hxxp://cerkl[.]udayton[.]edu/ls/click?upn=u001[.]PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D Snapshot of hxxp://cerkl[.]udayton[.]edu/ls/click?upn=u001[.]PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D

Analysis

user interaction
yes
max time kernel
71s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cerkl.udayton.edu/ls/click?upn=u001.PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D Snapshot of http://cerkl.udayton.edu/ls/click?upn=u001.PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D
Sample260916-s714dabe75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340472859620445"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{75C15A74-9360-4D6E-98FC-1B868E8C8CE8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2208	1252	msedge.exe	84
PID 1252 wrote to memory of 3784	1252	msedge.exe	85
PID 1252 wrote to memory of 4044	1252	msedge.exe	86
PID 1252 wrote to memory of 4044	1252	msedge.exe	86
PID 1252 wrote to memory of 4044	1252	msedge.exe	86
PID 1252 wrote to memory of 4092	1252	msedge.exe	87
PID 1252 wrote to memory of 4092	1252	msedge.exe	87
PID 1252 wrote to memory of 2012	1252	msedge.exe	89
PID 1252 wrote to memory of 2012	1252	msedge.exe	89
PID 1252 wrote to memory of 3572	1252	msedge.exe	90
PID 1252 wrote to memory of 2012	1252	msedge.exe	89
PID 1252 wrote to memory of 3572	1252	msedge.exe	90
PID 1252 wrote to memory of 3572	1252	msedge.exe	90
PID 1252 wrote to memory of 4420	1252	msedge.exe	91
PID 1252 wrote to memory of 4420	1252	msedge.exe	91
PID 1252 wrote to memory of 4420	1252	msedge.exe	91
PID 1252 wrote to memory of 5100	1252	msedge.exe	92
PID 1252 wrote to memory of 5100	1252	msedge.exe	92
PID 1252 wrote to memory of 5100	1252	msedge.exe	92
PID 1252 wrote to memory of 3352	1252	msedge.exe	97
PID 1252 wrote to memory of 4456	1252	msedge.exe	98
PID 1252 wrote to memory of 3352	1252	msedge.exe	97
PID 1252 wrote to memory of 4456	1252	msedge.exe	98
PID 1252 wrote to memory of 3828	1252	msedge.exe	101
PID 1252 wrote to memory of 4220	1252	msedge.exe	108
PID 1252 wrote to memory of 4812	1252	msedge.exe	109
PID 1252 wrote to memory of 4988	1252	msedge.exe	110
PID 1252 wrote to memory of 2288	1252	msedge.exe	112
PID 1252 wrote to memory of 2288	1252	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cerkl.udayton.edu/ls/click?upn=u001.PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D Snapshot of http://cerkl.udayton.edu/ls/click?upn=u001.PC0sSdHHlP7VsRgWiHFgJS9k0KW4fxCgoTr0mV7lml8nWLvSNKdkbSwTJDJIxaMMUEv8LxKZ0YMPAFcuLuo5IFINzzdfW9WxhxQi6DLCUqtdCD3i5k18GpFDlVXF2pEigctdyZO9iWdeWBhscWlKYA-3D-3DA5xD_KHeIFo-2BxfuzDxtHCdmlmRIDlYb76M4n1ru3NsGwMJgjXhjjCevaYHQyFi2MH-2FUZHgiNlJ60g7vG0pxJMDqZ4DrseXfiXDfJPCb5i4vDeXYNx0FTwc0LWfVIWXYwMOiqrqad7IyPRgoB2D4aaJaoj2rnZB5C5t8WNpacqruwbdvDiIut0NOjI-2B-2BdZ5N4MtQZBIBqrsnjMZUc86s0gJLB1NaPTe1yUNTgaFpq5TRYO1GWJWpFeu-2BXhvWIsfOCLEfzjM1jRwdzkrzzK-2FHYHpmHqFimhN5keupShQbakX6oF0eeOrpQezXPtdmRj9wykoPnOllAIdIBDooPP81YMfYvjL5fUMJQzW7ZCkpC6g4YYFJDdk75fT0gPeqjOpMF4f-2FaDu2qs6dfDSY80kld1Q0Q-2Fhn2skHYInkQixFkZEPJGbBonKgyW48GwHWgTH-2F-2BIEq5DxP7FYkjAIAqFKrFB5vrJKTTFta7wdDzxk6JTnZVib-2Bo-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff921cfc188,0x7ff921cfc194,0x7ff921cfc1a0
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6399955125109939809,15850842514340377128,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,10418681434117746380,8428894054001330934,262144 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,8299700092537017794,11015882347380507704,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,8405782700222051020,8530707673050947056,2097152 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,12110549300980968750,16923726320699474130,2097152 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8293228761735371887,2966966153326947632,2097152 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,2037070225452245611,4810645378223910816,2097152 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,18388047745132120807,974305496066626762,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,18247301552299155601,6991738562297177088,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12382289859460237691,9674647775089038319,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12382289859460237691,9674647775089038319,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,14645879332432403939,8392684090575046353,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,2860850726934652793,3267793319075367890,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,1885432760385664150,3114671869053648648,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,11040756424347236117,336188244053048190,524288 --field-trial-handle=2268,i,8556121657728587882,7956022417334062467,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0abd3f28c42262c7c9a88c4c1a89740d44f730d3fce1d56722f52578246f6ea1
MD5 be4451e4a19d42255cecd14e0f36e5bb
SHA1 28aedb31d3defab80826249b7f0f097e01e589c2
SHA512 3020221b5a54746bb7afd487dce0c2e835440809c81333fc7fa9af9f1305b7ee1b07b593d2c9ff03b6e30775c09cdde02159e426129a180fc9c31d0ed9d899cf
TLSH
T1FB61738440650BE6FFA47935B6EA134F323E45A3D783AD9217ACE47768CB794B204C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595181.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595181.TMP
Size 3KB
SHA256 d59b654937cdabd534d827f929767522e8139c1bc96cf7a23949ad7caed6a2f9
MD5 3590da20dafe5baf76668ebabdb6c261
SHA1 4863d32008cdddb71cc5acc6a766f263de6c803d
SHA512 285a05f7af43b5b7221c2daf41e5407d198719ae61f9e3c4d2fc1846f67f30ea37d919000ac8de3cc8a536baaa363acdd802e85d56ee935cc2b798b704e0a588
TLSH
T19B61748440510BE6FFA47935B5EA134F323E45A3D7839D8217ACE47768CB794B204C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 715B
SHA256 e58aed8b0f33bf378bf586b0d2b8539d3621833e8a7f43a42d39f59050b621d4
MD5 950de17242399f79a149f6dc57723d72
SHA1 efdb17beca7e5c625f79316b744db78375154074
SHA512 fe0209773f0d231f0fc21d0745641fb6e33c2a4e1f2e1fdcd25535c94a8de065cc60f9c413f278ee400c0da20b11a043a22994719e7f439a287524f822f51028
TLSH
T180019CF382D185AE890106F05A24EE2BDE2D060242187C1989D4FF67C3E306AE00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 39ca6eb0b23f555cdc80f1593f45a34cd5b78f13085d987fbc953ff8a925e735
MD5 07ccffc74ced16c668c340e0de818edc
SHA1 675bc37eeea9fb9376956925925f8d6f8fb88cb8
SHA512 5f2fb84322030c59b93ec85994e1cc10755393308c80b0b64bf33ca20bfce16eafe98dfe5a00a3ba7500e4fcf3d57162dd857c2fbc283f567c031604ef50432f
SSDEEP 192:sxZHRZWO/fTs0QQ1IdpGGHl/6+WNH/F/YRP6ldIgrJ:sxZHeO/fTsvQGhH69/mo9
TLSH
T1D822C9156E38A97B8CC7E20DBB15BF53E6F9503291D11E58E6FC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b43f62b20ce97e2fc8bb7fe7b3b5eb82e5279fff395c0d4979beeb831af4cd7d
MD5 dea23fef2eeb544ba44b4635f8fd1e11
SHA1 625350dc53bfeb0147f368b6f294562ea73c2b25
SHA512 1b5f9727ea7f4ae47a938e842f41129e77b0ef2d36a913fa6239532fe431c54d8ab7fdbb032d53c1e9d90853d7a6bccdd4f04b7e44672baae08578662807aee6
SSDEEP 192:sxZHRZWO/fTsUQQ1IdpGGHl/6+WNH/F/YRP6ldIg5XJ:sxZHeO/fTsPQGhH69/moj
TLSH
T1D022C8157E38A97B8CCBE20DBB15BF53E6F9503291D11E58A6FC862C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5b477fbfcaa55221223c771843ed5744b5c66dc0fb45c091638cf6606c779a3
MD5 acc458d9912147d8a5fc77b8ad7be8c2
SHA1 76940ca2bc4aeeb1e8c41191a43f1e7d1161efa5
SHA512 c0d486310166348e522c23dc07c0ce2cd4781b6b71416f13165ec4d3b155076eceea79d9b9c6bd233cea440a2f2623571f91667a5aecab962c0cfd89e68215e8
SSDEEP 192:sxZHRZWO/fTsBQQ1IdpGGHl/6+WNH/F/YRP1ldIg5lJ:sxZHeO/fTsyQGhH69/m9V
TLSH
T1D722C7157E28A87B8CCBE209BB15BF53E6F9503291911E58A6FCC72C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6f450ef20891052ebef0409ef86c6e955098b1eb5ffb8bbf436607a9f85a7c95
MD5 cd0c8d98415ae6cfe71919818b1017e0
SHA1 569df8327bbea5bdcccb634db74eadc60be8c96b
SHA512 03a1e254e50a0f481b55e7ba15e6b4472686a7b882b89f007eb5cd7953b802731c4d218d8d7f0c950b701b30df5713b91f8adcc26afbbbb18e6a77fb2332ac06
SSDEEP 192:sxZHRZWO/fTsBQQ1IdpQGHl/6+WNH/F/YRP6ldIg5lJ:sxZHeO/fTsyQGDH69/mYV
TLSH
T19422D7567E28687B8CC7E20DBB15BF53E6F9503291911E58AAFC862C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fa2a50e0fd975f899f0517d758b571fffdc211b3427609de7126f962e18ee51b
MD5 ed83f11539eb3abba3f487800becdf3e
SHA1 4ceb94dc28e4fbc6d430dd7c48f856d284730bba
SHA512 bf5e59a3a1d8908c4d6b2075529862528361157da38fc934e482eb7dd2f3c0ba112a798c8c8618d0bbed129fb3c632847174dd994333ddc80d0484d71f182e22
SSDEEP 768:F5K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Croi+i+:F5K9uzYWvcQWsu1ja0HL7Q3Zi+i+
TLSH
T14AC2F93F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 676B
SHA256 aba73b02708414f24b930c44fe7b2f9ceb81d8caa010da7d58e4928cbe2d2bba
MD5 7e508d208681dc74cafef71b32ed9b20
SHA1 261e741b54f201a28854a4233347c2d6ab953e3b
SHA512 ee3f992d3e90f0ec08d1611a710278bb9aa3cd4471cb58fa0315dd71fb08bd2d0b06ffda79d8e871693c1f1b4436f19ba027946c7dd73c73662e12490a4ba4f7
TLSH
T19A0121C1A2D410947F8AA941C10D9A13A0A13E76130EE87213DD85F09F84A280EAF964
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3c17bb0c1af2275d4629a652da5c59ec1e3815c0009288f282835e9a3dff7815
MD5 40407cfd99fcd5736748daae466bfb33
SHA1 2880273c03c5ea1822c2b864b3863ef77567df67
SHA512 fa95a7ef81f4cf33fb2ee43feca5b3e90f2cc7d41c97eb69010633cae679fb8b51877672b623c222288cd36dfa331e6b75006d323e05fd2e88a0b9d6e79cfaf1
SSDEEP 384:rZcICsNxTwVuyaWiCOjTV8/dwC3wJr8W7O6R2Feovh7Uxox:zCh6RBnYAh8W7TR6Au
TLSH
T1B7827C326C785C7799E7A141F54739039FF890A396C62F90A1ED9F1D01DABB8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c74fe7b2521cd4ed9505a35c413a91a1c2181df3d970fac8b7d0fea26653ed19
MD5 58b0e0185a7b6bedba01318cd86842f0
SHA1 799de9cf2f863c3e14ce045269ff2332651eeee4
SHA512 b2481d9f5c7899fbc1b75df7c721e3de0d444fb5e84ba9b35cfc45bcdd4309d36ecc96e72a43216724184c4d22a80ba49a85b5535e5c9b2557c74e04bbac3da6
SSDEEP 192:SONe6ygpQmiUyo0tOCTVgj0+FdVmOzP9HU6:SONe6lH2tOCTV8/dwANU6
TLSH
T19D02D735AC782CBB8EF26E45F48736175FE4217BDA962B90D5E81A1C01D766C2307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67d05224d8cfec83ad972102943a5c6cc47e848106effb64775e3fde44ee4e2b
MD5 09914c949ad0476710b8bcb86b2a78a9
SHA1 e63a183380f5f1f181b02209aa5ca3de0eb2d7a0
SHA512 ea270fd863c837976baa735e6693631cab1e4bd80ddff6e466ff4c7512f3f78703b7bf63f1784c78581bd33d0b7a9d0585cfc20c7a4fb55e6c32687dedbc8ff5
SSDEEP 384:sZcICsNxawVuyaRiCOjTV8/dwC3wJr8W7O6R2Feovh7Uxox:6Cw6wBnYAh8W7TR6Au
TLSH
T1FA827D326C785C7799E7A141F54739035FF890A797C62F90A1ED9F1E01DABA8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0bfc131e251aebb044e2b68e010f698bc0c53a7d605fa3608b10fd8fdeb2222
MD5 639e54c6a64ab7cc5eb08272da11b9d1
SHA1 6ff0825eca86e0a2c670dd77403bc8da9c19e70f
SHA512 5d590b30a82671999fbd9742b1e0895f508b3be4add7856837c2500671d1c649f6787075a4d402effcc12558a6ebead458ceb6b380ec152af567aeca193225ba
SSDEEP 192:SONk6ykQmiUyx0eOCTVgj0+FdVmCggFJSJrZ3Ur/aU6:SONk6L9eOCTV8/dwC3wJraWU6
TLSH
T1E912F935A8686C7B9DE37541F48735139FA45167EA8A3F90D5EC1F1C01EBA6C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8645be5a618ef88fef9daa5fcd46320d8c0340f1344f29171af55db9a5a15fe4
MD5 f217e1a329f76ee41b11bd3a084d10ed
SHA1 3944122aaf46ffab5c08845d2a0a6334ecfc31f8
SHA512 c6b594652f42a63c8b75436443d615a7366a26993661596f33a41ea639d15a2a7a2f90488d48048c77397bb355e1fc085d2f9dd77e6981e96ea976a28bbcf42f
SSDEEP 384:JJBqZcI6csNxawVuyaRbCOjTV8/dwC3wJr1W7O6R2Feovh7Uxox:iBw69BnYAh1W7TR6Au
TLSH
T1F4B2F6F168E71876C8AE9343A73E2D035EBCD063B6862A50B3D85B1DCD8567FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c9a9c47-8f93-46d3-b9fc-a1628c6d46db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c9a9c47-8f93-46d3-b9fc-a1628c6d46db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31897ba5783dddc9f3d1524cd59c7ab302556d53ed64b7009cac96064c88636d
MD5 880a95d33bb5a8de72cd23957bbf7eab
SHA1 2b92578f1126500a9b12b087e17100c18e42a222
SHA512 e6238864c8034c92d8aa7525b85919427b7d78828c9fbd02b9e4101b58960552bef760903adcc40659fd6997e0ef5f73ebd815fc608145e3bb2fe009c9129802
TLSH
T1D641E95CA6F91108B3B37F5AABF6696E447AB8773E47D45D10110E4E0623A40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads