697e86254cad2716376dbaaf58646d315c64bca07f68b976a5d2
MD5 3040f977c9738eb55a6a86394f3aea0c
SHA1 d9d6b6257e8238a962aa5e5c830b19021fef5f79
SHA512 c1e1445ee7ae42a10f310746f91b23f678ea9416fe8b8e9c27c925943641afaf4bf5d09b2ad13ce16582acdf2af9f911b1889a35d00405e586c2aa5bd87f6c47
SSDEEP 384:noiFavqMg3sNtZ8TUNTUlIm29J/ww3vfEPu4utSrkeCNcdnS4mtmR+srNlk+5vIF:zFayv3eZwg2bPm0rLCNcdS4smskE
TLSH
T1B9C25B75E858D9ABEDE78FC6E7497A07DFE001A7D58C4AC4CAC81D0E109729E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 99d4a34ebe808d8d6732b5cd2ddea442d98f3929ab554a3351d0becdad5381d6
MD5 aa508eaaa1071b3b8d3449c445d9e7e5
SHA1 1186c03e02a541acb8ade7bc97ca620c7715ca86
SHA512 94f4e34907906c1f824a83fb4c792e796b7c7bd589623844b6f4d9ff08e9c70076f717f2a5561cd5dff50f3a127737957190134e235ff18813e539d9f58cca03
SSDEEP 768:RFccp23uZwgHx7fbRfm0rLdaNcc9Dn551:V23uvxjc0tQcc9N
TLSH
T199D25B36E858DDABEDEB8FC9F70E36079EF011AB99884AD4DAD84D0D008719D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bc16f45718ebd97605e7b3118a56c69e970162aa4809fadc3c82f03f4450e2da
MD5 9db3904524f9b47a658eeda79a651909
SHA1 a8461dc6895af1ed94bf06787aae8d9a969e8ee5
SHA512 fb247255c49be15b0be8de976b10b9c7b86d4c12eea96f0b2876f137304a829a7e5a2709fb4fc2d00709cd30f864136fb1aa363b183bab4f9311df3d01742beb
SSDEEP 384:nQiF9CcmyWCV3sNRZ8TUNTUlI4+x69JOQD3vfEPu4utSrkeSNcc9Dn1PDiUrNlkW:rFccpV3uZwgHxMQPm0rLSNcc9Dn551
TLSH
T183C25B36E868DDABEDE78FD9F30E36079EE011AB858C49D8DAD84E0D008719D174BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a0af06e056d4e81b242cc915953f01f9c7cd9f0af99efb2de79dba66cd3d8781
MD5 d84acfdede1fa06aae66bcbcb624e373
SHA1 cd1e3ccb0808e6202a66bbfd4d60a97f342ad85b
SHA512 86c5b269fa980c4b79719c2d519709ababa26d0ef73619c2a8e68b9b52c0e56f360cc6b68ef8354bce491437a9aee75764517b7100985ad08c0f5e74c0a95501
TLSH
T1EA41385CA6F91148B3B3AF569BF6686D48BFBD732F06D49E00010D4F0A62B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1280-203-0x0000020333760000-0x0000020333809000-memory.dmp

Download

memory/2952-35-0x000001A2DEE60000-0x000001A2DEF09000-memory.dmp

Download