hxxp://grimsby[.]dev

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://grimsby.dev
Sample260805-tpphas1brf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3260	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304200594835467"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{BE17DF0C-750B-442F-89E1-B5BCCAEFC4A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3344	2564	msedge.exe	86
PID 2564 wrote to memory of 3260	2564	msedge.exe	87
PID 2564 wrote to memory of 5004	2564	msedge.exe	88
PID 2564 wrote to memory of 3620	2564	msedge.exe	89
PID 2564 wrote to memory of 5004	2564	msedge.exe	88
PID 2564 wrote to memory of 5004	2564	msedge.exe	88
PID 2564 wrote to memory of 3620	2564	msedge.exe	89
PID 2564 wrote to memory of 740	2564	msedge.exe	91
PID 2564 wrote to memory of 1864	2564	msedge.exe	92
PID 2564 wrote to memory of 740	2564	msedge.exe	91
PID 2564 wrote to memory of 740	2564	msedge.exe	91
PID 2564 wrote to memory of 1864	2564	msedge.exe	92
PID 2564 wrote to memory of 1864	2564	msedge.exe	92
PID 2564 wrote to memory of 1900	2564	msedge.exe	93
PID 2564 wrote to memory of 1900	2564	msedge.exe	93
PID 2564 wrote to memory of 1900	2564	msedge.exe	93
PID 2564 wrote to memory of 4528	2564	msedge.exe	94
PID 2564 wrote to memory of 4528	2564	msedge.exe	94
PID 2564 wrote to memory of 4528	2564	msedge.exe	94
PID 2564 wrote to memory of 2100	2564	msedge.exe	96
PID 2564 wrote to memory of 2100	2564	msedge.exe	96
PID 2564 wrote to memory of 2100	2564	msedge.exe	96
PID 2564 wrote to memory of 2648	2564	msedge.exe	98
PID 2564 wrote to memory of 2648	2564	msedge.exe	98
PID 2564 wrote to memory of 2648	2564	msedge.exe	98
PID 2564 wrote to memory of 3232	2564	msedge.exe	99
PID 2564 wrote to memory of 3232	2564	msedge.exe	99
PID 2564 wrote to memory of 2240	2564	msedge.exe	100
PID 2564 wrote to memory of 2240	2564	msedge.exe	100
PID 2564 wrote to memory of 1708	2564	msedge.exe	103
PID 2564 wrote to memory of 2260	2564	msedge.exe	108
PID 2564 wrote to memory of 2260	2564	msedge.exe	108
PID 2564 wrote to memory of 2260	2564	msedge.exe	108
PID 2564 wrote to memory of 2132	2564	msedge.exe	117
PID 2564 wrote to memory of 5020	2564	msedge.exe	118
PID 2564 wrote to memory of 4936	2564	msedge.exe	119
PID 2564 wrote to memory of 4260	2564	msedge.exe	120
PID 2564 wrote to memory of 4260	2564	msedge.exe	120
PID 2564 wrote to memory of 4260	2564	msedge.exe	120
PID 2564 wrote to memory of 4488	2564	msedge.exe	121
PID 2564 wrote to memory of 4488	2564	msedge.exe	121
PID 2564 wrote to memory of 4488	2564	msedge.exe	121
PID 2564 wrote to memory of 4396	2564	msedge.exe	123
PID 2564 wrote to memory of 4396	2564	msedge.exe	123
PID 2564 wrote to memory of 4396	2564	msedge.exe	123
PID 2564 wrote to memory of 3444	2564	msedge.exe	124
PID 2564 wrote to memory of 3444	2564	msedge.exe	124
PID 2564 wrote to memory of 3444	2564	msedge.exe	124
PID 2564 wrote to memory of 3016	2564	msedge.exe	125
PID 2564 wrote to memory of 3016	2564	msedge.exe	125
PID 2564 wrote to memory of 740	2564	msedge.exe	127
PID 2564 wrote to memory of 740	2564	msedge.exe	127
PID 2564 wrote to memory of 740	2564	msedge.exe	127
PID 2564 wrote to memory of 720	2564	msedge.exe	128
PID 2564 wrote to memory of 720	2564	msedge.exe	128
PID 2564 wrote to memory of 720	2564	msedge.exe	128
PID 2564 wrote to memory of 920	2564	msedge.exe	129
PID 2564 wrote to memory of 920	2564	msedge.exe	129
PID 2564 wrote to memory of 920	2564	msedge.exe	129
PID 2564 wrote to memory of 408	2564	msedge.exe	130
PID 2564 wrote to memory of 408	2564	msedge.exe	130
PID 2564 wrote to memory of 4372	2564	msedge.exe	131
PID 2564 wrote to memory of 4372	2564	msedge.exe	131
PID 2564 wrote to memory of 4372	2564	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://grimsby.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffe0732c188,0x7ffe0732c194,0x7ffe0732c1a0
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,5275391812928624452,1201929599436826823,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,15712364165255012321,16968820318631184900,262144 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,7913608127135673761,9051320483338856833,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,6103820123658120979,18418927959871814116,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16239509487297598579,8445655812971481973,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,18441490775451059349,15595459557007173881,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,14749570451382054141,3030688982941696439,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,9950850908029784500,14499315301986744921,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,4809173060326607642,2562377977662952799,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1884751830649265790,14492322103343338717,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7456260209687944559,17145291726821236151,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,4656790421072991345,17975823243158305012,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,4656790421072991345,17975823243158305012,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6220,i,4059885747934045425,8809329527268049901,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14668345655772510825,12651516644666757042,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,12529294404396606273,12415772137979111684,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,11177498686607808254,7907408950908958094,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4528,i,10382836329065954826,16259166479967836676,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6264,i,1706594854415808875,5649576795521717787,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4552,i,6083770221535992280,17936765836496366650,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6172,i,4579039029608327489,10932220045358563168,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15245714843705483166,1916505852045393880,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2092,i,16183085161580181353,13803374122011383731,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6292,i,8167456593069371800,3109038930528001452,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2096,i,4894204937739420150,3600217145562844569,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12011937990583001148,6825345901124678466,524288 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4308,i,8050281946657996624,5187051548118201439,2097152 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2976,i,7271621550609357301,14415048859216660959,262144 --field-trial-handle=1960,i,7534589977427043377,10483450295959714159,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

71a02751-558a-4d81-8509-31cb6a488940.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71a02751-558a-4d81-8509-31cb6a488940.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df9f18884c60571a2340ca0fbe4e09efbce0f741708e5aff109c045a7fb3c355
MD5 88ab52f92140cc7320ccaabb9baada1c
SHA1 88aabf0cfc5fa9e3345136e40a8d4beb2b2b48aa
SHA512 450a717acf12e20a8d761d0104cfd6efd3b68869a9903b029fe2c039c918d9d54e93c17499f99a4a0bdd4f0897fe5a7460f84127b39fae8d3e1d4bf725598ec6
TLSH
T1826109FC136108E1E7684071B0E20640747C3EDAF53F7E8E535048F66616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db67.TMP
Size 3KB
SHA256 ca83a64dceb80266fe9cec0a622055337918e67719e0a0a01a865e214e049358
MD5 6b4f18f2bbccc9d7e4f57cfc51782d76
SHA1 e86c63890c2b58cf65077a25af4ad799639bf29b
SHA512 9be795d40537a66202bbb4c1661fd8b35b9a641059bb00af36f97b79c6a926301b2a7d02d7ec7814d70d51fd237c1e22b7a7bde59cdcc06c4eb20c5dfd45efd3
TLSH
T1956108FC176208E1E3694071B0E20644747C3EEAF53F7E8E535048FA6606F668F4928C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ab72769547e4f279a0b35f764cd75d325657f4d9c2a1420d0c028ef2f059ab41
MD5 0edfcf2020a5f40e8ac03f9c7e564ac3
SHA1 6f79e5c6a30c38b89c8757ccd4f8fd61879c39af
SHA512 cc3cabcc7c2e0f28576e32d70b3dec42ad3a86e944a451658c6b256437f6d5d07361acc3966e7925e2e7582fa3e6e78b1b3c1f22575261188e150463d46e8915
TLSH
T17A117DF3C3D5856E894556F05A24AE2BCE2D0605821C7C2585D4FF2BD3E3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8e3ddee47535bcffee1c1970072c43dc80a00e5252c016aee36117bf2640974d
MD5 5dcb9a6b47cba48736b9fb336320900d
SHA1 4e33378d17aaf0c588b458e8d85a1061a08a0ac1
SHA512 81079ec4da449fc99a358f61ee14e73118c918116917d5a5b2aa2226f85b5c2ca3dc53e5cc1bcaa4ac20a4c7acd31f05637816f60d9a3a7044daa54e011ca7cd
SSDEEP 192:sxZS7RuyM/jK1Ml8MkTG/fDsMBE3sIdpLwDHskO6+WNGY9IKfsKIgrJ:sxZgQMy/fDsMB0aHDDGS9
TLSH
T14742E705BA346977CCDBD209FA55BB53D6F9057292900E44AAFCCA1C01E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e3913701be43ecb37883f3463479bef1d8afcbae9b37f149f01a58e397e31ae
MD5 13214057454863a1f62f8fae97e6a13a
SHA1 6bef1721b3f90c050686a9996a38a87c65ea711e
SHA512 89b7c1fc6c64ff032ceb5bbb18319ca6f35b5db2c97822635586b5b75c50f93221aff7a77b4fb7ac74fd57c77c2c5852c38861e8c3c7399f561300955c637ff2
SSDEEP 192:sxZS7RuyM/jK1Ml8UQckTG/fDs5463sIdp1wLHs06+WNGY9IqesKIg5BJ:sxZgQqny/fDs54+oHGGX5
TLSH
T16B520806AA346977CCDBD20DFA557F53D6F9457292900E44AAFCCA1C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bfdeade6861aaf5a33ae4ab19fe13220fffd192a0edb24a0680c57e3e153c2e7
MD5 0b730b6f0b0b03d3885420074cdc51e8
SHA1 8d5729b9425b8301f3c2b25b78fc3d8a9178b6f3
SHA512 a5cfaec3bddfe53f42006f73b73e657e3288da0111b9bd24080500bd2cc1cc094b032eb3f58271001b45b6af4ff1674eb9fa3cfa2cdef5a9ff14b454e336fce7
SSDEEP 768:rscv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNsroog6Jn:rscv21wWvu+Z+u1jaeFLeRN3ol
TLSH
T117D20A2B280CCB7E4F841E9CED2AAF866ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6dea699c390c0189493357cabdb42ab049f5a6263f4de606afdffd91542f59f8
MD5 1eae62d5e22d920bb4c7ceb7ab9a2951
SHA1 23f97f54cd59943c03e8317d08a718df115f93db
SHA512 8f15810661e252cf960a28ce5997588d65225099ad185e64ffafab3486d600983ae86d8355b7f5d488c98c38b9abbb1686cac7c7fb252ab81180e93e7f0e0f65
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+thOKSc6i60KHqi:mTvdHx
TLSH
T1E6915152307B52813C3F688CA77585272B5230E73418E42BBBA811A55FA7E646DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7e46f762fc1779ed57cbd916866ba6f46c4ddfb61963166c97ad960b591b0688
MD5 9ab5d2926cf836086762b5840a394e07
SHA1 0a640e36e8609f098bd51787b34bbc985a87d7be
SHA512 12e51ffc1f25e2ad3478550884ac0404e30773ed854d84d418a7c7adf6f75c67589cdb64862ed9222de3d6e4a1daa9b91683030f95e274e6e6f4ab6f44e1926d
SSDEEP 384:fZcIhsNo6S+hziNm5e+CMdceCBS+2FtBeRs9JKgqijUMhOGD:3hmB3AklCclFtTjKgqmUMhOGD
TLSH
T181929E71A8385C77AAE6B581F48736134FF89073E7C52F90A1ECAF0D029B9DC231A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 34408b419bdecb016dffe0a5c4d3c6495b63d7db4392c71cfc69513e484a0568
MD5 43047d0fdc067da964695cb3f69a7433
SHA1 bcf47b368c350d534ef02641fed8e76269d74054
SHA512 396961c6293b7b0f60772190d715b4578fcf1d71ff63fbbf13f2b06e2e10ce5ab8dc3767b43fada4845430eea5edce32ee0d103f97c3c47c189313da89ca84e0
SSDEEP 384:NqZcIjzsNo3S+hziNm5e+CMdceCBS+2mtBeRs9JKgqijUMhOGD:mnbB3AklCclmtTjKgqmUMhOGD
TLSH
T12A927C71A8385C77AAE6B581F48736134FF89073E6C52F94A1EDAF0D02DB9DC230A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 033dd760e9965f3cc73b86221e5b73f0c662a0f396ffda61bd7e8ad9c8fd4bb0
MD5 3973fdb57b1a097f568d7cf4f6d9031d
SHA1 8713e5e7d4115d94d3d11878a4f409db7eb46a0a
SHA512 e1bcb2961b42aa3d97382430c04a80271bd8ccb4eba03651c89395b4a16ea6041f59f9b7071e2d80a0ae6cb058e6d8069d67327d31cff8c070c698e658e1cea0
SSDEEP 192:JONU6v+YLNQmiUysHZh+CGy+FdeL9oCXusUfU6:JONU6vz/RZh+CMdceCDaU6
TLSH
T15302D9357D382C6B9FF2AE45F5873A235FA82177EA952F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e4c30987aa4ae3f562fa5adf36b69fb85908fad8b195d2af119bf9258e4ec3a2
MD5 9cffb9fb5ff2ebaba46d929416f7a272
SHA1 a0df0e4d978dd3d9312854eb646fb282c8e77a41
SHA512 65676fe2628c245094e462b5fe33c5c5f7bd2d9f46afb760480d06fba697e97150e4d780634367f0c35ef8f0011d79097272ebeb20a0bb595ce1ca7fb232e6e2
SSDEEP 384:0ZcIhsNo3S+hziNm5e+CMdceCBS+2FtBeRs9JKgqijUMhOGD:yhbB3AklCclFtTjKgqmUMhOGD
TLSH
T187928D71A8395C77AAE6B581F48736134FF89073E7C52F90A1ECAF0D029B9DC231A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e24aa1aa686bd71bd2a8a6a76cff57b7c6b2be40a17788b711e3479f77560ec7
MD5 1a63e2ce40b8505a4b97ffbd4cc0483c
SHA1 79d3bc10db53ca8f1af9fcd18242a3da673d0261
SHA512 d5e27a6b066c01fb92b57ac9c6754d4f1744872b8414de5ddadbf833e2d4395570a5b0b151e67cc98c4fad5771475c52d39e375116b5128689b458e2bd974714
SSDEEP 192:5ONJ6v+YLAQmiUy7H7h+CGy+FdeL9oCd1FS+2fCHPquU6:5ONJ6vzEC7h+CMdceCBS+20tU6
TLSH
T1BB121B35B8345C6B9EE2A545F48336139EE55177EAC63F90D5EC6F0C02EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

143dbc09-96d3-49ab-acc1-13dd90e73354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\143dbc09-96d3-49ab-acc1-13dd90e73354.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd91a582c6dfcceab6cbbcfc661e4af2e14d94969163c41a13300a7a716bafe8
MD5 8085cdfdec1aa2265684afdfa18b9368
SHA1 c5de58fcf1632da9b6db4a2d33bf80298d70affb
SHA512 fa54c5d4cc1b8e7484212d3b0a436e7914da246f0a3b6fd872ac61662494d6fe29c9cbcdea02103283fe2a813401a1ff24ed84301cc0195089919d77343cc5f4
TLSH
T1F6410758B6E91148B3B76F4A9BF7A8AD447EBD761F1A945E10110E4F0A62B00C872737
MD5 SHA1 SHA512 TLSH

Submit Download