hxxps://winter-static-signals-floating-past-darkened-engine-rooms[.]uobgruop[.]com/routingmatrix-securityprocessing-authmodule-layerframework-sessionvalidation-nodegateway-dutycalibration-informationinsufficient-requiredinteraction-single-sign-on-authoritytimeout-reviewengine*joe[.]wilhelm@asarco[.]com

Analysis

user interaction
yes
max time kernel
300s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://winter-static-signals-floating-past-darkened-engine-rooms.uobgruop.com/routingmatrix-securityprocessing-authmodule-layerframework-sessionvalidation-nodegateway-dutycalibration-informationinsufficient-requiredinteraction-single-sign-on-authoritytimeout-reviewengine*[email protected]
Sample260701-xjp4esev41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274056292539757"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{79052357-9AB9-487D-84D8-907C93E5CA15}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5300	msedge.exe
5300	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5564	1144	msedge.exe	84
PID 1144 wrote to memory of 4560	1144	msedge.exe	85
PID 1144 wrote to memory of 3644	1144	msedge.exe	86
PID 1144 wrote to memory of 3644	1144	msedge.exe	86
PID 1144 wrote to memory of 3644	1144	msedge.exe	86
PID 1144 wrote to memory of 4132	1144	msedge.exe	87
PID 1144 wrote to memory of 4132	1144	msedge.exe	87
PID 1144 wrote to memory of 3096	1144	msedge.exe	88
PID 1144 wrote to memory of 3096	1144	msedge.exe	88
PID 1144 wrote to memory of 3096	1144	msedge.exe	88
PID 1144 wrote to memory of 1092	1144	msedge.exe	89
PID 1144 wrote to memory of 1092	1144	msedge.exe	89
PID 1144 wrote to memory of 1092	1144	msedge.exe	89
PID 1144 wrote to memory of 5960	1144	msedge.exe	93
PID 1144 wrote to memory of 5960	1144	msedge.exe	93
PID 1144 wrote to memory of 5960	1144	msedge.exe	93
PID 1144 wrote to memory of 5916	1144	msedge.exe	95
PID 1144 wrote to memory of 5916	1144	msedge.exe	95
PID 1144 wrote to memory of 5916	1144	msedge.exe	95
PID 1144 wrote to memory of 3124	1144	msedge.exe	96
PID 1144 wrote to memory of 3124	1144	msedge.exe	96
PID 1144 wrote to memory of 3812	1144	msedge.exe	97
PID 1144 wrote to memory of 3812	1144	msedge.exe	97
PID 1144 wrote to memory of 1116	1144	msedge.exe	99
PID 1144 wrote to memory of 1564	1144	msedge.exe	105
PID 1144 wrote to memory of 4004	1144	msedge.exe	106
PID 1144 wrote to memory of 4704	1144	msedge.exe	107
PID 1144 wrote to memory of 5480	1144	msedge.exe	116
PID 1144 wrote to memory of 5480	1144	msedge.exe	116
PID 1144 wrote to memory of 5532	1144	msedge.exe	117
PID 1144 wrote to memory of 5532	1144	msedge.exe	117
PID 1144 wrote to memory of 5532	1144	msedge.exe	117
PID 1144 wrote to memory of 5300	1144	msedge.exe	118
PID 1144 wrote to memory of 4828	1144	msedge.exe	119
PID 1144 wrote to memory of 4828	1144	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://winter-static-signals-floating-past-darkened-engine-rooms.uobgruop.com/routingmatrix-securityprocessing-authmodule-layerframework-sessionvalidation-nodegateway-dutycalibration-informationinsufficient-requiredinteraction-single-sign-on-authoritytimeout-reviewengine*[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbc85dc188,0x7ffbc85dc194,0x7ffbc85dc1a0
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15749373282255066508,2967900695298186175,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14033465576100028625,16993600071238033519,262144 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,1010004112959693240,14537168593489855981,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,11158064313846037233,5489638201183555815,2097152 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7812071447972648591,11701629859323688412,2097152 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4912,i,13308534650008522330,3540790927937238724,2097152 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4812,i,17279380167906290714,9690826970891029032,2097152 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,5341258482885545177,1147590796868326221,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15097930629937594707,6686896594249478656,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5278669527561446871,8073042173488827758,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5278669527561446871,8073042173488827758,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7064317121775598691,2514056842929654101,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17499153655430530086,12083130522499492075,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11771656863937737047,4439154046027990479,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7693834457742118210,15044378895988176757,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5824,i,4192393067617748862,681441077265226997,2097152 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5240,i,1319231792042368168,3912212467967689316,262144 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,9230498543314605547,5355282581876086688,524288 --field-trial-handle=2348,i,6765777426897925148,8473604188711226024,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
  2⤵
  PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 0038e92367c9c997054f136208733994912fafb1e84d1ff9ba877b47a9b62475
MD5 4e21581b1aba7570de44552d8fa0f042
SHA1 ad68100abe1c62f859654dcd798afcbb907ff0d5
SHA512 2ab415645903dd8fdef58eae499709d65c513dd8796aae4a44dc8bb08be64a5b94f2117e7d16417bd09c6e7e98d90ccb1860c0e18d0efa79c5a9cbcc38588143
SSDEEP 192:lj+wZFrXu5IIIEo1qqb655IIIIiiTTTTcccNNNA6h:lj+wZFrXu5IIIP1qqb655IIIIiiTTTTK
TLSH
T133F14F028394CEDE9B4660CA4DA8639C50B1770BEFDCD508039C99ED304E4AEEBB57E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3ff4df4f4b8f6f50afafe78a820b046384cf892f201ebb9088e3e18ffd4c53a6
MD5 2ffaa2018e144fc660cc111eed9a43e9
SHA1 60790e76c498a745d8553693e9c6f3b9c00db193
SHA512 f72ec659865c40ff3e138f0f2ba43d19ed2cec7d3c7cb266329c421bf29a40d3490ce7a0e37104cb40653c30915720399300ce9d793597e68062c57f53b0d2a5
TLSH
T1ECE022BBC822EC2728FD8B18B45D868AE70013273A41994F3B3C834C8FF062A45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 755f6def2773024a047414d6fd9e3bc120e1609f5c63587761e9f0159ea85a32
MD5 7f21ecbe69d559e9b79605665f20878e
SHA1 2206b9c84a9272e2f972f0013dfc217c96247013
SHA512 761e6507fabc876e2aca8be42e111e5f5653dd667779f4e1b9d5476b95ac018d7110cb865b195ad139b3b13243f765bc488a47889d909eceac2ece4f5aa5f4f1
TLSH
T1EF81C73449D351AAF360013385DF054CB877DDF9FE276F9168A4A8B1232B3B180ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb89e18b7e85d2d5efa2b9d397061d7c552f634a0829f7b926cd48797c0a1148
MD5 1fb2a9e0b2e1954b523f840b05010a37
SHA1 76c9eb94c7fab301b2d427e1767e6b790bb05bf2
SHA512 51145b8b21d12642e3f228a636f7c015b72a599c16c5cf10175fe9b801e709d2d4a39536420199bfbe304c5663e98f6e7c59bb5c1e752c2b3beff0c8b46bce99
TLSH
T14881C87049D352A9F360413381DF054CF877EDF9FE276F9168A4A8B1272B77180ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5836f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5836f9.TMP
Size 3KB
SHA256 dea7dceb5b2fa240231a3f861aa3426a94e94f2fbb7fe588cd334ad5f89cb793
MD5 6d19848aefaaa39b4c28184e834e7323
SHA1 99714c28e521768241c804b0a771d25f9a2814ce
SHA512 72986ac051062dba36548d78c3ecc17c8fa44f9944ac87e83aaebf11c155422566e0074c06ceb1959160f0421fe76274505b22f8e171170174a152f306338533
TLSH
T14F81C53049D352A9F360413381DF054CB8B7CDF9FE276E906894A8B1232B37180ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1355a7753242a38062890f610999cbe5dea4e59157bce4421ea48f6b007bfbda
MD5 2241e989bdb1b406cf8d438f106dc054
SHA1 11e43777c0d78cf8dcc856fe05bb94a8d7dda3c7
SHA512 56fa56b99785819b6ab0402de1ecaeccf44a9f01d165de9b1dc6cee9e4487928dcc0568ea59c68dc12e9897ad1babfb7961834952373c433b62163e64aa4bdf3
SSDEEP 96:D/O1fFK6uYfuYn5aaij6YzHGDPwfLWuY5muYJxuYFx:DW1fFK6ZfZ5aaij6YSDP2LWZ5mZJxZFx
TLSH
T178A19EE2C7E48A6D9D1156F0AB153D2FCE29091483283D6BCDE4EF5B93E2070D241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fe831d3f7a51b1df0523e0bee43fa3e732ee19a10d3c9d5946ac3cc8fc973d29
MD5 dd83b5af1982ca6359df6ebcdcc88b9d
SHA1 03dbeaeea316b843775ba31c246e73d01877a2ad
SHA512 30e30417606db68d4ab62d1fa792285936aed43695920c188c5689daed725d946e76fa181cad5b029a857606dcec4d46429cc5b259ea11e41bbeb1694183caaa
TLSH
T1D771ACE3C7F48A5D9D2196F0AB157E2BCE2D0914432C3D6B89E4AF5B53E2070E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a78ddab40d9432d666833a7e0de13fc215d2b8354f90d6fca38c5141d54c9a66
MD5 8b87b7a38fb9a7d825ae9f1a0a04366c
SHA1 e754110c046458ea2dab843b7289966fa8699021
SHA512 b52876c8a1b8f0ee075cb573ffd06aba052aa59abca7302d4960564d3ff51525ac5c9543b52f8e095c02ec60b8c550a63961ffab049f2e283fb687ebbd1ace34
SSDEEP 192:sxZcRiyMqZjK1Ml8UQ1kQ/f6sKOYZjZduzodp5/IuHW6+WNe4pGXYvQZ8wAIg5aY:sxZcbq+Q/f6sKO0z1RHb0XUn8Y
TLSH
T14072E91A6A34997B8DDBD219F545BB53D6FD056392904E84AAFCCB0C01E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9700fd506efdb14d9f794e05f536bd9a237afb19bfa0263616b34d444551c503
MD5 3e25babe2381864cdd7c37e54024e7e4
SHA1 58a2d9939c3f5f1137d16257150c4a52ca461fbb
SHA512 c0c0a2554617501e833d2418d842f4321c2024c015f7331e693c76902c754d165e1a79a794f49000a9f1826ff292a94ff3b70e168d07f7860adf646541237d9a
SSDEEP 192:sxZcRiyMqZjK1Ml8MkQ/f6sKOYZjZduzodpzuHW6+WNr7Z/YvSZxwAIg5aUJ:sxZcbMQ/f6sKO0z1iHb5/Xn8Y
TLSH
T10962E91A6A34597B8CDBD209F655BF53D6F90563A2904E84A9FCCB0C05E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e6cf363b51562822b3b23c78638ec8e768e61b8cd654c14d8627186523804e6b
MD5 c8510c1fdfa49ba8828087b59701999d
SHA1 5e855ab20a439539e952d2d7cf96f112ef90a5a9
SHA512 4259831a48a9f6f6f6cdbc221937b069533dee6fe209f589f4ad2236c74fafc70539c8477bc5feba7165e8f07caefe5e3a166b4218fccd42ed6cb630f330f0fa
SSDEEP 192:sxZARiyMqZjK1Ml8MkQ/f6ssfOYZuaZduzodpzuHW6+WNr7Z/Yv3C+wAIgjUJ:sxZAZMQ/f6ssfODaz1iHb5/wnjY
TLSH
T1BB62F91A6A34997BCCDBD209F655BF53D6F80563A2904E449AFCCB0C05E7ADC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 713cc240e85b0344256b121b908e135a4a74dd4bcfb3a0902d0840e49539cfb1
MD5 406f2eb116d78bac4e143360ce3dd986
SHA1 f85286b30aa953da98dd65cd7e7a087ccbafb0bb
SHA512 32b320f5a21a35fa5efe00555bb3dcff27063b3c6fce78320757353a00059cbf6a30e9855aaaf4cbeef24f87b836a8b0ac88f25ef72e555f043b210367d98c55
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9VlfqI5MYKz:0LppY93PBZJPtN53VNi
TLSH
T1D2B29C1A713F0212397E2948B39696364F4235A37058E4AF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e3d8bafc7a847b05e90e679f79bac55a86a18a43e0c097b87faa938ff747c492
MD5 d6e0487b09edef79d1ddaa584f7c08b5
SHA1 e9a48b4d77e1d131cb55d893c1c9cb4e58b1f6e3
SHA512 a58fb77c82ac2757ce25056b36d6aad2ca0f906a13393841c43666a74aec81500a4c8f245d4b02f8b8de316ad81256c75b147c4fb62820694e771b71458db50d
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9l6KphBftGnIwpae4KV8p0mHpty/7IgI:pEFccps3mwgbkUgk1GIvI8p0wd
TLSH
T1DCB25B36DC58C9BBECE74F99BB4A7A07DEE4126786989AD4DAD81D0D108319C070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0c94357460cd00db748de890aa792b7e676fd2e2a24096e3eb168c43a59e41ac
MD5 f085b7594accabe311d4eb8cebcf1f52
SHA1 b686198386df83a0abca5dd50c85bdac0a098905
SHA512 26f86f06dd9000f4f9567f0fd0a338017f1e9e9f7b7c70dc1becae5de1f85efe28fdefed0dee28f82b4b3e2cc96fbc31c3c86bd240439204ce571607af5c0a15
SSDEEP 384:nIiF1tNn/s3n9SdzsNX8TUNTUlI40QckCrvBqphBftGnvENVxGueQsUkUty/7Igj:TF1j+9Ciwg3ksE1GvENVIRUkT
TLSH
T159D25A36D854DEABECE68B85B70A3607EEE441638AC86AC4EADC5D4D01C72ED0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ca1f2bf7dfbb697b388005967cfdc2b68646fe887bc6c0cf4fb3051615028758
MD5 9ee4dd2f4d2fc52add0494097c06c593
SHA1 dab19c3a718cd4e7ecdc5ccaf06a77b9ac94e5a7
SHA512 f5fb75799751fb0cde443a023d933ca9ac3d517789c8a56fae573be5d515f68c384942d7979c61b4dd87dad99073c9ddbdb5f587b5760362e62747c15173aead
SSDEEP 384:npriF1tNn/s3n9S3sNX8TUNTUlI40QckCrbBqphBftGnv9VxGueQsUkUty/7Igj:pGF1j+9Iiwg3kYE1Gv9VIRUkT
TLSH
T144D25A36D854DAABECE78B85B74A3607EFE4416386C86AC4EADC5D4D01C72ED0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b9c8e22fdc1d259eb56de07eafedc16ec3367f478a4ed35a4b12d6524703b7eb
MD5 5ac7b97f44787dfbb1576dc6c9fe187a
SHA1 a05fd44a4ed0e7666283bff43cabfad0837a091e
SHA512 0d8b0eded35634945cd5109b3a70a43aef347baf20b770e3617d197b11e3b5764b4c5212ddd3f86f7146e3756019b43c510052bdc60f50d0e41631ff4cece0d3
SSDEEP 384:npriF9CcmyWCs3sNX8TUNTUlI4YQckCrbBqphBftGnv9VxGkQ2ty/7Igy:pGFccps3iwg9kYE1Gv9VIkQw
TLSH
T1ABB24B36DC94D9ABECE74B89F75A3603DEE44163CACC9AD4DADC1D0C019B19D430B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 35b7332400a01dc79fa1e233cb325ea37b5e2fdd1372783d0e46f6c3718b595f
MD5 dfb1160ee97788d577dd3d0981b22a6e
SHA1 3177bc4e177fc23befb8c197a81b671c16210464
SHA512 d7c11b728f421411959d7c52cc11b248bd46b979585be9a769c5ef3b1a30995bf7fb2f500435a1380ec9214b0599d67f97ad5f46de4957b66b2dd2c18235f070
SSDEEP 384:n/iF1tNn/s3n9S3sNX8TUNTUlI40QckCrvBqphBftGnv9VxGueQsUkUty/7Igj:KF1j+9Iiwg3ksE1Gv9VIRUkT
TLSH
T194D26A36D854DAABECE78B85B74A3607EFE4416386C86AC4EADC5D4D01C72ED0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ecf443a47a8bf4268564a959747c99a53c25b77ba800302fc7a8791e38204a7e
MD5 33ffc67043bdfe1b7b0d57eede4e2b27
SHA1 0fb00cc79ccfe3a57ad422f814ebf64da4566d9e
SHA512 4aca152767a88473673a187ffbfeefe91f0ae1dd265134794a6d27c0112a9dcc3155ce5a1ca71a7f6ea8512b7fe3af1e771af7819da7877c1b39042c0bf6ac7d
SSDEEP 384:np+iF9CcmyWCs3sNj8TUNTUlIm2QckCr9TCrphBftGnvGVxGe4KV8p0mHpty/7Iv:pVFccps3ywgbkUmF1GvGVII8p0wd
TLSH
T12DC26C36D858C9ABECE78B99B74A3603DEE4422786CCAAD4DADC1D0D10971ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8814554cc8cfe061d59438e0eed291f137ee6400ec7777f3666dde00d47ff941
MD5 4ba814a9222ce9a75e2610d9f187eef1
SHA1 d6287911d8eab98d03f39d3422464cf0c8695373
SHA512 8472b30797706ad94370a4fb0596cd338528576a5daaac661aceb716df0b34f4451f8d43f38a4500f8c89f22040486ffb709862012d065420a6d69049d7e43c5
TLSH
T13E412759A6F91108B3B37E4AABF7B86E447EB9771F07C49D10110E4E0A26B44C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download