hxxps://grok[.]com/project/b390dacc-f684-46a0-b323-4d8261a296c1?tab=conversations

Analysis

user interaction
yes
max time kernel
116s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://grok.com/project/b390dacc-f684-46a0-b323-4d8261a296c1?tab=conversations
Sample260720-paembshv2n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290228479728137"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{C78DD5D3-C64A-4CA1-9E49-C74031BD0223}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{AADEB77B-2D91-4F0F-B90F-DDAB10CDEC5B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4688	4728	msedge.exe	84
PID 4728 wrote to memory of 1528	4728	msedge.exe	85
PID 4728 wrote to memory of 5832	4728	msedge.exe	86
PID 4728 wrote to memory of 5832	4728	msedge.exe	86
PID 4728 wrote to memory of 5832	4728	msedge.exe	86
PID 4728 wrote to memory of 5072	4728	msedge.exe	87
PID 4728 wrote to memory of 5072	4728	msedge.exe	87
PID 4728 wrote to memory of 1036	4728	msedge.exe	88
PID 4728 wrote to memory of 5420	4728	msedge.exe	89
PID 4728 wrote to memory of 1036	4728	msedge.exe	88
PID 4728 wrote to memory of 1036	4728	msedge.exe	88
PID 4728 wrote to memory of 5420	4728	msedge.exe	89
PID 4728 wrote to memory of 5420	4728	msedge.exe	89
PID 4728 wrote to memory of 3420	4728	msedge.exe	93
PID 4728 wrote to memory of 3420	4728	msedge.exe	93
PID 4728 wrote to memory of 3956	4728	msedge.exe	94
PID 4728 wrote to memory of 3956	4728	msedge.exe	94
PID 4728 wrote to memory of 3500	4728	msedge.exe	96
PID 4728 wrote to memory of 3576	4728	msedge.exe	115
PID 4728 wrote to memory of 3004	4728	msedge.exe	116
PID 4728 wrote to memory of 1872	4728	msedge.exe	117
PID 4728 wrote to memory of 4800	4728	msedge.exe	118
PID 4728 wrote to memory of 4800	4728	msedge.exe	118
PID 4728 wrote to memory of 4800	4728	msedge.exe	118
PID 4728 wrote to memory of 3572	4728	msedge.exe	119
PID 4728 wrote to memory of 3572	4728	msedge.exe	119
PID 4728 wrote to memory of 3572	4728	msedge.exe	119
PID 4728 wrote to memory of 4004	4728	msedge.exe	127
PID 4728 wrote to memory of 4004	4728	msedge.exe	127
PID 4728 wrote to memory of 4004	4728	msedge.exe	127
PID 4728 wrote to memory of 6032	4728	msedge.exe	128
PID 4728 wrote to memory of 6032	4728	msedge.exe	128
PID 4728 wrote to memory of 6032	4728	msedge.exe	128
PID 4728 wrote to memory of 3580	4728	msedge.exe	129
PID 4728 wrote to memory of 3580	4728	msedge.exe	129
PID 4728 wrote to memory of 3504	4728	msedge.exe	132
PID 4728 wrote to memory of 3504	4728	msedge.exe	132
PID 4728 wrote to memory of 3504	4728	msedge.exe	132
PID 4728 wrote to memory of 3588	4728	msedge.exe	133
PID 4728 wrote to memory of 3384	4728	msedge.exe	134
PID 4728 wrote to memory of 3384	4728	msedge.exe	134
PID 4728 wrote to memory of 4008	4728	msedge.exe	135
PID 4728 wrote to memory of 4008	4728	msedge.exe	135
PID 4728 wrote to memory of 4008	4728	msedge.exe	135
PID 4728 wrote to memory of 5952	4728	msedge.exe	136
PID 4728 wrote to memory of 5952	4728	msedge.exe	136
PID 4728 wrote to memory of 5952	4728	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://grok.com/project/b390dacc-f684-46a0-b323-4d8261a296c1?tab=conversations
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff988d4c188,0x7ff988d4c194,0x7ff988d4c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9290155931303355111,9083677602436155133,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3125373106442015233,11436953410507228621,262144 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,2883092516894577255,1605946498446340536,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,9600304998134300061,6015983282155074438,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,4560608398765618853,14212452877427876361,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9141686546478189580,17210371327131953510,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15224323860484174384,4481057017783615038,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,10037545776486961650,12508398997709663681,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,10037545776486961650,12508398997709663681,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13021074815967994488,5958933005079159253,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,17410536210353062924,10711167032970938873,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5184378850969393630,16095466036554962366,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6284,i,7416118017741762494,7326492592496924577,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6716,i,393122238104930619,12181679353162138096,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3624,i,865800893708095064,12237285418707387033,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6880,i,15804632639924039255,9115884553025469803,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,8921575396827707710,16742153941271549446,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7212,i,12235306442145125795,16695714324384542434,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,1929009647122151093,11684247368522392387,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,9224998501702464080,12695555612328537558,524288 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7448,i,3271195449447480423,12618275630068328800,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6272,i,12326995241204633664,3273332956225613835,2097152 --field-trial-handle=2356,i,8142778025578034635,14908546438734878865,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6c1eaf0683403fba5551aeefbc447dedc778f7d88528298c5f9291ae81159402
MD5 f131cb5efc9b9503e563e252c68251ef
SHA1 359113ea48d64677cd2067be54fea22cb37706a9
SHA512 691320856212ba6217fb55d16ce7edda67eb7bd3a79bebac3336d84d069dd4f4082b16d07535e05b1792cab76b268054f6327a52d30f01e3474f87dec888dafc
TLSH
T19EE02B6BC821FC2718FD175861298A66E71023172650495F3A3C82088FB462A56C585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 23KB
SHA256 7e3414ca99ea3bfb7c5107c591a9884749830f4c787be379f981861e80f18a83
MD5 72324f2401f90c68d8ad1a09ec3c76d6
SHA1 e1a8ecf5715f2838cccfb8dd79457511d666f2e5
SHA512 907b0e7f268c942dfb26ccf8e9a1a99d4c65b4f7a5d11e7632af3ca5d094ad9f3b57df654c41fe8d993ee17f93b6018dab1b33702ae42eceb44a80216d1c9512
SSDEEP 384:enQck7PXExLkvKCNjaEprI6USH/7qCNdJk+Ito5mtvtdnhLjMX8lY9adiNWNY0az:mO7PmLk26rI6H/D3ItYmtvtLq8lYAdiz
TLSH
T18EB2F1FAF1DEAEC46ABAAE6E5FF990F246BD1D5200CC713B806D5814DAC8C897011D4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 690d95542b0fddb789e3bedc949c4b6d541aac8a4059a925a88fd4946bbcb497
MD5 4fb18d43098e5123983fc386cf91fbda
SHA1 d238b46bb50d3c627ab23fdbbe9b6c48af13e82e
SHA512 a75b4245321304e4ba71b39f31c8c1259f15b5e89f66687fd47554dc8ca4ddf04ec341489bffb1896e49b65b1d6e128f2f7819e92bb97aed8d0d64a88b6fc054
SSDEEP 96:q1QjPqYJ9eFgByZD5fDHudwF37mx3AgLqmJx5t0rq8Xp4oSJcM1D/SKpUBkUMF7P:XjPLY15SJx3HqmF2q8OcMx6KiBF+L
TLSH
T152F1A47D58AA01BEE798207064F1055077BDBDF5FA838F82AA43F6342B09BE1A0DD354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ac34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ac34.TMP
Size 3KB
SHA256 cf8684a8d9354bb4d8e97c7d442663729f33c7676152251bf863f24c911cf2ed
MD5 dbf0a80cb188311fd3fd5ffb25587b71
SHA1 e3624dd726c5c80e0c70219eb5c03713eb2fca0c
SHA512 34bf6611edde52e5ff4ea0794bd902e75077f159a0ebc91505fbd0e9eb3e25370c4c30ca213759cab3890fb305e21ae3f0a7166e278e85ed030c7a2cae7edcc2
TLSH
T1F061E73E8D0F02AFE32961B169D10648373EDAC4FD936F820192F5342E09BD1F0E6254
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ec035480fe61b9a76faca56f871e91f6febe7ffcd816c61783833b77ad70c3fd
MD5 f944df508b3b4d7363618d2bfa76ed0f
SHA1 5fa3a7c90b613e69ebe37ba3b3109cc60ae73ad8
SHA512 d28adf687de327a33d524cb4555f7acf2bc0aea3bcadbec73596775dcfd3093412c0e73529a89198a54738028ea49dfa9004540e56384bbddad28487be3321ed
SSDEEP 96:D1wOI/R5Igaaij6szVGI4cwBDxA4oKoYwsdh7P:D1LI/R5Igaaij6s5GI4ckDS4oKoYwYhz
TLSH
T1B2A19AF783F4862ED92152F0AA143E2BCE5D0615532C3C4A89E8EF2B93F2471E151A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 608a07b0f444c4bca8853751914735b11bb2ad03ab4c740cf5debc53abe27741
MD5 9da92f27d352e3726f3993e92435be32
SHA1 259977fb915a940cbe77c93d3cbdcc6aaea40cff
SHA512 66ce5000c4c252a724c2b1afef2deb5a962d3f4e12dae20d9639b5185e6e1f64b3155cdc1b16415370a882ca7994a464c60db6cfeaa0e47d1b51235fcec0caa9
SSDEEP 192:sxZYR8yMqZjK1Ml8MkK/fcsskdLjaZdPzodpLHW6+WNGYv0ukiOOIgjxJ:sxZY7MK/fcsskdvazELHbGeZj7
TLSH
T1BD62F8066A3499778CDBD209FA457F53D2F81573E2904E44A9FC8E0C04EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 390d4aeacfc5a19d04bd43344e263ce6e647a47b7eda9149b7032793758e18d8
MD5 b8e884de289c70a81117ff72102567d1
SHA1 e05fba008d9d00c7946ee50b3e6dc82ebb92022d
SHA512 faa4d515b04d880291ba4afd15e1e150a03a33dd1333a38d15b593796143d25f20c74b702a9dc68f2b1f7b1362d27295c0bf21bcabf9567d2d204170d8b7e6ce
SSDEEP 192:sxZrR8yMqZjK1Ml8MkK/fcs/dLTZdIzodpDhBPHW6+WNwqx/YvdkiOOIg5ExJ:sxZrVMK/fcs/dvz7dJHbT/aZG7
TLSH
T18762D71AAA345D778CDFD219F6457B53D2F91562D2904E4469FC8F0C04EAAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c6f42ec206fdc6fd63e7451ae9d4ef3992934de266da5a63435aa9745ce0a44b
MD5 66099cce98f5041949f297fefec8d82b
SHA1 37ab13376e561e53e22aba91b6ad0c9fe6b24c5e
SHA512 77ddcfc68a133a718f26d8c22868737a43e4c8e7b259e15e49350dcbb31266f3a505279bfc7e6d05acaaa21598f1e02089349696b84369afe9eb64f6a7a814cf
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrA:0LppY93PBZJPtN53Jpv
TLSH
T192B27B5A713E0211393E2988B39696364F4235A37058E4AF7FB814A54F27E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3664a05e0af45f613c6f5fc49ac9a011e1feb9d9e0badf3d52064929a477c261
MD5 dfcc33dd12b649e3b4906123c3157317
SHA1 37e1a2e8f3defb60dd5f4eba430b92723f7cb666
SHA512 20ad70a1c9401fbe75ede2a5d065a44b5807691859913532c5b91d7cfa525807f114ee4524acf6b3b8753a5eeb7ff2cd2bbfdd3b13a6723608131c8b32cfed13
SSDEEP 384:nziF1tNn/s3n9SjTsNF8TUNTUlI4AQckCr5lhB8pvBftGp+Mgj4Q4LgQRnfOObjc:eF1j+9cUwgXkUBKjGPVQXQBf29M0
TLSH
T11CE2C4F698E78A77D89E4B87A37D2D029AFCC153B5885984B7C81E0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7a1afcb9d770b3ea7e17cf55d599473740fc55198e844ddf309c300c2f63a1f8
MD5 e833a24972c0fedcf4cf878b62189cc1
SHA1 2b563ad63be6a1622d5cfb2ffe2ce8f2fb24868a
SHA512 171311052348457423d46d8c9333c0f4372d49a3faf0bcb47afaea096bd46546cca61c04dc117f3b5a3be90394fba74ecfa1bfa44333e7f13e29a442a2ffa3de
SSDEEP 384:n3iF1tNn/s3n9St3sNF8TUNTUlI4AQckCr5lhE8pvBftGp+Mgj4Q4LzQRnfOObjc:yF1j+9k3UwgXkUEKjGPVQEQBf29M0
TLSH
T1F6D25A36E864CA77ECEB4BD9B74A3A47AEE042A3C5CC5AC8D9D81E4C01D75DC430B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7309c76f2078ebb60a1cbd2012dca2dd380c1d123cdcae67a3ee1b7324ce50a0
MD5 a0e941338f9f9ca0cfeff6563bb20612
SHA1 5273fa3e55cd16ec0505fb7933c9eaf1efd9defb
SHA512 220e34ceb1e9349bf79424709172ee2d84cf9fcbfc562fa71d23355387192c5e5dac6e5b3e5df2d893d9d2ebd37ab97b131aba5ecbc8dfc83f3986c909a2ba2b
SSDEEP 384:np1iF9CcmyWCs3sNp8TUNTUlIm2QckCr9coR5pvBftGp+Mgj4Q4LcQRnfe4KV8pb:p8Fccps3kwgbkU5RnjGPVQXQBfI8p0PU
TLSH
T108C25B36E864CA7BECE64B99B74A3503EEE05263C69C99E4DADC1E4C11D71DC830B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5b2f0d2e3ddff1ac2c42d3694d38035c852ecaf25f8b31e80dff423053d3ba75
MD5 9173b131aa899208d9b413cb01af63bb
SHA1 648ac35d1103a81186c545de80cab2465c7eb182
SHA512 8d1e7072e780d6bf931069c3994d83d19d786e90dcb391267e7f72fae96574e958c7d356e10ff43f368a7920b93bbe61d1622aa5eb81a5eed8c58db8c49c394b
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lNKpvBftGp+Mgj4KXphe4KV8p0PHTt+:pAFccps3iwgbkUzkjGPVKHI8p0PU
TLSH
T1A6B25D36EC64CABBEDE74F89B74A7A03DEE0126785D859D4DAD81D0C00D71DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ab4894f5a73de338ac63332ddd47b093431e2c55058c2bbefbe898749baa1214
MD5 92d60b9424d721c3c972abf2ca806010
SHA1 e657d7f09f2341a323d63b931b583a942019714a
SHA512 825ca8448471ced0799679c2cb3b3d6940b1b1aa33e3f1ff0e50b7b3a2ec7d78ed11e9741d856cea555d98474f814435adbcb00a03666c32a253021bc85f1f36
SSDEEP 384:np5iF9CcmyWCV3sNF8TUNTUlI4/QckCr5vhE8pvBftGp+Mgj4Q4LEQRnfe4KV8pq:pQFccpV3UwgekqEKjGPVQ1QBfI8p0PB
TLSH
T10FC24A36E864CE7BECE74B89B74A3643EEE0526386D899E4DADC1E4C01D71DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce0457081a21bc8d6f3960be5603082ba6fbaab67b351b411292681c332c0c12
MD5 d5baaad4447d5e0c44d7c724dfe4546b
SHA1 6870494683c5da67a8b97161bb449d15c197bd2b
SHA512 ec61437863dd5fc16dd1a655ee5131f1455d26bd78a91ec48e805794b8f7755bf22ed69ef0f92c762b49d668cd3671404f9fa4f9a3f57dc5573d55f257618b8c
TLSH
T165E002419140107DC038073105432B301DE2441149F1434446B0526C1C373043B31BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e6b8b6b7bd5ac6134be5653efca8ca3df8be33395daa0b0a0421946e473050d4
MD5 4180a5f8b5c99b6fcef68a9133724454
SHA1 f19ecfc44ecbe4d687bafb6bc6148d3c91bfc456
SHA512 0658f5f09173f3eec3cd5136dd369699b9d30c99ffb257d810a9810bea07ebb62ab1f855889c2beeed50d05bcb7c474b75608b190f0ee3565cbf999c63086d22
TLSH
T1BFE002419140107DC0140731014326201EE2441045B1434445B052681C272042A31780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59f41a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f41a.TMP
Size 392B
SHA256 833fae44d6d7da964d58ab8d5c94ef3080b87df798b9e92fdaa793de47508479
MD5 9aeb383e89f9f9c43b0b628d252205d1
SHA1 7d8bb653f2bb562dcb71267e0aed0036559dd4bc
SHA512 beedc24e4c58312b3ceb9d6c0dcb1ff1ba1f2224e061e9f3080bc6d2e0d51143709f6286866f57cbf2bc43bfd306d12243bb9388cbe8416a6588ce4c48f6b2eb
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7fb82a76812ca4905a930c536f4c256dc5c0756f28c3a918458783bc2cc11910
MD5 747e46094ee33492acad6324c411f092
SHA1 bcbed884b960f7c036ea6b56af40792c55f353eb
SHA512 454931e2f3a17d737961e7520a0326f5695abf9e8568c0733e0da2d452888b8f1b947db160914934998fabc5d882b8f1c5fb72741c1fd28c08e9f9a41db4b55d
TLSH
T147411858B6FA1148B3B77E569BF6A86D487F79772E0BD45E10010E4F0626E40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3500-196-0x000001F800000000-0x000001F801000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads