hxxp://cursor-cdn[.]com/openvsx_v0/production/e431744b0175df92e850fdbc7fc44dbb51584270ad4e9cdfa0fea5a62eb7aade

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cursor-cdn.com/openvsx_v0/production/e431744b0175df92e850fdbc7fc44dbb51584270ad4e9cdfa0fea5a62eb7aade
Sample260805-hkshlsfb67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303861112546216"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{3EB1DD24-FE49-4C0F-8F84-EF3BF5CC48DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1104	2936	msedge.exe	87
PID 2936 wrote to memory of 1436	2936	msedge.exe	88
PID 2936 wrote to memory of 400	2936	msedge.exe	89
PID 2936 wrote to memory of 400	2936	msedge.exe	89
PID 2936 wrote to memory of 400	2936	msedge.exe	89
PID 2936 wrote to memory of 4176	2936	msedge.exe	90
PID 2936 wrote to memory of 4176	2936	msedge.exe	90
PID 2936 wrote to memory of 3172	2936	msedge.exe	91
PID 2936 wrote to memory of 3172	2936	msedge.exe	91
PID 2936 wrote to memory of 3172	2936	msedge.exe	91
PID 2936 wrote to memory of 3192	2936	msedge.exe	92
PID 2936 wrote to memory of 3192	2936	msedge.exe	92
PID 2936 wrote to memory of 3192	2936	msedge.exe	92
PID 2936 wrote to memory of 4496	2936	msedge.exe	94
PID 2936 wrote to memory of 4496	2936	msedge.exe	94
PID 2936 wrote to memory of 4496	2936	msedge.exe	94
PID 2936 wrote to memory of 212	2936	msedge.exe	95
PID 2936 wrote to memory of 212	2936	msedge.exe	95
PID 2936 wrote to memory of 212	2936	msedge.exe	95
PID 2936 wrote to memory of 1080	2936	msedge.exe	97
PID 2936 wrote to memory of 1080	2936	msedge.exe	97
PID 2936 wrote to memory of 3912	2936	msedge.exe	98
PID 2936 wrote to memory of 3912	2936	msedge.exe	98
PID 2936 wrote to memory of 3036	2936	msedge.exe	99
PID 2936 wrote to memory of 3864	2936	msedge.exe	100
PID 2936 wrote to memory of 3036	2936	msedge.exe	99
PID 2936 wrote to memory of 3864	2936	msedge.exe	100
PID 2936 wrote to memory of 3864	2936	msedge.exe	100
PID 2936 wrote to memory of 4548	2936	msedge.exe	103
PID 2936 wrote to memory of 5032	2936	msedge.exe	105
PID 2936 wrote to memory of 3080	2936	msedge.exe	113
PID 2936 wrote to memory of 4164	2936	msedge.exe	114
PID 2936 wrote to memory of 2592	2936	msedge.exe	115
PID 2684 wrote to memory of 4728	2684	OpenWith.exe	122
PID 2936 wrote to memory of 4592	2936	msedge.exe	123
PID 2936 wrote to memory of 4592	2936	msedge.exe	123
PID 2936 wrote to memory of 1788	2936	msedge.exe	124
PID 2936 wrote to memory of 1788	2936	msedge.exe	124
PID 2936 wrote to memory of 1788	2936	msedge.exe	124
PID 2936 wrote to memory of 1460	2936	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cursor-cdn.com/openvsx_v0/production/e431744b0175df92e850fdbc7fc44dbb51584270ad4e9cdfa0fea5a62eb7aade
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,13424585853892640208,1909221883414382756,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9389867839945302810,3633023155716613755,262144 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,11264871352730563454,5440364010973423142,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,3930468415238264739,5410845650048052725,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15901850858110692472,17019194974854980623,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,7170855892075748691,15738858845025076017,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9189975100915740860,18225340575917211825,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,4560845615167647556,7546149610702853348,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,15504050325149941319,7172802871301340298,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,7642302184573493730,2228043452564679486,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5616,i,772178888143098800,2305282986875568244,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10841384308113849454,12400100837585420025,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10841384308113849454,12400100837585420025,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,13579826964593031962,4941634198604761810,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,13407770260398190274,12419152004307725663,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,3028523134054983102,15827274486499290747,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,3716928558780285489,14681181780223698562,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3691616591284068139,3411895899603739442,524288 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6920,i,1918764562292141143,10294709681663656928,2097152 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,13512113393119798574,5261460333995131042,262144 --field-trial-handle=2848,i,16052370295218690163,9500180237064943445,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\e431744b0175df92e850fdbc7fc44dbb51584270ad4e9cdfa0fea5a62eb7aade
  2⤵
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0cbd9cabc622b13c9556311f9c94716b3a1affd854a7a7bb27769fa5b2c06607
MD5 ec9864ecc93431f83f9451c6fff346bd
SHA1 fcfcadfd3d7e67d85de4656e6720dc32c4acd8f3
SHA512 ddb8afa52568ccc3ae477893b8255f91223479cfd395d840f3a60066e2279832fb98ff86e9368f05a1ccd7a794b26917fc96edbc6244e646469f842cdfa2c889
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T1E9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e73b5b8ff150cddccc5321ce2e2a90203c82c7de2db6d34d9192c7d7f9bd7626
MD5 b276ff75dc8bad3bc389333703f60c9e
SHA1 d684a06ed3f9d0737709bca99f3dce56f08fbcec
SHA512 46d2a50bf93fc66c06b6b68cfc2844ca816ed170e42e1ecfc584c40e2bdbc06cdb97f1ff2fda7aecfec876d210a847eab5ae74b5fddedf325ab3b92ec606dc79
TLSH
T1C3618E773D3505A2E3AF067094E12AD23035F4DBFB5B2E4E2288B9F51524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d37.TMP
Size 3KB
SHA256 ebcbd7672da96f2273c0f564ff38e3f6685ded8dc765dc0dc2661e6d8735f328
MD5 36bf43a295fc86fac1e25b9e96df1384
SHA1 b85c491b943c3f5a7cd0a4f37f8ccb84beebf8ce
SHA512 deda787fb9d2892ce15451b492f50dc9a1bd35c0d73aa6c3e81e5fda04ce673af2098140ed52ca2a9e302c8cef64e442a87a4466f7a765ed7c51d1709b70b612
TLSH
T1326180773D3505A2E3AF067094F12AD23035F4DBFA4B2E4E1588B9F51525FE0CE5A818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7d214ff11e70279caa8f22ea3ba238d1d5321459fa68e393bc2f871f7e2eec96
MD5 61719a32516f52993cf5193f3cd6efbd
SHA1 11d20bdbc644fb316e3db1f064c57107c41587dd
SHA512 98fba31a8f606bb2533c413c06f3b73e1fa84e0bd3c654752ea6cb82ee973c854f556964430a2807ce17103d657ab68afb5c67f124ca7c07209b26e779ba91ca
TLSH
T10B219CF3C3D5966EC91116F06B14AE1BCE2D061942287C2AC9D4EF6B93F2472E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eda74196a8ec07dcd374490d8f430146147db04af0140bb7147e129b2611e003
MD5 8613a087a6844b9ec568db20f98a7c6a
SHA1 1356acae16013269e6aa0bae2dcfbf491708a554
SHA512 21cae884c76a072d766817f043ed594e5b5a8e3af84abec49ebc8d0dceb37fab20cb409cf0dc23072371fdd76b611e4858d09361039e33b626953554be189e10
TLSH
T16A418FE6C6E4C65ED91112F06B146E1BDD2D162843683C2BC9D6EF5BA3F24B2E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e9156db3b011ec9be3afe962c5ab3665574279a40e60ab1cbe193b544436b133
MD5 fe296300b32bf1c581e3d310b59df0f0
SHA1 42f0281ec23398daf5e80cc8783089b170d7e27c
SHA512 ebee03b2a2431050cf301a4074bc573b1af71ad4b0efa82984c24381872f4419e3b0adf51e44c028e5987cd5d9daaf701041c3c067a42c4d01abdc59cba77dad
SSDEEP 192:sxZEReyM/jK1Ml8M9e/fgsR5GAEdpJHW6+WNGY9IoErYIgrJ:sxZEo1e/fgsR5eJHbGG9
TLSH
T13C42E8126B346977CCDBD20DFA55BF53D6F9147392940E58A9FC8A1C00E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 347d470df660890a855daeb0123ecaa1e5ea52c3513980f9c158a9cb632f0f66
MD5 82decb3aa7937fe45b1d6f16268528fe
SHA1 e68e14db485ef1badbc3d29767f0c406ada48b5e
SHA512 defb7ebe08a56297aed4c01b87ba7ff8c89a25c8995b7f40921ecb7ef54b45b8c93b230e5fe36395aee2c6729ac1f89fd65fa294b7cd3cc6a137cd7c10aa055c
SSDEEP 192:sxZEReyM/jK1Ml8M9e/fgsJpeAIdp6dHW6+WNH8UZY9IT/rYIg5aJ:sxZEo1e/fgsJpuyHbLZ0M
TLSH
T16A52D812AA346977CCDBD20DBA45BF53D6F5547292900E58AAFCCA1C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6da6435dceb3955b247c93c0a393dce205ffed30c0d384353fe664237d74e6fd
MD5 2e804ec11a5e7b571425f1a3e0eda7a3
SHA1 b5ad75846b5cd30780d4971c49400e63fae25803
SHA512 153efa243523a120b3db5c10d9f95ebd35ed517d4edb92479f7f7b4a33c77619c014d6782be7ea24c2c8faf503f3d68556ac6c5a5bcefe3aed5fa26119afb0f4
SSDEEP 192:sxZEReyM/jK1Ml8UQv9e/fgsJpeAIdp6dHW6+WNH8UZY9IT/rYIg5aJ:sxZEoqle/fgsJpuyHbLZ0M
TLSH
T1AD52D812AA346977CCDBD20DBA45BF53D6F5547292900E58AAFCCA1C01E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d55bf43f70886f9c68c474d674cc5dad46c4136c600c1c626f8675018e6a5656
MD5 19877c6a3b2b0895404ffb5e1d065d57
SHA1 0eb479e1bffd34bb9d11816a79232b6f8dd01ff5
SHA512 7fff94ea24ae3fbb1f87d7fd3325a40d7befd11d2ecb8fb6ed0e9facdb1193fccd6a448fc7bd8c89e01771a38809805411a210f45e3bb6a25d5e3d05660950d9
SSDEEP 768:6Pcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNBroAg61:6Pcv21wWvu+Z+u1jaeFLeRN6AF
TLSH
T179D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 21322b74151d993b36f505b239a330ccf6cee3a2834237df974f237743c141b5
MD5 fdc84f04fb29c6aaf2993464a7afa810
SHA1 2c8662fb76b0d568cd2517a477250e35fa59f7e3
SHA512 b4bed1aeec633c5de295bd66890376fac7fd7e9b4811a6f406d1207041ff955730bd385b5323d6b160abf6358e047842a0ac04489ac846a93a3975688fce5293
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiYJpCKKUCg:mT5RXfdXtg
TLSH
T19FD1F005317F0302387E291DA6A185678E8172A33814E9BF7B7805A68FA7E215DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 691a8774ae062ebe2704be7bd64c508a4c60f89783233461a500165a665dede4
MD5 6a953e0d9994df09ab4ec81060990296
SHA1 731cdc51588917105872962ed6951df663a8a147
SHA512 8e255a23c25c5c91076e6d42d7069d3102f1940346e4a72b17bcd3671167a2b85a141375d2af7ee433bd91dcdb1496e6baca672fa47c432c4d49cf78ea574ab6
SSDEEP 192:NLsNrmQgGEg+YLeNfQmiU1aXZAy4e+CGx+Fdew9oh9aFS+2Z2JitqJ3nw:xsNrmHGFzifCA9e+C/dHeWS+2dU3w
TLSH
T1A7422A36AC785C365EF2A546F54B35039FB891679AC93F94D5EC6F0C02DF2E8230681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 85e17824584a06dfbea24339b07d6f08103157c1582d10ca60ca6d30bc9b9f65
MD5 532b27b2d5c81df4d500e5ab3cf06c20
SHA1 6ee41da0e943fa3d3cfe3754b0baad2a0f9046ee
SHA512 b2391340a7e6c9ac60200a7fd3754b5824a7218a20500b58c636db2f6b8e5a912df107a3d66cd88e92e2ba463b84203782dacde6c2adc1441136dd4bd5cc9eec
SSDEEP 384:IZcIvJsNrrHGFziNMA9e+C/dHeWS+2IUBeRs9JKgqijUihOGfI:2xnV/AcHkJlIUTjKgqmUihOGfI
TLSH
T158928D315C786C3699F7B542F48B36074FF89063E6D52F9591ECAF0D029BAD8130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5d769ad52dac656b692f2b23348327f3636bd0ee05c39076de7483c53a1d652b
MD5 187506390fe04a672ddd8c114a9de9b4
SHA1 3131d2d2912ecb978822e65b26328a9defc77847
SHA512 591906ca5b8552cd52c7f47afcc0e9c2821560b65c7319d42b2f3fdf9a2bcf55a3b1e44bfdca68c9d971821fc141874d276bcea03b20e200a40be749b8d8e2f0
SSDEEP 384:aZcIhsNrmHGFzifqA9e+C/dHeWS+25UBeRs9JKgqijUihOGfI:YhkVvAcHkJl5UTjKgqmUihOGfI
TLSH
T1DB928D315C781C7A9EF6B542F48B3A074FF89073E6D53F9491ECAF0D029A5E8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c34f7f3bd22586bc1e9d96e1ba6bc8661ada9becf8c3e8c2e8f5b0684577bee4
MD5 ed8dede42ee670557454b04489e830de
SHA1 441ed3875d32abe62eee6de0480be39e4c18446a
SHA512 42e7ff4f3217115504cb38531088d20e07ba49d48967bbb4b54687c96a03f9f32a9095d249acd6ebf618ad6445a594861a4d53335c21cf2a0437781dd53f102e
SSDEEP 192:JONv6v+YLNQmiUysRZh+CGx+Fdew9ohXuslfU6:JONv6vz//Zh+C/dHe51U6
TLSH
T17802FA35AC382C7B9FF2AE45F4873A175FA82177E9962F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 06dbf4daa8b6383a07801422afbd2389f50c200af990ca755ccfe7006b60dce1
MD5 ccdad8391644798fef7dcf569115ef0d
SHA1 f2dfdc99e34d271297b05a4a2fe80353ec8f06cc
SHA512 9f3ac34c40acf670dcb29044bf2cb7c60de41b6416b998c90820929c35d55c2d2bbc6094a6035b82b18d2f087d48387201df6759a77da48b59af841867a6a2f8
SSDEEP 384:nZcIhsNrnHGFzifqA9e+C/dHeWS+25UBeRs9JKgqijUihOGfI:PhbVvAcHkJl5UTjKgqmUihOGfI
TLSH
T1A7928D315C781C7A9EF6B542F48B36074FF89073E6D52F9491ECAF0D029A9E8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 50f6ac3992121e69f5503d585708e31f1678500580e08f4339dcb326277802a8
MD5 ce9f1b614f430c4e1ce98bd1f081c379
SHA1 a91fde49412ae71bcc336ca3ecde8ffb080b3157
SHA512 42fee76b0f2a7e34860343e5bbc172e0814624aa962cea73bb7d2c0be9f687c7e29a688091cea58bdc405332825eabe4ba5292af2747cc5c3561f4aa480929ad
SSDEEP 384:lZcIzsNrrHGFziL4qA9e+C/dHeWS+25UBeRs9JKgqijUihOGfI:dznV0AcHkJl5UTjKgqmUihOGfI
TLSH
T17D928D315C785C369EF7B542F48B36074FF89073E6D52F9491ECAF0D029A6D8130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5907086c55a27fead0dba32039061099d2172dd0c8a0de752d64860d3de58213
MD5 33ca0f1d26fc5fc024bfb5eab6f725fe
SHA1 45112f7ab70d1f841262633f69bbcb959508500e
SHA512 e8cd7e1af030c190131a39f3bce7c95443ce9f4b9d4ecf0439b3d546a0bbf7d0902b382c40c8269454e98b236522c3a2d1a91d61a9209345b65dfc9b63b6d3d9
SSDEEP 192:KONG6v+YLTQmiUyuhReh+CGx+Fdew9oh9aFS+2ZmCHtqJU6:KONG6vzBJeh+C/dHeWS+2BUU6
TLSH
T181122B35AC781C2B5EE2A545F48735135FB95167EA8A3F80D5EC2F1C02EF6AC2346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0957c65b-d79d-4cd8-bc85-c75dff52faf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0957c65b-d79d-4cd8-bc85-c75dff52faf8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa88a6bddab65f123a6418535bd2e3590d390dfe15440b7b74ce071513ea25f3
MD5 6976dc3953a32207a11d0c7d121a592e
SHA1 2bf78ca43ece5a70fee63aee1fa0a9d6e4762a3c
SHA512 21625caf4f5c2f5cc15dc6174529f0424b72e9a63351f3891311fc054670eb7901278bc73382ab6b1e96d5b6be15b4066b7ea8b7e28ca9231effe343398a47f4
TLSH
T13241285CAAED1148B3B77E569BFAA86E447FB9772F07D05E00010D4F0626B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download