0e6b49f54b9b1c76414ce3876dd3c624293cee7ca97ca04ef84768e2e8a5a08e

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-uk
resource tags

arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
03/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
id=489501036.html
Size 66KB
Sample260903-ssh91swxat
SHA256 0e6b49f54b9b1c76414ce3876dd3c624293cee7ca97ca04ef84768e2e8a5a08e
MD5 49e539b4a4d1b5fef2ea197e13a20754
SHA1 4fec5a241d8b6af1f33324e7d304e9407cc2a15a
SHA512 47771c7961db762de6a47092c3f8534e969fce9ec2d44ee3fe9d8b213e6a3ff80a2770f5e0d15d8eaf9b60042fd7e4025312feb466f6e2de9a382f99f22923bb
SSDEEP 768:AWwNOYMEJE6wWTxVJDWOrzysfyHElej95F8jcF+FsF5WpNlNEOsVZMZRw/sfp9Hp:AVa6fxpcTFQcF+FsFoE0HuT4
TLSH
T13A6388C519C724BFC99636A0AD4E908A6CE43D167B8897859142B8C178BFDF43FD2C53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4456	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329226584297616"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{0584FCE3-7689-457A-9138-7A0AD130E5F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3100	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	taskmgr.exe
Token: SeSystemProfilePrivilege	3100	taskmgr.exe
Token: SeCreateGlobalPrivilege	3100	taskmgr.exe
Token: 33	3100	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3100	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 5124	536	msedge.exe	84
PID 536 wrote to memory of 3896	536	msedge.exe	87
PID 536 wrote to memory of 4456	536	msedge.exe	86
PID 536 wrote to memory of 3896	536	msedge.exe	87
PID 536 wrote to memory of 3896	536	msedge.exe	87
PID 536 wrote to memory of 5516	536	msedge.exe	88
PID 536 wrote to memory of 5516	536	msedge.exe	88
PID 536 wrote to memory of 4476	536	msedge.exe	89
PID 536 wrote to memory of 5252	536	msedge.exe	90
PID 536 wrote to memory of 4476	536	msedge.exe	89
PID 536 wrote to memory of 4476	536	msedge.exe	89
PID 536 wrote to memory of 5252	536	msedge.exe	90
PID 536 wrote to memory of 5252	536	msedge.exe	90
PID 536 wrote to memory of 4252	536	msedge.exe	91
PID 536 wrote to memory of 6076	536	msedge.exe	92
PID 536 wrote to memory of 4252	536	msedge.exe	91
PID 536 wrote to memory of 4252	536	msedge.exe	91
PID 536 wrote to memory of 6076	536	msedge.exe	92
PID 536 wrote to memory of 6076	536	msedge.exe	92
PID 536 wrote to memory of 3820	536	msedge.exe	96
PID 536 wrote to memory of 2096	536	msedge.exe	97
PID 536 wrote to memory of 3820	536	msedge.exe	96
PID 536 wrote to memory of 2096	536	msedge.exe	97
PID 536 wrote to memory of 2764	536	msedge.exe	99
PID 536 wrote to memory of 4588	536	msedge.exe	107
PID 536 wrote to memory of 1992	536	msedge.exe	108
PID 536 wrote to memory of 5928	536	msedge.exe	109
PID 536 wrote to memory of 5152	536	msedge.exe	118
PID 536 wrote to memory of 5152	536	msedge.exe	118
PID 536 wrote to memory of 4384	536	msedge.exe	121
PID 536 wrote to memory of 4384	536	msedge.exe	121
PID 536 wrote to memory of 5912	536	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\id=489501036.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcc5fec188,0x7ffcc5fec194,0x7ffcc5fec1a0
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,16493455096249218491,10488289522999792807,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15518340267464456609,15492616577115857979,262144 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,7697538624394474184,3848027025913452733,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5664712333786872629,5639961851678563146,2097152 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,15035709852435626752,7819581669586497914,2097152 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,4651535364293415415,10403792539971648567,2097152 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13471227566772114804,6146234387511114911,2097152 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4076514727869775844,4983636602253379968,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9783343918305593387,1541797962381841951,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9289037293498420530,16315419917937269665,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9289037293498420530,16315419917937269665,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,2880579362343413210,12168643155847381030,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,6401347156429074953,11163533046876246326,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,8124969531199478075,1523344511699558161,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,3661959824999591956,11243121148009654720,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,11397477629616504122,4259257605479870294,524288 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,15477654977201909612,17345338134508294953,262144 --field-trial-handle=2268,i,7732909329830897469,14976394843548684470,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 37KB
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919
SSDEEP 768:PcaDYrV5KBau+3erpKn9jpe7z9mWAFjQcR4D9DQ0LKfjLh:PcsiV5Y+erc9T/H4f0jLh
TLSH
T170038DE82E4917AEE9E2CF324ADB6716237B4F88C0BC169742B07F193175A51C6D78C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2105ad6a39f118f4f16d8722068cb5fe2f773389ffd14ebe11d185ccfba25a7f
MD5 247161d338d41d43d97da08f38e185e3
SHA1 79963683cb5be14c1466ddbaa20bcfd5f55bf2d0
SHA512 1b9df9403b88f7004512323a57eeacdb331e944bcb13fe5b0c2127f1810a73cdb10eb9ba409df51cdb08fc8a2985d1d345459adaef03c375903b2aa69b6f41a6
TLSH
T138713D1502520A90DF1913F2E3D201EAF4B1B2A97CD3DE6263C85FF2650C72CF25AA5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591cb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591cb6.TMP
Size 3KB
SHA256 b6967c472953a16ea0d3d99fe29c3192138ad404e5e1c089c34efbbec327b408
MD5 aa242146e98b9e0962bc331d6ee1189d
SHA1 d8dc6fb76d00401fbfb6169cc82a46352e8a1532
SHA512 6bbca64e5c8d28b8d41ad35dfcc1f785626d3dc3b5abf28ac0cc2766b500af01176a16309f2998f1987b8e67dd235e57501197832d3cd065cb15e575cce30818
TLSH
T172713D1502560690DF1913F2E3E201EAF471B2A97CD3DE6263C85FF6650C72CF25AA5D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f7fc8271321d552821c22369150df720a1ca60f116bfc83a50b892570fd9d5f7
MD5 5fe4daef5e0e793ef4a1bb49bbf76cd9
SHA1 b0e0f0994155c0dfe3223c3d305801190c4b6794
SHA512 dc736b8123cfedbd66fb603659b29d6b842f9974cad688a9db6c6ad652ae5477ed5242bac88feaa53a08180511bf0a43bb2f815486a116a9f30259fe17647490
TLSH
T118117DF3C3E5856ECA1516F06A24AE2BCE1D0605422C7C19D5D4EF2797E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e72b7969722aba21fb38dd453f6bbc2b2bda995edbe038ab45e7a78ce79ac0ea
MD5 f393ce099d9f47a1be30efaa5b25ea1c
SHA1 a32f7c5a2a46103cd9455e6095fac32cbd5f7462
SHA512 1911b4ea63f97331f000de4f09b27bb57997186324c9915386b8f7180f65bc640b9e15aa676fc5f68f7ed2c198f8669bc08679e3df244a77a9547b19f307808c
SSDEEP 192:sxZFRXy43KOMl8Mkr/fMsXDSIqpdvHW6+WNGYCkShyiIgrJ:sxZFqMr/fMsXDe1HbGhj9
TLSH
T15E42D915AA34A977CCCBD20DFA55BB53D6F95472A1940E48A9FCCA1C04E6AEC2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cc7125f9bc4e83b6988c24d7e4e00262c1284ccdc8f47fb6bfa6168bfe41bfb5
MD5 29ed0ab8c1677921907f8a994ff3beba
SHA1 a1693291abb593c35648198b344c14546627b97a
SHA512 c9288fbd6021c626dbda5ca5b91c25ac0bb1ec05fbc275951c24a66ee5df42d8750f50bf56ef2a07c1eddd1f7a60ca8fc098979d6200ca0ebede2fddda58a88f
SSDEEP 192:sxZFRXy43KOMl8Myr/fMs0KSIqpdSHW6+WNGYCW7OhyiIg5JJ:sxZFqar/fMs0KegHbGSojh
TLSH
T1D342D816AA249D77CCCBD20DF655BB53D6F95472A1940E48AAFCCA1C04E6ADC2307C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fbd42b90077ffd54ea2598a4fc00a39e0fcf118210c0f81d03b46469f1fb9339
MD5 c065d17434e987707ddb677838df8f17
SHA1 da449877ed22e967f95c32d1dc779a07e80fd8c3
SHA512 f40153be3fa1fef2c403bc47ab5b762ab9139150d1a5c12ff0f04c55f00693fbc7f61fdb118dd3064b452f677f6e0fc3301bcd65e98668a54e6e126bcb4a1a44
SSDEEP 192:sxZFRXy43KOMl8UQ2yr/fMs0KSIqpHSHW6+WNGYCb7hQyiIg5JJ:sxZFqqDr/fMs0KeyHbGbqjh
TLSH
T1D252D816AA249D77CCCBD20DF555BB53D6F95472A1940E48AAFCCA1C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9d0b72e605fe63342f3513b67f65ca13b01bbbcebe1d158c4e5ebc49fe8f0602
MD5 457d8875d5a29c8ae78bcb485cdc8842
SHA1 e3d964a4f18eb8305c3f2714470b0114458d9599
SHA512 eef4798d58c2d44d0a7cfd4ea2be4b0e05fc5eafd8dd84acc947c3c2481a78922612dbb06018d63d375cef51084deadf433e113ab7c2b0640e8fb7f686dc09ed
SSDEEP 768:M38bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVnroG:M38bqn+WvSCt6u1jaCZLbWV0G
TLSH
T1DED20A3B280CCB7E4F845E5DEC266F966DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a46c5a11b7f8c08d70606b23d542a674dd3f1f29f0335e593ed343f998293d0f
MD5 da43dc67167b5ca040d80202c106cab4
SHA1 41bfa2455d81070b757ab381c30120b5bbc074b0
SHA512 61a37038e34812d0c716f9a21ac28b32dc7ef75dbd49dbe2ac13e45f0d8e7296c5ab3428fa7d82f1397aaa800de01b198aa36dc6ef1cd1959e8f361bd012760f
SSDEEP 24:Kd4fP8tayd6qm4a2+NIjQmKilhaum1EY2SmsM18wq5yXYBfM3eabdDvX4nr+OIje:KoZI5KqU0G5yheInKvKIfyNvIZKoY8B
TLSH
T1D891EF53307F1241383E654DAAA29A3B8E4635637018AAEF3BB844E55E27E110DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 46d0679179b4de11827895ae05980a744379ba7eea1d6c8e3dd7dbdfb6e9dc47
MD5 eae4603292d0d7b93edea29e559c3dd4
SHA1 fd312f60fc809e56d19a1fdda78d971cfa37e276
SHA512 67487432c409a2e54d12c6e9d9163546fa0e412e11120b4aed40c52808fd224aa8e7bd797cb9057fce6b868d217c39164f6ab6a1ecadafef8d362910bd925de2
SSDEEP 192:u9m+xasuheOwQxMGsN+PQVeDbiGYQmiU1Kj24Ea+jq+FdC4XQSuTamsirqtqva+S:PZcIhsN+PqXGZEa+hdhuVstsa+VYSo/d
TLSH
T159827D336C789C7699E69655F88B36135FF8902796CE6B54D1ECAF0C00EA698030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9bf35b0f4eabb78326f78156c5efc1c215ebb21d5479ed3d7180cbb4de2b0414
MD5 c3378eb38046c84434c7c232f720414b
SHA1 b97bcd576b07cdbef67b4180cd0648b5d8aacf7d
SHA512 f5d8c27b13e47cd8928a5c89a596439a40ae3581602d2671ad04e80dd0e4da4c1e1cecebe70ba15a51c64842697d9212820dcb1a574fd5b377c2292f35cb81ac
SSDEEP 192:vONt6Db6QmiUySoHBa+jq+FdC4tRgsoAU6:vONt6ukHBa+hd2s1U6
TLSH
T18002D735A8786CB79AF26D49F48B37275F94203BD9962B94DAE85F0C00D764C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a5543d4ad15a5774fdea00b6f066b808e79859c7064d493ff63629f8d5cc91a2
MD5 b8534a959b718b63d68ce38c793c77c5
SHA1 26d7aeee2e6823a8b99fafc5e493fcaab0db106e
SHA512 8237aed915b7310a9edc79e204764d44af089f5739edcf5d11e0979b44e51b7ac6db89229c6ea8a2ab08c99457afed9f5543228b75f5b91d74c536b243a6d836
SSDEEP 384:cZcI59sN+0qXGZEa+hdhu6stsa+VYSo/d:KPcyawbu6sthghGd
TLSH
T171926D326C789C7699E69655F88B36139FF4902796C96B54D2EC9F0C00D6798130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c0b6525bc122f0fd0a4c1ea83de5a444e9ca194de1e5cc9a50ec1230abec5fcf
MD5 07268f08f30e3486d5f4f799c9923f90
SHA1 5ba3d4e7fd42226c9c78985afa339f9bda206775
SHA512 9a59209f08ede31a4530856789e7e3a9ba09b44f8c0bd1617770d9ee667fcdc64c0821dba0450526c90406ef8fb07c460b1ec17c1ddf57893cb98a6ca71e1602
SSDEEP 192:uK6+xasuheOwQxMzsN+YvQVeDbiGYQmiU1Kj24Ea+jq+FdC4XQSuTamsirqtqvab:8ZcI8sN+0qXGZEa+hdhuVstsa+VYSo/d
TLSH
T194827D326C789C7699A69655F88B36139FF4D06796CD6B54D1EC9F0C00EA798030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c67e8441cce83091fc547b439f54f50b96c8696e3875d90981ffe872940e7c1b
MD5 020e2afe667b86cf157b4594a4ef730f
SHA1 b24313caa61169392395469facc61a35f81aa008
SHA512 f249a9a1fb80c75fd53c7f9c29f021070c016dbecedb16a8aa3befd63f43deebf7042b5446896b18e306b99b8a109e47d8fb4ac9fcf427f52316f3a02912451e
SSDEEP 192:zON36DbgQmiUy9obBa+jq+FdC4XQSuWNzsirqtU6:zON364JbBa+hdhuastU6
TLSH
T115120836A868AC6B9EE26944F48B31135FE49137DE8A7B91E6DC5F0C00EB65C530BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24cf1bea-c113-413e-9f4f-924b3991ae24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\24cf1bea-c113-413e-9f4f-924b3991ae24.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8070df156a2459730c957217ae81d5b3161cfdbedda77a5c2c5fa0ecebef38d4
MD5 eeae9f67f97bc981bd8a8174928c875d
SHA1 27b88f26f61bd19a83b2fbc0ce3324e2516df02c
SHA512 87ac0a85adec284b3b6a3c0c5dfc2e8b70f400c1da8ef315b23de97b388b256ca14d26fb165ab87d9ecb50ade584a217a87dfd3e1ac5bd792f6a865f606802f0
TLSH
T18441065CBAFA1148B3B76E5AABF2B46E487AB9672E07C45E00110D4F0A63B40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3100-235-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-247-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-246-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-245-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-244-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-243-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-242-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-241-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-236-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download

memory/3100-237-0x00000255D50D0000-0x00000255D50D1000-memory.dmp

Download