hxxps://wetransfer[.]com/downloads/6f523fca85de3deea024f73f118293de20260821073904/89c01242c46af9a5095d521830e68f7720260821073944/ba5c20

Analysis

user interaction
yes
max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/6f523fca85de3deea024f73f118293de20260821073904/89c01242c46af9a5095d521830e68f7720260821073944/ba5c20
Sample260821-ph47ystycx

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
418	2472	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2472	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317884656875103"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{13E8EA57-2395-4333-93A7-DFA669015305}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3356	3472	msedge.exe	86
PID 3472 wrote to memory of 2472	3472	msedge.exe	87
PID 3472 wrote to memory of 2204	3472	msedge.exe	88
PID 3472 wrote to memory of 2204	3472	msedge.exe	88
PID 3472 wrote to memory of 2204	3472	msedge.exe	88
PID 3472 wrote to memory of 2264	3472	msedge.exe	90
PID 3472 wrote to memory of 2264	3472	msedge.exe	90
PID 3472 wrote to memory of 1980	3472	msedge.exe	91
PID 3472 wrote to memory of 5092	3472	msedge.exe	92
PID 3472 wrote to memory of 1980	3472	msedge.exe	91
PID 3472 wrote to memory of 1980	3472	msedge.exe	91
PID 3472 wrote to memory of 5092	3472	msedge.exe	92
PID 3472 wrote to memory of 5092	3472	msedge.exe	92
PID 3472 wrote to memory of 2240	3472	msedge.exe	93
PID 3472 wrote to memory of 2240	3472	msedge.exe	93
PID 3472 wrote to memory of 2240	3472	msedge.exe	93
PID 3472 wrote to memory of 1784	3472	msedge.exe	94
PID 3472 wrote to memory of 1784	3472	msedge.exe	94
PID 3472 wrote to memory of 1784	3472	msedge.exe	94
PID 3472 wrote to memory of 2840	3472	msedge.exe	97
PID 3472 wrote to memory of 2840	3472	msedge.exe	97
PID 3472 wrote to memory of 2840	3472	msedge.exe	97
PID 3472 wrote to memory of 4808	3472	msedge.exe	99
PID 3472 wrote to memory of 4332	3472	msedge.exe	100
PID 3472 wrote to memory of 4808	3472	msedge.exe	99
PID 3472 wrote to memory of 4332	3472	msedge.exe	100
PID 3472 wrote to memory of 1508	3472	msedge.exe	102
PID 3472 wrote to memory of 2112	3472	msedge.exe	103
PID 3472 wrote to memory of 2112	3472	msedge.exe	103
PID 3472 wrote to memory of 2112	3472	msedge.exe	103
PID 3472 wrote to memory of 1520	3472	msedge.exe	104
PID 3472 wrote to memory of 1520	3472	msedge.exe	104
PID 3472 wrote to memory of 1520	3472	msedge.exe	104
PID 3472 wrote to memory of 5076	3472	msedge.exe	105
PID 3472 wrote to memory of 5076	3472	msedge.exe	105
PID 3472 wrote to memory of 5076	3472	msedge.exe	105
PID 3472 wrote to memory of 4636	3472	msedge.exe	106
PID 3472 wrote to memory of 4636	3472	msedge.exe	106
PID 3472 wrote to memory of 4636	3472	msedge.exe	106
PID 3472 wrote to memory of 3516	3472	msedge.exe	107
PID 3472 wrote to memory of 3516	3472	msedge.exe	107
PID 3472 wrote to memory of 3516	3472	msedge.exe	107
PID 3472 wrote to memory of 4728	3472	msedge.exe	108
PID 3472 wrote to memory of 4728	3472	msedge.exe	108
PID 3472 wrote to memory of 4728	3472	msedge.exe	108
PID 3472 wrote to memory of 2172	3472	msedge.exe	109
PID 3472 wrote to memory of 2172	3472	msedge.exe	109
PID 3472 wrote to memory of 2172	3472	msedge.exe	109
PID 3472 wrote to memory of 5080	3472	msedge.exe	110
PID 3472 wrote to memory of 5080	3472	msedge.exe	110
PID 3472 wrote to memory of 5080	3472	msedge.exe	110
PID 3472 wrote to memory of 4940	3472	msedge.exe	112
PID 3472 wrote to memory of 4940	3472	msedge.exe	112
PID 3472 wrote to memory of 4940	3472	msedge.exe	112
PID 3472 wrote to memory of 4488	3472	msedge.exe	113
PID 3472 wrote to memory of 4488	3472	msedge.exe	113
PID 3472 wrote to memory of 4488	3472	msedge.exe	113
PID 3472 wrote to memory of 4444	3472	msedge.exe	114
PID 3472 wrote to memory of 4444	3472	msedge.exe	114
PID 3472 wrote to memory of 4444	3472	msedge.exe	114
PID 3472 wrote to memory of 744	3472	msedge.exe	115
PID 3472 wrote to memory of 744	3472	msedge.exe	115
PID 3472 wrote to memory of 744	3472	msedge.exe	115
PID 3472 wrote to memory of 4676	3472	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/6f523fca85de3deea024f73f118293de20260821073904/89c01242c46af9a5095d521830e68f7720260821073944/ba5c20
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe6e63c188,0x7ffe6e63c194,0x7ffe6e63c1a0
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4755110904408365374,12422685382901096205,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17832350461268185896,3942171859507425389,262144 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,9301274083371644505,14891350852305002971,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4446087710729005867,17136982296211594640,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10923048920150635652,8022517820601893155,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5485868047355434279,1883244165374383699,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4305303717689775739,8802352493387737044,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4968,i,14898770231659817946,14505310065017920361,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,11901443050644202180,356834857222615213,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6394128621042897121,3422359931945989538,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9736488905920169067,13659433347742302677,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,9736488905920169067,13659433347742302677,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6068,i,8410975501577471040,856984232420772151,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6228,i,4626551600390701683,16757554552725532946,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6588,i,7064992305460114325,11989299845449903561,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4524,i,4328679252753591602,10651036464216582834,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3876,i,1584137788692609890,12256218067407207539,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5200,i,9672504357420471422,10648582105091531407,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6920,i,13156701286049647999,13557765027622106171,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6940,i,4229301988262933587,10536524558632913692,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6912,i,10353869722052150338,2429297677736939565,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6200,i,3623076349065328184,15358081394887464489,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6764,i,16792538266658598421,6424860864991447328,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6580,i,8683131399327912279,18340160868321231474,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10600149501774417543,2476891884244196327,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,796116158321660693,1517968012182677476,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4399293614420970654,4143591015350593384,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,6402444421406347520,16507149069180405204,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6660,i,10119821271458891928,12458342307108327218,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16235314107882785851,6130150337412916664,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,11177332811909366976,2347545566679614670,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12538664799897506496,887674913597743827,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5908,i,9874507211179480553,9502170372807743375,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6840,i,10507912421910393815,15757418655553010736,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4548,i,5826323304274035155,6094177228037624061,2097152 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,10324337313987707444,12925999190935478995,524288 --field-trial-handle=2272,i,7706874803561640536,16773572435937106412,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Endress+Hauser_SICK\Endress+Hauser_SICK\README-Auslieferung.txt
1⤵
PID:3972

C:\Users\Admin\Downloads\Endress+Hauser_SICK\Endress+Hauser_SICK\Kundenprogramm.exe
"C:\Users\Admin\Downloads\Endress+Hauser_SICK\Endress+Hauser_SICK\Kundenprogramm.exe"
1⤵
PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 25KB
SHA256 bbd7209ead03f287ba9385d01c603e4b69e5bdc955a67628f29f40a8d379d60d
MD5 c962554114baf3f31073e87eba47b3a9
SHA1 0ff06d8a8f056809df71a8253e4daad36b99de0d
SHA512 0070a02b23bfab849dc2420e9a0426442c667c6d54cad74a7dc8811c22b1460a40d6dfc0daf0cccf0695424722cb11d1060718b59d9e08f4e04e487c0175b07d
SSDEEP 768:Q6dSX+YzXKdBSkObnqs8i/DaxR34b5mmVhgP:9SO6a3S5bnqsDban36vVOP
TLSH
T14BC2F1CB5324143D3B7E25A511574FDCCE0B6B7562412E481A22FD2822C9BFE32AE5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 248KB
SHA256 ddb79bcf655c185586a937fc3418211d65845be3d12a673820863a59ce756587
MD5 79bffcb21ba09873cdfc9ba1b5c99a86
SHA1 286c2ae84939b75419bd5a47f6732bc3138f9654
SHA512 afd14e2252258c0d3cfea69e8fa9d169f8bb422d087de33dee373e772b78ffe3b45f516772cb01e0e1fcaae9fd3ed7c13c8f53dbb267ac1b0561d39cb1504666
SSDEEP 6144:0QzFEiJRfdJ/NCIJNLGCSkI00bRvNBXNvW98+32fase:DTdh4y0CSkI00bRlBXHq2Cse
TLSH
T1C044232A6FBD449C0CF594ADB161FD57E742824BCDD11870E6038DC2AAA12CD4FEBC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 16KB
SHA256 386e2ec0cfcddd5e2a59311de1081251de2cf70bf16dd52e8db4821ee061afc9
MD5 7b40547a18fae324d326d9ab0b1697a6
SHA1 d74d7824b69dd5e0965f2bb2bd8074765e4497a8
SHA512 ef652940054f074a197c4f01628966ffe19bdf85b0655b426c3bed071687a6b058a68731a58272612f7cf6b50d3f9f0f21768fe4a715c45cb609e6dd1770ee43
SSDEEP 384:ua9WPPYozN9ojZBAitmejpyge3S3DpSTOw/+HK:uacQozToTHDrD9iOYGK
TLSH
T14872E00D25C56C9CC17B05CBFF8A437AB471CB3AB9836CCFE495F56991478960242D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 166KB
SHA256 0af80aff823bca33b57e801d322abeae9e6e634bdec45fce39249512f1f40a75
MD5 76d74a25d77113f79ba77cd407957c3f
SHA1 fa6d081ffcf70aa160135702cb5ba5418c2ad73e
SHA512 f44d369ca9896c208cfcd58150008d68386777649ad0b43bee4b351ed6e9f632c4a00e1014fa98e13769a4d01ccdc43c6db7ea47268f1f75960fd9342279c7a1
SSDEEP 3072:wBEbylLVY850hk8ma9BVpsuMR7puYXqKNmhYQV5iSaU84xMLqFq1f0ewVmH8tpx6:2EbylLL50eAXsuMRwYPNw5ivU8iFEvwA
TLSH
T1BFF3128889F4EBD1BACE18D38AF359A07D4406AA7CC6D3E211ED0D6843516290D61FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 5456502124ba7bd6a144ce8351d534f15d564a2db5e908e8628afd7bec05011f
MD5 61fbe6fef96895cdffee8da85d0cbbde
SHA1 79596262ecb096998a250727e9a1682ee1d6f114
SHA512 e2fd38ff951f4e88292f1a516b12cdb5c4ca6d6038161f9d25d229ceead002d35913fa996597c71410e60542051f4f62816ad68edde5010c63cce070b943b599
SSDEEP 192:Fg0s0BgxMnn/fNinvY7Du/LZgqnE3kcG6E:iP0BgYn/fIvYf2gq+kx
TLSH
T1BB02EBF15B890C89FBA9DBB2A0F65C10B63670D9F50F2EB24A952AFC3B133507698401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5919c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5919c8.TMP
Size 3KB
SHA256 0c81a6dd25019c623c4a8ef9292b4eaecf39d1a8c0fbde69af1e99e7b282f574
MD5 f550bcdea786bb532914e0b2b0501a86
SHA1 6c2e2d3ef23e7c63555449d52734f24e4b44666c
SHA512 da3029a9424d05790cf800f8c7594af85dcf4d9bd06fb352e36ca00779939fb1c8bf2f8bdaf4e7bbcd437b000ea835cc1a6376e6257b0fa3d3a13635389aa727
TLSH
T1AA71C7F4A6C10894DFCAD370E2D21100FB3B71E9F90F7ED28C941AF85A07319A9D8206
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 274KB
SHA256 fe9bd33709aee10ada8a8f87b318f48fa738c7f814ecb5aad2fd8e6e182cbeec
MD5 245be4264088f0f297ac24d89ed82cdf
SHA1 77c6f4cc98785a3ecc24c551c83d7840d7b40d0f
SHA512 9cf02bca1cf8e302344ef2b87bbd6404d8cfdb2dbc92d7650733be9d86fc67e6492c65af27febcd678c58cfee0526fea392be5dc50538968a8fe184280c68e5f
SSDEEP 3072:M3rLsubKzW6UtHJcoBycz3UF7fIkHNo9SrTNZTZ+kmYroCjzW6UtC8rM38NjYfbu:45tHd5tC8r
TLSH
T18C540A7FDC48C83BD8774136E4E117A6AEB9AE40BC408C0961DE664D0932F663DE9D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG.old
Size 349B
SHA256 1936f869b36fe029e1c94e3dd7bd9b99463ed0f136d1572f71a154faf65c1c69
MD5 003293675c21afddcde384524b3c0e70
SHA1 96f1e01ffefa1b24a79f14e6571194ac98858008
SHA512 75d1e49c74550185b5dad94eb6a4cefa83e2e58506f9a95624a4939dac9819fea7c832dbbd2e857c6fff70420d356facb554e517f3ea1c28861948f2daba157b
TLSH
T1A0E0D87CC8C9C11F5A14A1E76578FF0E999FAA0EA789BD8D1F44D800B482089E06E1A2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 b4b103d73aec1769210677a8f74b46bb9e836fe52c0db80c6adb976eb9329d65
MD5 a3cc50c31b8ccfcae9becc1f4b64431d
SHA1 b866836922322a4de041a681a9b0753d97c802eb
SHA512 f6125044f36e44107d3ac08d28c36286fe12678a8fa6e02229046dc6f19321983527ee0b80edc4e252a50037057a897d27b20b9924645163413a87c8d68d7f10
SSDEEP 384:Dwgj9qBengPkNnCJmUieapJreIsTKReEFeofGk/xXFBJKoVo9t+NY4Ftk6CGBJ4T:q6nVCJjfvQkII
TLSH
T1AD82A2E7C3E4873EC81952F06B142E1ACD5E052872693C2785E9EE5BE3D34ABD18164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3be92f7e006dfa8a5e050dbd311ac7508393194bf66887a590e8f20efef7d0ed
MD5 32ec9a08e38a74951df6958c9a416c8b
SHA1 8977b4e1445d8ab2758253ef322d7cd0f63f8094
SHA512 824b522fe1d23ed10fd4a209b0a45b4d73a2bac97c7eaefdaeff376fe6170df87f07e222021e4a0559eea6ffa0e02dc6f691765c62226ed6af4a17590d2ad768
SSDEEP 192:sxZnoRPyM/jK1Ml8Mk6/fXsKi9jfIdpPlHW6+WNvc/k/YzrKFtIgrJ:sxZnoxM6/fXsKc0NHbf/19
TLSH
T1BA42D852AA34A97BCCCBD20DB945BF53D6F5447392944E44AAFCCA1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44dc48fb29809b8781b24e14a127ce06f6860f9647ea856f7d00dda6c5f7c595
MD5 d99fd7ea533af2d9e1888c7773e3add6
SHA1 d237f497494372f2885d6dbd479af07486c72908
SHA512 146a9d3500dd8100a878291cc190ef14bfd560d3d179228048a64c65db708de9a7f5955bbef6eaba256739bd39abf3b58393e617d20410d2d985d85ed2c76faf
SSDEEP 192:sxZnoRPyM/jK1Ml8M96/fXsziZZtdpPrHW6+WNvcBpXYzReFtIg5iJ:sxZnox16/fXszIzzHbYXrc
TLSH
T1C452D752AA34A977CCDBE20CBA457F53D6F5447392940E44AAFCCA1C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c1d5dc2f278e633b39780f6b21bc2da23e6883a356ea71857982b7b7228f1638
MD5 79880e03d12210e9371dc42eda846f02
SHA1 f07c0cf754f7a2ed8d110b2c977d8c3627156bd5
SHA512 8261c011e117c202d37a11b2043d35d6076df9922bf20e988f4788dfd07a647ed5335a5d790e454e0a87cb3e984110499696d2a894c125eb6fea3030d3a9c5b7
SSDEEP 768:n+W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjYroI/ijYU:n+W7kf0Wvqidau1jaa5LA3jjEU
TLSH
T157D20B3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 65KB
SHA256 ce59e11e9cabfe16dcfa03157c2c4515a1e6467a95641c0450a68675b4a3d812
MD5 b5179b837158988d557e981b7ad5cbc2
SHA1 6fa1f18020d7c6a067d273f8ed7b8c7915910a57
SHA512 cd837691dcc9ea4fa9891d516409baa434967ffd773372f7a6e8e914420e34e6754f797da89b890178607db185e4d78425cdd98b2f1105d97a218718162b8f9e
SSDEEP 1536:kwaGJUKEXr6EYQ85iwMAJXHWgH5sM2Vh8/gkU0nIjNjHWJvkxbrNTQ:g+XHWgZQNjBbra
TLSH
T188633BE3341B10A20FE776BFE856E9E5BC33615D6CCC8958FB30492D1384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 111KB
SHA256 01eb282903dc739627fa67e45a77156ed63f5473cfb76ac8312191a02215af09
MD5 e4206ff469ae3e1f3c0ca157a138256b
SHA1 88e3358c3d428878bec68069df5f74b42690977a
SHA512 e1047cf760ad027465a8ba5059c81c68bd321fea2e2289998168b50a6424f547f5c92a9fc14ac8bba0cd6a1a126884c48c6e93250fccbada4c3461ddfccee7cf
SSDEEP 1536:Yp7Lpx/huv3FZpg/If2lnjPH952PSNBdtckbbRs4HHCDOcLspFAO+e+Cysjz6sM:SLpzufFZN2f52PSkkIrLWF0QzBM
TLSH
T1BEB32EC2AF8A77E1DFB7217E14D2C297BDF282CF1FC1D126E561A209184826916F705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cee64cef7215bcc6a83ac8ba841a88b63fc53548471f6763803148deb282712e
MD5 f8c61cfc032832e1468827f85b9a56ea
SHA1 b7f968d2e77630a30dcba1cfd06faab329a60edc
SHA512 06a7da4c37e66cf25b69fdebdae873c2ddbeba3a6ae7d94a77f6da9ecc3fd313916c56f02d8c6870c501332947ca16a0d2d0607027ba3a6ea6b0a853b8d39da5
TLSH
T1F1B022328880008BC888833CC0CC0CCC323C8CB20B0200A300B800FCC83030A22830C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a11d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a11d.TMP
Size 48B
SHA256 a0006dd3079e3a5166759408aa4cedb3b19900208bd59ace695ca46d2c44e261
MD5 22bbd6925bc4594ccee8e3d6df599026
SHA1 84997dbfc89031bf04695f69b7f653517b97e7ff
SHA512 b774d3f1ce5667ae859ee28f5b344253168adfc214c75ee44f896e1c69bbb0d3c305785d2764588154e9bdbc16b5a5df7c9a740c11605e99039df46768b8d556
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2a7523513647c40ac87f1a56008c12ef2096869d4eec7f8f6976d285defb3038
MD5 b28ce3bf8b8b2f028361e1a766c718d4
SHA1 6513dd71afbd3b36afb3dd8811f9de8482ce546d
SHA512 616ef12f4a2613d592d7f46305a91388b76d226f185dcc82f25eb26b384545bf28c5ab46e19ce84c8c610333f850939da4f77d303651fc9341a85d3fe0dc4ad1
TLSH
T150A0026021500C42D0D083F01091C2626624BD545216171265D01C87D8B19505552061
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0c6d3d608c8484b07c972f32ad565d172ec9293b0ff4045c559e6c3d26e46148
MD5 e21b28ba59f6fa7cce873e885c81b97a
SHA1 43dccd88c9b7ec100a3a01e6e11e0a33329e80e8
SHA512 1e79f6107b2a1bef145437b0153f0b09067d01a2f19523d0a048ee867d3e5b4e84875b2cf5c5ef84d19f93579257079f8b50c4e555079c61376adea1d81951d0
SSDEEP 96:KIbCKcXfGKAIG8pUtJvPv693CJrZ6KDPr76/JhqTVIQK1qd:s69f8G
TLSH
T132914403B07B46413C7E28289366CA268F827553341CA9FF7B7844621EA6E514DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a5c32ec91a9017ce2c359210a7b19de0a90f1ad0b76947cb972bb7153b305647
MD5 faafdf46e6369755a4558bbd6381a075
SHA1 98a67875608b68bd8ae7489e20000147943f33d4
SHA512 767fc5287215224ce52278d305fed7109e55c0f69272517f2cb46e017bb33fbf9fce5abfc91ad7871fe7d35251ab25801305610b92ed8eb4af73e7a639e3de93
SSDEEP 192:unm+xasuheOwQxMGsNnnQnP5BbchQmiU1AhL4aGBPKZX+FdGumHqK+2PRkjdNlqu:dZcIhsNnnAbOyUxd5ml+2PRkL+ivUcoQ
TLSH
T15B829F715C785C3759F6F145F54B36076FB88027A6C8AF44E9DCEB2C01EE6A82317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f53707cff8e3176616690db0e11600b27a86ba1f44b8b8f72930e7c8c0d62f56
MD5 408c5bb501566592d4277056f3d5a80a
SHA1 78b5112b54f7e4a038aee8e75a210496c8a960a6
SHA512 bbcced9307db1793e71dccc3880c9df8d38abab1ad2207ee9bc0442de3e6ebaa7fb236a2b8a5302a3864043615e084234167e97d64156fb818c28b869aba7826
SSDEEP 384:uiFrZcIbsN58TUNTUlIlOAbeKUxd5ml+2PRk0+ivUcoQ:FFzbYwgp1ogle0+it3
TLSH
T1B4C23BF248E78836D9AD9747E77E2D039EBCC057B584AA40B7C89A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0188dd87f471c3d6a637e3f45812a43cb92b73c4d11b34749006f150d6d651c4
MD5 171a13c38efdbff3652231bb48da80fd
SHA1 3656b71e5f607b8c3b23b34564e9333b18614c0f
SHA512 d3a7ec4904721de2bebe2004f9b331b56d6eb89714d7a5909c218ae90f63e2c9e357c7781d1d3d759e4a96f7a53432a3ed5c209894e3ab97d21f32c1137c64f2
SSDEEP 192:MONC64BAQmiUy01AW5GBPKZX+FdGumWaD/TU6:MONC6eAjWW+d5mzrU6
TLSH
T1F4020B35AC787C7B9EB2BE45F5863B175FD8112BE6842B44EAE82B1C00D724C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d9f68c897e878f24739e54e5f8b48451483a38fd67a8be42955077544eb15d86
MD5 93b44efe4cb83c25e1251cef87a84045
SHA1 0d0ce07bfb7f92d03b48e43c10d7d69299a15fbc
SHA512 f36823bacef37c515a5de1fec248d79db79c4fc981880b806defc89748107896bbc9f51eb3710fcdb62a3114d192268555293b9a78dd7495314061892b468f70
SSDEEP 192:unX+xasuheOwQxMjsNnYaIzQnP5Bbcp4miU1AhL4aGBPKZX+FdGumHqK+2PRkjdT:WZcIUsNnOAbeyUxd5ml+2PRkL+ivUcoQ
TLSH
T13D929F715C795C3759F6F145F54B3607AFB88027A6C8AF40E5ECEB2D01EA6982307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 df349dcd2c4f5a07b972f0520c23dbf0c4706ffb1f1452abcae20bb0eb63914a
MD5 436ac1fdd5ad07f206f38d223a941df0
SHA1 1049604969fc1d2cf3494c926b1cb64573ff667a
SHA512 27ddf83af04c0b462fa2e095214881cf1fe87db40e63537aae9d1dd4b5cbcd080945072cb3a9a45f849d485e01d14213d43ccd2e102443b0d0cfb1956bf267c2
SSDEEP 384:uiFPZcIbsN+8TUNTUlIlOAbPrF2xd5ml+2PRkW+ivUcoQ:FFHbxwgp3FGgleW+it3
TLSH
T1E9C24BF248E78836D9AD9747E77E2D039EBCC057B584AA40B7C89A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 993e66194132622f17ad67c086fb2515d1423a03b5810050da8cd405ee9b210d
MD5 ff01e9aaf8700d8245f312c612f1b270
SHA1 c75e1c234db31dfe3e73b89af6854c5f5ba26c63
SHA512 c41c03b15681ecc2aa6a11ba673bf8453a52f14c2e4661bb703daa7dd10c5c44c524e4a0f419d450c47f0192e3b99ce788432fa3403d0b5d68d1968cf45b50cb
SSDEEP 192:uONC64B5QmiUyjA05GBPKZX+FdGumHqK+2PRk0WwlqfU6:uONC6eX10+d5ml+2PRkK+U6
TLSH
T16E122B359C78AC2B5EA2B545F08736075FE5412BEAC4AB54F6EC6B1C01EF66C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 082154d43a0381995445fe0d2ce7da620edbc89f744c27dc4d7f4e97fb584f22
MD5 a2292dcd10f3125e525ec713392bb3da
SHA1 82244fe3a97f5fcbbb6b7e83b0fafebbac0dd835
SHA512 fee5cd95451141185f12ac9ee902a1355ebad2cc2cdee4d0d5e4ced1da0802959b0f515bc2100b7a8c603d014cc4532fa73526b6f8813db7df2569d3da39c129
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59863d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59863d.TMP
Size 392B
SHA256 6180082f25dc52551bc4cd2a637fc1122f7ed6eea676af2b00e4387f07552f1c
MD5 0e5b58bc83541ed99b9dd707d2dcd2e3
SHA1 10527b30789dab66694cda9e5357e2617535a720
SHA512 e9d8cbe86d2397e8d0c5ed151d340bc1c99d3cfadc2798024d623b3af324c15c088dc106608370384e0bde9f75920340da1ccb5dfe116fa384e7728201cb4401
MD5 SHA1 SHA512

Submit Download

82542ccb-b395-4156-ab78-75a2cdfa5060.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82542ccb-b395-4156-ab78-75a2cdfa5060.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6350c1e513d8e2d372e2ae41f7ce4a066994ccaed0fb81c81568ed96f6159253
MD5 95bb7de0d7624faf9f2337cb1b256f09
SHA1 3611913a0cdfc2f0a682618e4c8768bab99bf998
SHA512 3227806c3a0650904b833e61e8ad68afab8f32aea54645a68329d527b84c0e55e62427f2d3bfeeb4b04bcba95b642369e53447b84e31f38947f2de35a91f2057
TLSH
T1FD412758A6FE1148B377AF5AAFF6A46D487ABC372E46C45E00110D5F0A23B40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-1213-0x0000017A07D20000-0x0000017A08477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads