hxxps://marketingwithsam[.]co/campaigns/ba55421vrp921/track-url/lr221yewqj10c/007ad46d8719a2886ed873c35d7c2444248cf9ed

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://marketingwithsam.co/campaigns/ba55421vrp921/track-url/lr221yewqj10c/007ad46d8719a2886ed873c35d7c2444248cf9ed
Sample260810-xt58dswcnh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
64	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308625974779151"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{62ACD72A-E158-4D4E-BC1D-2C3E270A1AC4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4308	4692	msedge.exe	85
PID 4692 wrote to memory of 64	4692	msedge.exe	87
PID 4692 wrote to memory of 2204	4692	msedge.exe	88
PID 4692 wrote to memory of 2204	4692	msedge.exe	88
PID 4692 wrote to memory of 2204	4692	msedge.exe	88
PID 4692 wrote to memory of 3340	4692	msedge.exe	89
PID 4692 wrote to memory of 3340	4692	msedge.exe	89
PID 4692 wrote to memory of 4200	4692	msedge.exe	90
PID 4692 wrote to memory of 4228	4692	msedge.exe	91
PID 4692 wrote to memory of 4200	4692	msedge.exe	90
PID 4692 wrote to memory of 4200	4692	msedge.exe	90
PID 4692 wrote to memory of 4228	4692	msedge.exe	91
PID 4692 wrote to memory of 4228	4692	msedge.exe	91
PID 4692 wrote to memory of 2788	4692	msedge.exe	92
PID 4692 wrote to memory of 2788	4692	msedge.exe	92
PID 4692 wrote to memory of 2788	4692	msedge.exe	92
PID 4692 wrote to memory of 2424	4692	msedge.exe	93
PID 4692 wrote to memory of 2424	4692	msedge.exe	93
PID 4692 wrote to memory of 2424	4692	msedge.exe	93
PID 4692 wrote to memory of 4808	4692	msedge.exe	97
PID 4692 wrote to memory of 1220	4692	msedge.exe	98
PID 4692 wrote to memory of 4808	4692	msedge.exe	97
PID 4692 wrote to memory of 1220	4692	msedge.exe	98
PID 4692 wrote to memory of 1632	4692	msedge.exe	100
PID 4692 wrote to memory of 4300	4692	msedge.exe	106
PID 4692 wrote to memory of 4300	4692	msedge.exe	106
PID 4692 wrote to memory of 4300	4692	msedge.exe	106
PID 4692 wrote to memory of 3416	4692	msedge.exe	109
PID 4692 wrote to memory of 3416	4692	msedge.exe	109
PID 4692 wrote to memory of 3416	4692	msedge.exe	109
PID 4692 wrote to memory of 4464	4692	msedge.exe	111
PID 4692 wrote to memory of 1604	4692	msedge.exe	112
PID 4692 wrote to memory of 2156	4692	msedge.exe	113
PID 4692 wrote to memory of 3244	4692	msedge.exe	114
PID 4692 wrote to memory of 3244	4692	msedge.exe	114
PID 4692 wrote to memory of 3244	4692	msedge.exe	114
PID 4692 wrote to memory of 4648	4692	msedge.exe	115
PID 4692 wrote to memory of 4648	4692	msedge.exe	115
PID 4692 wrote to memory of 4468	4692	msedge.exe	117
PID 4692 wrote to memory of 4468	4692	msedge.exe	117
PID 4692 wrote to memory of 2396	4692	msedge.exe	118
PID 4692 wrote to memory of 2396	4692	msedge.exe	118
PID 4692 wrote to memory of 2396	4692	msedge.exe	118
PID 4692 wrote to memory of 448	4692	msedge.exe	120
PID 4692 wrote to memory of 448	4692	msedge.exe	120
PID 4692 wrote to memory of 4080	4692	msedge.exe	121
PID 4692 wrote to memory of 400	4692	msedge.exe	122
PID 4692 wrote to memory of 400	4692	msedge.exe	122
PID 4692 wrote to memory of 400	4692	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://marketingwithsam.co/campaigns/ba55421vrp921/track-url/lr221yewqj10c/007ad46d8719a2886ed873c35d7c2444248cf9ed
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,735714680176989485,5034725159798876153,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,64132768647947614,14591981072711892749,262144 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,3516305103862687061,10828098881646400579,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6606613395087005537,1097148057441613964,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17073323505106269069,8740459394245116859,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,17470297076090366241,13973191896211163973,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13099640149683619320,5996355038442817121,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,3306603488866564337,6238201112457609770,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,5696871050516602960,12094688147845201836,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12003845354346744640,893134979732663746,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12003845354346744640,893134979732663746,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6272,i,12217097043391284376,17327759928995955355,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5916,i,2202312138089427770,17542917843831977170,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=1616 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5141484801111636832,13839269025536247873,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5148306127818593961,3587681264672466942,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,3617819771661379191,18040546956152749741,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6264,i,2105409141483377676,17836320976999953819,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8567089350306742227,8602614793705950620,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18085762483416952057,3628282220958442929,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6476,i,15756526083466643756,16174173524728658794,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6269993267282540869,5765577867703040886,524288 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,12735523618644388157,4354172909251888748,262144 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6188,i,448121135164056729,17622502395555335303,2097152 --field-trial-handle=2276,i,3982395818571583471,1761248010545289610,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7ad7f78c6f81c115ce6f95362bd947e87a2faa4874d7babdfe4354a0599add4b
MD5 6a6270612689ba1ccb0c69a8b83c5721
SHA1 ddb31cbba66bea9dec20e3fea163a0c189330928
SHA512 df27d938dbc7afd89fc624fd3aaef3c205b826d53c523c7a9fbe5e9a99d70dab7e3ad6340400f95570c8e8bac2c615e178332a1a269db50465d3bd5a9c55f07f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1AEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 af813cfb5da1068c5426f50ed3cf57ae5b9db70d2e2368a80127f3356663c983
MD5 98887774cc9e8349a61801f33c611309
SHA1 294997640b6acdf8aa00c630cd22c719eca56606
SHA512 3c4d2f5134782fef761cd26fbded52c6f70d2278a529c67ec2f5e614c29395a84621f6b4cf7ad8b60d1a355cae049b0c4a65b09eed99c47735cb66638902054c
TLSH
T162E0204416ADC7A6ED40A74F907F4396D935F345D74DF4563B47B2DE1A40400CA564B8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a035a92f9bfd63bb54727780b77469ee68d3395d3829142d9fd4246fb9008f5d
MD5 6f5ba33cabad508180440e7a23abf673
SHA1 423f3ccc4dc1a3aeded3f10859955fe026daf5f1
SHA512 64bd2ba83c1bc240a0eca8c09c03c0eeb5e8b8996791e1f42a5bcd3ac693b0a63f4267bb44f451d25a8f9cd81c9b1f2a34f5bbd23b34f606d48faccbec2d1501
TLSH
T10E611AE405068993EF2D8DB0D0B51272B471B7B38AD70FDD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a5a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a5a1.TMP
Size 3KB
SHA256 399d1e558363958398dad1cc81961ac0dc7b00ace66d8ce0c4361a2f19d7369b
MD5 a09e8544ad4dab490469c1c29783ff2b
SHA1 2d948bdeba9b823687fbaf3dcbedb5e8c3fc01ec
SHA512 f2d47d3c67ecde2a2267529e9e60f6e65d8e1474dbbae88efb78a2056e04fb1d01fbfa3511cfa34895bd95b3827a19d8d5507a32a42d9bc233e0ebc48fa010b6
TLSH
T160613BE405028993EF2D8DB0D0B11272B471B7B38AC70FCD01501BBFE69A7264D53718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a016b45e18068ab9e289624efb5667bf734c3dea95df5bd3629164d423e6d5fc
MD5 6045f14391528eade8d3672c4206fc56
SHA1 afe07e20ca641caef578075100fa0fe1600b362a
SHA512 ddb6e17ad47c82015d7610a4124416a498b7010fd0b3b7e543c2a31626f91d85a5da4413e7a460fde1e6efb8b03aa60c9c163bee5d34c7194d07cd3869d9b211
TLSH
T1E421ACF3C3E9866EC95156F06A28AF2BDE1D0905436C3C19C9D8EF1B93E2075D102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2f06a37df95618ec3a5127283157b80d2441cb3ea27917623285c5c9c3e77cc4
MD5 9d37d6f2d42a9e3311d16051edca2d1c
SHA1 26f6fee5831ebc6e044d1358ab32130447ddb5d5
SHA512 ebc83a1db765ce966abef6e73c8a3936d39dec5ba8fa8a2701ee70ca52e5be6585e48682c6a4ad4429acbd28ac4ec0965743b96f712a8638fdbc8438a5bab514
SSDEEP 192:sxZdRTVyM/jK1Ml8MkL/fis4XN6IdpJHW6+WNGYLleb+PIgrJ:sxZdhvML/fis4XNTJHbGP69
TLSH
T1C742F911AB38A977CCDBD209B945BF53D6F90473A2501D88A9FCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8c52bbefa79eb9e44f5ff6b2a63dfaaf5a46f8026b3a5b9535eed2efb314e091
MD5 f357d4c6191b13806a1b1d86cec8a078
SHA1 6a715e51f03d15a4d7f5f840a7d662a0f7816ad6
SHA512 83085a361f44016b730f8033420b660d77dd2d9a3b66dce8c082d061998decc1652412323ee80bb4990942f0a5318c4d0aec79d8d5abaf0282aede2cf64bc435
SSDEEP 192:sxZdRTVyM/jK1Ml8UQlkL/fisBX6bIdpCwHW6+WNGYLalS+PIg52J:sxZdhvquL/fisBX6EXHbGS6c
TLSH
T12F52E915AA389977CCDBD20DB545BF53D6F90473A2501D88A9FCDA1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5a73e57a0d041ed3c945fb58334c5d7511b777b416992628ad9a684cfd111a86
MD5 c36a8d8a106ee225e1648209ff4d3fdc
SHA1 aa651de3b65a8ab0f983431778c45a8039dfec9a
SHA512 cb28b369ef683e608057dd1613a92386f911c3721bd9a9cc00e6946a257a99ad33108fb53d9905c047e9496e288315ca6d624cd336ced8c798ff8cd64710ed7d
SSDEEP 768:mQs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNBroQK:mQs6pD1WvxzWju1jahILIsN6QK
TLSH
T19CD2EA3B680CCB7E4F841E5CAC2A6E967DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c7504c8f435f5d10a619de4a9b1df408dd91682028295e2f7e25f37c39f32532
MD5 a6fd86d7c2f1cd71311ebae55f72a63b
SHA1 8bfb2f0647d49885e9925feecd41d87a062d1cac
SHA512 a43ae54026f24ea73f9e89eaadccbd941603f1ecea8607bde84c392aaccaad1b82420dfea782871469adb4c230e8236e7f2c52813a45e4652f9b24898a5bb581
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZiO/:iihRJ67g86wQvcpgE24zaBiqREQSnx
TLSH
T122D1F61672BA13023C7E2A4C83D497678AC272637414A42B3BAD04B6CD57E21CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a9c99ff-e365-42ad-8a8b-b608ade80e1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0a9c99ff-e365-42ad-8a8b-b608ade80e1f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1eccd4aec77d59f893fcad84ad11001feccd913504b5f784950eb839db5be637
MD5 0906494a8e887d15902b1221560441ee
SHA1 63c995dd8f2edb2c404c58c66cbbf38132657a6b
SHA512 ac87d0b7649ba600b2ab83aa181c5d668117a7863e786107425c4ed7a61d33e72886fa70fee7893acb9476a8ed46f216fb1021dc78f8f1e96f6f8f3cfb6d32c3
SSDEEP 384:bZcIhsNOU+Z0TaNa9xO7glzJr5Kz6HlytEDq1W:DhFwDO7g9h5Kzoy6Dqs
TLSH
T166927E7158785D3769F7A145F88B36138EF84027EAD92ED4D1FDBF1C01DB6A8130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 83420c667917476e3f08ec32e9ed612138ea79fe26ef28c6c2d324105f76014c
MD5 1d4006d2fe02feb4cd0866f34d9ef4f1
SHA1 31823df6e9e000d273f0b2c945026be2c48aeb0f
SHA512 82f3e71ce696e2e1caf0150fe76e2f133e34e5f8b297e9e14aa74c0fec27fc49a65caff90eb1de5422726e71c35cd3fe9576eef3bc6dd4f380ac25c020e30d38
SSDEEP 384:xZcIhsNOUPZ0TaNa9xO7glzJr5Kz6HlytEDq1W:ZhKwDO7g9h5Kzoy6Dqs
TLSH
T14D927E7154786D3369F7A145F98B36138EF84027EAD92ED4D1FDBF1C01DB6A8130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 48ef73f30458401d09fc7251ff780e3eac351e42f486026080f94add1064a249
MD5 df06a6954845203eb943e6cd1c4d717c
SHA1 1c2f204c659fcf9132edc68f6663ca953e9e2a55
SHA512 aa4e1d49c0f1edd618ca1b20fa8c69ff163a01b8794c3e2b7c398dc2742f3f2c0fdabc230497ba4b4b360e4a2fc1d823928377fe72ba7b1797dd427249d8ab51
SSDEEP 384:ziFiZcIbzsNT8TUNTUlIlPZ0TaNa9xO7glzJroKz6HlytEDq1W:eFQPqwgnwDO7g9hoKzoy6Dqs
TLSH
T176A27D3258A89D37BDFB9645F94A3213CEF84067D9D56AD4E2EDAE1C00DB1E8130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a4ca6dddba9663654d0c7e43b82be4e624505a4b9dec8568ff3bed3f75cff47
MD5 db9f9c17cbfd8c33a6bb75737497f7c2
SHA1 2a7f7834fcb2b5b9e698eb8eab6d2e3cabf4adf9
SHA512 766b553129fa9ef7ecfc5a6f8829f8efa8843b97c39a4b7638caa37821a252f509b032eff0fded42082bbab8b98bcfeaf45108d37d8e550cafc4c4855b20272d
SSDEEP 192:qONx6O7+3hQmiUyLKGttb0gO2VoIgGlmU6:qONx611Gt9xO7+kU6
TLSH
T13F02D6356D686CB75EF2AE45F98B37239FA8103BE9922F40D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 feca7b8b1287cc97eb8946df50f65f6c79e2f159624e3f4fd39334fbc7f2afe9
MD5 de8e2849511100dddbf19d5daf96c23f
SHA1 d52568db9d4a0be8c76158dc1412cf4fc6d339d6
SHA512 95c2384c072caf693113a5582e2c742afb751d2c9b1fd76d121857af6850b97caedd9bd0eaa1d85011d0ab996ed99e45aca566deb02c38fc929b74899294c6c9
SSDEEP 192:PONc6O7+3LQmiUyBKPttb0gO2VogHF0SJrNDcNNqM2zU6:PONc6rlPt9xO7glzJrSKzU6
TLSH
T15E120C35B868AC775DF2A145F98B35578EA9013BEA467F84D1EC2E0C01EF6AC2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 927dc01bdecfd34c94223d2514d84f0a412fa919a804f897d3a7d54aacc0a7b3
MD5 c912778b089a62e275641154de534d57
SHA1 cc25885792c203492e7f83909e40f041d68ae107
SHA512 797d5508befcfc1b834508b4984e7539677d34c6886ec883adc3215db2677dfc6442084dc4deb641e2424792dccd6d12e56729bdfbf022c2a1470f13ac61dcc3
TLSH
T151413A98AAF90154F3B77E56ABF3A86D487BBD772E0AD46D00110E4F0627A40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download