hxxps://svn[.]dd-wrt[.]com/changeset/45724

Analysis

user interaction
yes
max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://svn.dd-wrt.com/changeset/45724
Sample260727-ryqevavdnc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296365912251019"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{2E6E22F4-994B-48B2-B4C2-A163F171B154}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4852	2104	msedge.exe	84
PID 2104 wrote to memory of 4816	2104	msedge.exe	85
PID 2104 wrote to memory of 3844	2104	msedge.exe	86
PID 2104 wrote to memory of 4816	2104	msedge.exe	85
PID 2104 wrote to memory of 4816	2104	msedge.exe	85
PID 2104 wrote to memory of 3784	2104	msedge.exe	87
PID 2104 wrote to memory of 3784	2104	msedge.exe	87
PID 2104 wrote to memory of 1972	2104	msedge.exe	89
PID 2104 wrote to memory of 4728	2104	msedge.exe	90
PID 2104 wrote to memory of 1972	2104	msedge.exe	89
PID 2104 wrote to memory of 1972	2104	msedge.exe	89
PID 2104 wrote to memory of 4728	2104	msedge.exe	90
PID 2104 wrote to memory of 4728	2104	msedge.exe	90
PID 2104 wrote to memory of 4992	2104	msedge.exe	91
PID 2104 wrote to memory of 4992	2104	msedge.exe	91
PID 2104 wrote to memory of 4992	2104	msedge.exe	91
PID 2104 wrote to memory of 4800	2104	msedge.exe	92
PID 2104 wrote to memory of 4800	2104	msedge.exe	92
PID 2104 wrote to memory of 4800	2104	msedge.exe	92
PID 2104 wrote to memory of 2420	2104	msedge.exe	98
PID 2104 wrote to memory of 2420	2104	msedge.exe	98
PID 2104 wrote to memory of 1688	2104	msedge.exe	97
PID 2104 wrote to memory of 1688	2104	msedge.exe	97
PID 2104 wrote to memory of 1364	2104	msedge.exe	100
PID 2104 wrote to memory of 4092	2104	msedge.exe	105
PID 2104 wrote to memory of 4732	2104	msedge.exe	106
PID 2104 wrote to memory of 656	2104	msedge.exe	107
PID 2104 wrote to memory of 4972	2104	msedge.exe	108
PID 2104 wrote to memory of 4972	2104	msedge.exe	108
PID 2104 wrote to memory of 1920	2104	msedge.exe	109
PID 2104 wrote to memory of 1920	2104	msedge.exe	109
PID 2104 wrote to memory of 1920	2104	msedge.exe	109
PID 2104 wrote to memory of 2116	2104	msedge.exe	110
PID 2104 wrote to memory of 2116	2104	msedge.exe	110
PID 2104 wrote to memory of 2116	2104	msedge.exe	110
PID 2104 wrote to memory of 3856	2104	msedge.exe	118
PID 2104 wrote to memory of 3856	2104	msedge.exe	118
PID 2104 wrote to memory of 3868	2104	msedge.exe	120
PID 2104 wrote to memory of 3868	2104	msedge.exe	120
PID 2104 wrote to memory of 3868	2104	msedge.exe	120
PID 2104 wrote to memory of 2052	2104	msedge.exe	121
PID 2104 wrote to memory of 2052	2104	msedge.exe	121
PID 2104 wrote to memory of 2052	2104	msedge.exe	121
PID 2104 wrote to memory of 3936	2104	msedge.exe	123
PID 2104 wrote to memory of 3936	2104	msedge.exe	123
PID 2104 wrote to memory of 3936	2104	msedge.exe	123
PID 2104 wrote to memory of 3212	2104	msedge.exe	122
PID 2104 wrote to memory of 3240	2104	msedge.exe	124
PID 2104 wrote to memory of 3212	2104	msedge.exe	122
PID 2104 wrote to memory of 3212	2104	msedge.exe	122
PID 2104 wrote to memory of 3240	2104	msedge.exe	124
PID 2104 wrote to memory of 3240	2104	msedge.exe	124
PID 2104 wrote to memory of 1316	2104	msedge.exe	125
PID 2104 wrote to memory of 1316	2104	msedge.exe	125
PID 2104 wrote to memory of 1316	2104	msedge.exe	125
PID 2104 wrote to memory of 4320	2104	msedge.exe	126
PID 2104 wrote to memory of 4320	2104	msedge.exe	126
PID 2104 wrote to memory of 4320	2104	msedge.exe	126
PID 2104 wrote to memory of 4704	2104	msedge.exe	127
PID 2104 wrote to memory of 452	2104	msedge.exe	128
PID 2104 wrote to memory of 4704	2104	msedge.exe	127
PID 2104 wrote to memory of 4704	2104	msedge.exe	127
PID 2104 wrote to memory of 452	2104	msedge.exe	128
PID 2104 wrote to memory of 452	2104	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://svn.dd-wrt.com/changeset/45724
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc5d49c188,0x7ffc5d49c194,0x7ffc5d49c1a0
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11938794012358040138,16926171901610128065,262144 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15233895984075996424,16451836975919375130,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,8382912250118407121,10969726039028757454,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11920540012605240446,13221354428376234696,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7810675570943482557,17785752392047323314,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,15249829779766242808,8293063572452914391,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,8849034357495481732,14297552104089015096,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,15034681539891963768,6925002148002086500,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,12547689019038054412,10172431144533811146,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,1866895465308268480,3682391645178019546,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,1866895465308268480,3682391645178019546,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3561910022954689815,2821709921267001726,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,17788836773628211786,16653936229474656678,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,13107667989048395763,10824746514672928982,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2872,i,16845880371196138383,87514423405257597,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5136,i,7318051069790356940,1400151424018217928,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6364,i,4280317056810084378,6567705350068063564,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,1334071227934499398,6292566994970492469,524288 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6712,i,6303845051776719470,14430742198315461714,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6476,i,5580776696571080396,14973385261670732515,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5348,i,5746007375719473467,6440151403972895861,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4900,i,11113736885957423607,10292239803441051970,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5372,i,15648802277159940661,10685088757262527055,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6988,i,5491549689638789905,17290137673919764909,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4900,i,16224353397263170826,8980135185089773313,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7028,i,5870380644681814619,12065831882301506420,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7160,i,9401481858326875796,14865203163095631528,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7028,i,8087255556941864458,3557994335631421607,2097152 --field-trial-handle=2200,i,13552068691209997716,2833856338107091836,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9ca605a6404f0eabd3a99b8e2d5b3bff19490c3a93d51029de1deac31eda4fc
MD5 f8acc167aec4831cb06492109a1a56b8
SHA1 18de4773ba3257699bc3cf1d6a8e05dd04ec52da
SHA512 d2a600866de97fd025dd415589bb088882a8cea143794cbabb866a5a995f7331b7e8b76c21682707975b19cd89ac89bd1211e1864674d38593d205c145817c15
TLSH
T179715EB3074E08E2EB631D31ECC10BC5787A91EDFA377E9A2060DB34C92177141E9698
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d08.TMP
Size 3KB
SHA256 35d240b3a1141bb37824a3e3bc870d0dda7e80cf16b07f5aa9c133c242381a33
MD5 cb282d17e0ce5012afea8b806e59e1dd
SHA1 5eab44a63ba5424c516e12346c59f39c6aad71a6
SHA512 90318b6e71329be18bb48c06daf8a5cbf9e2f2f680bab0590cc6f5091d0e5221c2e2f573adfc953a8622ec9fba2469d7da843c59ebd7d5898dcff8a4b84219bb
TLSH
T1E9714CB7074D18E3EB631C32ACC10AC678BA91ECF6377E9A1060CB35C62633105E9659
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9c2750329528886cecf1a4a6618866dee6fe8ed7d6dbfe14b57e64851a11e5a9
MD5 ebcaf3e5da2497fa2815ad0a5b6e6e77
SHA1 9fb0c0d80f11c9c187529198a46fc226ccd0ba87
SHA512 64860e852375a7ec354de901d45836d6e416add8b73eaad1204a42b23736d2e405729a4a3e5c39409b2607b3428503995c3e4795d0c3e0e8396406c6adbee4a7
TLSH
T119417CFBC3E4852DC90156F0AA28AE2BCE1C0A11431D392A89D4BE1F97F24B1E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5c9a332a738c928c194f50aaa1e221476b53523928f32f0e749fa504c3daad80
MD5 9ca2cc572d014af0f04e156c49bd4240
SHA1 74ab3124a1899f7ddece16e7331651a615612906
SHA512 c6d8e9550f08f38759cb3644fff7a8f0a6abdd5ad3e6a906cc9549103cbedfecd1cc6a7db74280c2ba87e41190e55c1c0e93e6984f870935d5da6ec60b86523e
SSDEEP 192:sxZTR0yM/jK1Ml8Mkm/fyXsFoEVcIdpy9HW6+WNs7L/YvqLjA+MIgrJ:sxZTKMm/fUsFoeGHbM//A19
TLSH
T19942D716AB349977CCDBD20DFA45BF53D6F51462A2901E44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 65ee903e50ed044ccfb83dea142e7f92bdb041da831b7c3b0bfced75f4dc2102
MD5 486e7b28a5a845587655f5b95e49e49e
SHA1 3c9e67adab2581d3e55211e292fdf9eafdb1e3f9
SHA512 5ec17430fe517bb42006d746d5b39dc925f647ee1c07a418e231a15b57f1e33ab5c8d56a865bcaf567c72a6e20748d231a38de24fb4302791e6ebd1b452e8ae9
SSDEEP 768:uwseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp9roxy:uwseJ3xWvhfynu1jaVcL88p2c
TLSH
T1D9D2FB2B280CCB7E4F844E6DEC266F966EE801CB67944D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9a5d7d1e78345cd7712accc052789ba1ed38d6e7dbefb3241b1f9638083a93ad
MD5 b49c51ea13b041ad32f665e089adecbc
SHA1 5861d44378fb22741e6148d754f3b1c4a5ea5d24
SHA512 5a8d06c9ec0f10f37cdb449462457ff4eb9776ac6294ac3d4381e75dd6beb44246a65c7074222703256a56babf1a85e75381f0cae0b097df091cd95951546225
TLSH
T1A3A0025513E60055C225467D10C153C57321CD10E942034354A640C4CEA42506907508
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 933a8ff639bd6ec815ab9f1aae3cf31e3631a4145059d870b754a9ec01175d6e
MD5 11c43e715b8cf45dd0b6f01c4842f474
SHA1 ff71e20356054fa11173e738c3658076230d3e8c
SHA512 a2de54a54963e87d9da1837d03d09d6918edba970da9b7e9f7763ba0f2520f8f9ebab5eef98fca74bf1bdd048883bcc0ec775b38882bd9f90fe9f1b1180edf6f
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ee:KYHIhKggkXyVDIdKYMAPyJiI/KXq0c
TLSH
T1C3912706747A13023C3D2898B2E1E5360F4139637469A4EFBF7844958E67E224EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f7b37fbab826b1332dba9d3a3bc7b2834d00a39a6341dd4101cd51e17d384186
MD5 48a90dca444d4a6bf7df5b2881fc46ff
SHA1 ae5d0b36862c7a46c29f95c26f8e053864dfe09e
SHA512 80870450f87422174b123a018a0fd79c438478b1658e098b6a72e61bc1defd4fdd0431b27da17006d8fb2e3648298f28a1e5c8028b50f33d8c4226ce7d915d77
SSDEEP 192:uIm+xasuheOwQxMGsNSUrQSBduqxLlM7eB8QmiU1Btt4MTH7+FdLJxtQ+2f8z1Sx:aZcIhsNSUrLdi7mMdi9d9xW+2kuNN
TLSH
T1E0626D72AC749C3BA9A3F546F48B36031EF4912BE7C45B94E5ED6F0C01D96A8131A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54f16fb66bcf1fa9c49cd6e83dc9b8a865befa00d403b7ebc7045517c5214873
MD5 87b1fd0b6612fae44bfab71e1cae8188
SHA1 26086ffc9f973df8d9e56fc445e9d951023a99b7
SHA512 67143399f89b493d1872966bdc67d333da821c9cad20c011bee963f38dc79fca1ecd8a179051872d37b7ee278c3c0bce14d4c3a707eca73bddb0727df3eafb5a
SSDEEP 192:lONP6vMtPQmiUytmThTH7+FdLJxf8475LU/u:lONP6UtRnTmd9xHNU/u
TLSH
T19202F935AC785C7BAAB3BD4AF48A27171FA4616FA9905B54EAE82F0C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8c494d2ee666be32fa0f94529fd1b742765c416009412454e6d83fa110c57ddf
MD5 7d493c6eca136e79efcd66fc0d3f86e3
SHA1 406ab16276b9951dc1cd975e607df0ee9c565f9b
SHA512 1403e55bde76526e18d9909a27391d4c6ec397f04d87cf471460efa7f30994677e67ef1d8d537b9a27d56a72fedd9196d2150498c96a96e822d3c528f280c80f
SSDEEP 192:ugm+xasuheOwQxMGsNSUaQSBduqxLlM7eB8QmiU1Btt4MTH7+FdLJxtQ+2f8z1Sx:SZcIhsNSUaLdi7mMdi9d9xW+2kuNN
TLSH
T16B626D72AC349C3BA9A3F546F48B36031EF4912BE7C45F94E5ED6F0D01D96A8130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 737544779806d42c7ce1b754c25226addfcf1a204035016becfb7a5b3ed84bdf
MD5 1561f64863eeac8e1b633e9f02285e57
SHA1 04b1d1defc80edd77c7b41081b4542397793979b
SHA512 6aa721f70265bdb1a1cf6a874e9e9233acb02bbb022d1dc78062e9b66715d1d67d406f91cd271c4175471151be97ae76e0b9e3069cf6de50e20398ba908908df
SSDEEP 192:uLm+xasuheOwQxMlLzsNSUaQSBduqxLlM7eB8QmiU1Ebtt4MTH7+FdLJxtQ+2F8I:HZcI2zsNSUaLdi7mMgi9d9xW+2GuNN
TLSH
T187A219F158E75836D9AEA307A77E2E030EBCD127B6845A50B3D85B0CCC9957FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 db211722b9443b5f92dce033c9c58ad2e504f7b8ee7c932440253dd19a33eb24
MD5 94b618bd74d5eca29fbe07c6a37d5ec2
SHA1 7750ef96954020518ce46bd88e13bf090c85946b
SHA512 5b49fc0788cd7bc440ecb73eba2913847e099d5a2fe19610cd4624f4fe98de65af0ab324d25309a2b908ae9d28616c3d5f8df8ad80bf06cd043ca17e719c52bc
SSDEEP 192:lONQ6vMHPQmiUy2m+hTH7+FdLJxtQ+2c80ISq+U/u:lONQ6UHRi+md9xW+2huU/u
TLSH
T19A120B36A8749C6BAE93B546F08B32171EF4926BDEC46B51F6DD2F0C01DE65C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0d642ad2a7f60344aa2e87713165541b657ba2c85bcfa478edf7e18e244b87d4
MD5 cc25585eedecddeb461b8c1197a47da9
SHA1 9af009cf759396b8228b2b37b5a24a19ff2eb14e
SHA512 d5fe7a612d1a07c725e2906ea5b3771e89fe016d961be0947ba2359e5ad3e37e1d9d5909bf62b40e1ee0aa9ba399f7d92b9840d0bc74e76bf968bf614f9a5ae2
TLSH
T19E413D5CA6FE1108B3776F5A9BF7B86E487BBD772E06845D10110D4E0A22B00C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads