hxxps://access-patreon-content[.]firstory[.]io

Analysis

user interaction
yes
max time kernel
106s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://access-patreon-content.firstory.io
Sample260910-l7p8jsvtd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335086541337600"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F584E286-5BE9-423C-B6D0-F7130221274A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3956	3660	msedge.exe	88
PID 3660 wrote to memory of 936	3660	msedge.exe	89
PID 3660 wrote to memory of 2068	3660	msedge.exe	90
PID 3660 wrote to memory of 2068	3660	msedge.exe	90
PID 3660 wrote to memory of 2068	3660	msedge.exe	90
PID 3660 wrote to memory of 2764	3660	msedge.exe	91
PID 3660 wrote to memory of 2764	3660	msedge.exe	91
PID 3660 wrote to memory of 3476	3660	msedge.exe	92
PID 3660 wrote to memory of 3476	3660	msedge.exe	92
PID 3660 wrote to memory of 3476	3660	msedge.exe	92
PID 3660 wrote to memory of 4832	3660	msedge.exe	93
PID 3660 wrote to memory of 4832	3660	msedge.exe	93
PID 3660 wrote to memory of 4832	3660	msedge.exe	93
PID 3660 wrote to memory of 2140	3660	msedge.exe	95
PID 3660 wrote to memory of 4592	3660	msedge.exe	96
PID 3660 wrote to memory of 2140	3660	msedge.exe	95
PID 3660 wrote to memory of 2140	3660	msedge.exe	95
PID 3660 wrote to memory of 4592	3660	msedge.exe	96
PID 3660 wrote to memory of 4592	3660	msedge.exe	96
PID 3660 wrote to memory of 2568	3660	msedge.exe	101
PID 3660 wrote to memory of 988	3660	msedge.exe	100
PID 3660 wrote to memory of 2568	3660	msedge.exe	101
PID 3660 wrote to memory of 988	3660	msedge.exe	100
PID 3660 wrote to memory of 2808	3660	msedge.exe	103
PID 3660 wrote to memory of 2180	3660	msedge.exe	104
PID 3660 wrote to memory of 2180	3660	msedge.exe	104
PID 3660 wrote to memory of 2180	3660	msedge.exe	104
PID 3660 wrote to memory of 1800	3660	msedge.exe	108
PID 3660 wrote to memory of 1800	3660	msedge.exe	108
PID 3660 wrote to memory of 1800	3660	msedge.exe	108
PID 3660 wrote to memory of 4756	3660	msedge.exe	117
PID 3660 wrote to memory of 3320	3660	msedge.exe	118
PID 3660 wrote to memory of 1992	3660	msedge.exe	119
PID 3660 wrote to memory of 756	3660	msedge.exe	121
PID 3660 wrote to memory of 756	3660	msedge.exe	121
PID 3660 wrote to memory of 2100	3660	msedge.exe	122
PID 3660 wrote to memory of 2100	3660	msedge.exe	122
PID 3660 wrote to memory of 2096	3660	msedge.exe	123
PID 3660 wrote to memory of 2096	3660	msedge.exe	123
PID 3660 wrote to memory of 2096	3660	msedge.exe	123
PID 3660 wrote to memory of 4660	3660	msedge.exe	124
PID 3660 wrote to memory of 4660	3660	msedge.exe	124
PID 3660 wrote to memory of 4660	3660	msedge.exe	124
PID 3660 wrote to memory of 2724	3660	msedge.exe	125
PID 3660 wrote to memory of 2724	3660	msedge.exe	125
PID 3660 wrote to memory of 2724	3660	msedge.exe	125
PID 3660 wrote to memory of 5100	3660	msedge.exe	126
PID 3660 wrote to memory of 5100	3660	msedge.exe	126
PID 3660 wrote to memory of 5100	3660	msedge.exe	126
PID 3660 wrote to memory of 2028	3660	msedge.exe	127
PID 3660 wrote to memory of 2028	3660	msedge.exe	127
PID 3660 wrote to memory of 2028	3660	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://access-patreon-content.firstory.io
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbd12cc188,0x7ffbd12cc194,0x7ffbd12cc1a0
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,8374059331527272528,3559304060309294544,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5106196841077643610,12838850275727144871,262144 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,5943948706853579674,6034965896578856361,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,13728285595636163422,596589174129179889,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,816491938114214799,11182081154794178487,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7435311528464172443,2291674631226436735,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,11891836067216242571,3543744727286244849,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,10541128508244051413,2450360456545794660,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,8480097024048895254,2762645777928864487,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15642727763287244586,15530882492142210744,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15642727763287244586,15530882492142210744,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6296,i,10726899561956984453,18156822891918899882,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4460,i,1172362656805896559,10166126066375282798,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,6789561717456221810,5902569142472124699,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,10279482678552007843,9107311323521020811,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,5241125652336925612,1508902455471790820,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4355160256421304709,8978491412384389813,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16276530907160232725,1374481047228160767,524288 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5180,i,10054367255303383646,9144248044899687834,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7004,i,11938453664364346624,4775042529920544159,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7124,i,18371352170964657415,8920402621717610054,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7292,i,5389494662033312416,18424308729808917430,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7056,i,6490391706543620020,15313516278214795841,2097152 --field-trial-handle=2300,i,17973186109037826494,16440394194659750833,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 82d4a8d3d52ae2d7f0fcf6020ab6b2115bc650e9dcd6aa88ce32524dc5a3b71e
MD5 5281773a9b3b6d64424af053c0f80bca
SHA1 77e1ac8ccdd0de51981f0b22e6363ced996a54dd
SHA512 cd0876b11a7f09221f06a08a0594ab2ffcab777ece7eda2050c7046ca28ad75d4294a7cebc5d704fb5bf36b1abd0fec32e95c50cc6239c70e0da3b858f07683e
SSDEEP 96:uaaYwKzUFWc+MWXj/+GdzpB2O7lt+JaD+:/rzrc+M8+Gzr2OJt+86
TLSH
T133A175F149B568D8FF14CAB070E18902B13279F8FD9F2E47E0C0FA3665933944906728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ea5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ea5b.TMP
Size 3KB
SHA256 e33c442b2d1347a2b6ecf15e709ce5c127ddc3ac727c47798c86a31a8627104a
MD5 aee798429d755d44477b311bcd01acd6
SHA1 f83d13b999b4906fd9be96803db6429986b8c3c8
SHA512 54c5f5a4df92d83477678d954bb1ae219fba00e09734ccff62b4b366d08ededbb65125f1b8f2f3cfd56668676af3a8300627eb0ed91704c59782d921d4fd5afd
TLSH
T14F71B6F54279489DFB69DCB070F181023530B9F9FCAF2E9681D0EA387A92354990B13D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ebe34e6ba47ebbac70422442e18dc2af1709babac27a5250aabcbffe23ca8425
MD5 4d7e7729e40ac3737165f0856013eae9
SHA1 c054192d9f69c3b81794444a105c1a75ce11eda5
SHA512 a7fb3a6d7b6dcadd0ced0dddae51fc719b4612bab42db2c37b39f8e68f6f1ddfe3bdd3e4f66121c5c84c346021a215fe5a2f90e4c8ecacbd3e4352003d4fe5cb
SSDEEP 192:DW09G0Y1k1HoZuaAGc1SEUIAhnH+VxtjizpjujEkjO:DW09G0Y1MIZutGWSEUVhnH+Vxtezpju6
TLSH
T12BD19FB7CBE5C22EC81155F8AB142E2FCE59196943383D39CCD59E1BA3F2970E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7310e0673452acc047e72468423d4266483cbd6c969f0da16702c6f2d38b375
MD5 4eb32cfd1abf9423fe86d66f7aa2d12b
SHA1 ba945b6c21fd0bb537f34b77b313a2aae11b6afd
SHA512 d4118449605f7164bacdfb578571628e762c540c333c62a6b4850fb0627dccc80534cd83764e5a7f8d16955a869bc9c63a9dc55b415bfa81701c922a70f1c073
SSDEEP 192:sxZfR2yM/jK1Ml8MWv/f5s+7umIdpNltHW6+WNwqQ/YzigI83IgrJ:sxZf0uv/f5s+7udHbi/a9
TLSH
T16542F911AA34A977CCDBD309BA51BF93D6F9557392900E44A9FCCA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 414b2a610c0124c786c4acc04dc279855e32038522b7b1f872913c855d5c5a92
MD5 c06eb253e2d3728d8acae447a752a714
SHA1 8a66236d15ea39404c7eafdf66b6539dabf8a412
SHA512 8ab10c8ac7ec8ffbb74723feb6dbe50461ee3f76055d17d2882f934ea6ad5484f926bcf7208ec4c878d605dc7df200f7ebe9edc89b8d440cd7d01d7af89d7e61
SSDEEP 192:sxZfR2yMojK1Ml8MWv/f5sJ7NmIdp6lOltHW6+WN9DojqQ/YzcgA83Ig5FJ:sxZfzuv/f5sJ71LHbCx/KN
TLSH
T1C952E741AA346D77CCDBD208BA55BF93D6F9557292D01E44A9FCCA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 efa393b790622ff02b38dd10f053ac9aac8a86ee89b1422b613e5c5052c1b7e5
MD5 87bc664bb728952b48aa602276117e6f
SHA1 c00f06babe6bb4fa818c05d002937bf69f4e9fc5
SHA512 475bdd99ab64fbd78afd3ce0ad332507191a0144f2528992e00c046687e84b2fec1ce7febcdbce6f6585bd712e21629685ddec1c8e9365d9e8baea7be1522690
SSDEEP 768:NkW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjqroIji9YY:NkW7kf0Wvqidau1jaa5LA3jByY
TLSH
T14DD20A3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3d3a27cc19055436732769b1ace39f5bd16ab108a77b6130693899249d576f3
MD5 ea81beaec91fcdf672e1bc22f389ee02
SHA1 37655eeae507a31e748f89780426397346b628c0
SHA512 1657396894cb5e82f58b641f7967722af55b6e9a9aef4835730596eda039329372eea4c15e875121cd1207b00aa64721c15d725f494fa231c99a71ddaa5b36ad
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTenI1K0k4Py1zIhKM4M8dIT:KIbCKcenWK0kymzuKM4/dw
TLSH
T1F2916402317B068138BE2849966696776F4672A33814A9FF7BB810A11D76F590DFFCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f916f9e-aca0-4cf2-9ac7-3222dd1e49bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6f916f9e-aca0-4cf2-9ac7-3222dd1e49bd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4f1e14fe07a2b8e5c2cab33e12f06037eb40b9f902bc71f4a728d34699b03a67
MD5 3457557d8e824aac3cddee52a28e7b79
SHA1 e56adb9e183cee7b1f1d9245a49c019119cc1608
SHA512 180169dc5266c34238baaabecabbd5e4dd5f2c58e6d82388954c71a114947a07df0de7453ed3c597fb4e9a272b8f5dbcaefbceb2eb1328bdcdb1f261f087f822
SSDEEP 384:fZcIhsNpps72bsoJtdKR+29m4xuvzxV+MhdpXuoi:3h1CR/wls44184pXut
TLSH
T151828E315C796D7759E6B241F84637035EF88137A7C8AB84E5ECEB1C01AA368231AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 34ed0a03a50b1de55fd9477eb27bc01c9474114a65619885d5ad05d3f7efba47
MD5 a956b9703b31e0242b92a213639cda69
SHA1 0bc74ce8358d4259fb4f1b7babdd448d29dcf7d1
SHA512 5d0df68a225e35e2830b7017e924244e6bdda7a6b869faf851952ee9833a3a200d542231d0fdaa491e331cfbc4fea388a20da8fcc3c9ff58ca2fc1f9eb9545bf
SSDEEP 384:xiFiZcIlsNL8TUNTUlIl8s72bsYttdKR+29F4xuvzxV+MhdpXuoi:YFQluwg7CdLwlH44184pXut
TLSH
T1D9C219F248E79976D9AE9743E77D2E034EBCC067B584A640B3989A0CCC561BFD30AC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ec9f14f926f8bba7454bc464d2218190b8a29a57b73191eb875741de1548fe39
MD5 2e06b6928aba8e0523af1ef0964b0037
SHA1 7ea89aade103d40b3c9c19383523747796a7b57b
SHA512 9561efdcdb56fe8cdbcf593a3a445a8777774a234eb691fae54592001bad15cba846b3efd3c037fd61ac549311e0fb634e2e3c81f9a8c3742a82229600f47b8b
SSDEEP 384:yZcIhsNp8s72bsSttdKR+29m4xuvzxV+MhdpXuoi:Ah0CXLwls44184pXut
TLSH
T13D828E715C756D7759E6B241F84637035EF8D137A7C8AB80E5ECEB1C01AA368231AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc59dcde6679f9d09f38ab8c1ef4c22132ff7cffc0b9b277f0fc21e9afc8e02b
MD5 6fb2a32e06f05aeceaf75d337e80fa7b
SHA1 4a310505d417381a976f470d81740535ecc21fe1
SHA512 92362501934ca4e9415bec4d83c2240f6913488a045e4cf5b0bd417282e2e1f814d997796f26dd3490f80cb376f4baf85908eb7a6c0d1b4288a918cd4dc95e42
SSDEEP 192:MONG64BAQmiUyL1GW5GBPKp/+FdG7BvaD3rCdU6:MONG6eAMUWOdKCudU6
TLSH
T13802FB34AC786C7B9EA2AE45F5863B175FD8113BA6C52B44E6E85B1C019764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5fc4744ffdd182d1b5c1945c2be7b1cf5bf24764d18bbd6ab17f84f5557d9f32
MD5 5be8ecc3cdaca9ce8eab7d46968810ad
SHA1 ee52a42e246c80286c0fb676671edacd4a666c0e
SHA512 0405f0fb0ed59edeaa8c9d833fe0805e0fe08c501e0663e034e31982fa25747c5efd1f9011125005e8e10441119e1abe9674805e73be578bfc44a36bfc710b90
SSDEEP 192:DXONE64BonQmiUySGDX5GBPKp/+FdG7BGc+29vWw3FqM8U6:jONE6eAOrOdKR+29b4U6
TLSH
T157121C356C68AC3B5D92B545F48736135EE8423BEBC57B80E6EC6B1C01EF66C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0ddfd2479ee035174c75a925134d1197a5b2ecf558fec32a1ba4c019363c4df1
MD5 ba5a6545cffd8f940e254db4b48886a2
SHA1 cb8bf116c6989623ab3b8b9b681fc6d08ae00dc4
SHA512 a9e36fcf866ac1ce8a498a0defd61e01896bdfed097c46b76c344c831f0e42939e9ecb6fb85897bdbc1a214ee83de7c8a16701da1131afedff12b93662b86474
TLSH
T1D5E002049211106BC079033140C31F203AF1802113B312996B3001781C733007B50FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1d0b0a1dc98c95de98d4ea7ed9ba3755ae2223b103bb77c9231a05f60662e9bb
MD5 b5933065d05f2fd4de13d718af108020
SHA1 e69e7410f200b12e07958988ca4b27fd8773ec39
SHA512 e77379b1da98afe3afd6dd1b9f7199556477a69f74615e0c399edec8712550e64a7f395fd241ac79a772019bfebedb8e2dc247f72a4205d4ae92f7be0adcb9bc
TLSH
T190E00105931110AFC079033180C31F307AF2803113B312996FB101782C733007B64FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fb99668e0114788f2819f0bb3e8556d3e79b5c25362f9d28b69ad743dc6dc3e9
MD5 5f548fd7d567a339513dcc4528c0ed8f
SHA1 89b60304129a7e4569fb600835b980144c7c300a
SHA512 d2c5e307740bb4557e48671036ac6a5ef01d3f57a4b34cfd415e70e651bd31882c17626988fe652c0b4f67a544b6c1da2bd96a8b1f4511d5aa4f64b0ee819f3e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58de16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58de16.TMP
Size 392B
SHA256 decd9c37856cd5048168cf8b00be35979ac66cd1f5d73735c7280656e7d89183
MD5 3d29322a665dfcea4a0e05026335e705
SHA1 09ee151bfef378117b15be280668481ef4a104d0
SHA512 bca4441adc2d1acd17330a2f142839061fb2de15b9c5d3446fd57992780789afe6efe2a31e108a03d0d61931afece455e12b3a259177afbf6b5f0f32d162fb76
MD5 SHA1 SHA512

Submit Download

55265940-b08e-48ab-9738-7854526c4f79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55265940-b08e-48ab-9738-7854526c4f79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b7da2f537fbd95d201735de17a35a96fa8e34f7b6224d773f3cd6aa8037a1d1
MD5 2b356882a41fcea5ebb1eb8273e0fa0c
SHA1 5d80e10ad61514d32cf28985a90cef72403ec60e
SHA512 a28eb1722567e75dddeb71087ff24f63b623c34471a78ac6f86f9a8a0f8ea621c295fd346080c857a5bf0e1aa7c54b9641c401dcda59f3505b93f8d3ed6e5440
TLSH
T1C141F848BAFA1148B3B76E5A9BF6696D487FB8372F0AD55D10110E4F0A36F40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads