hxxp://bku7ah23w1njgb[.]infomatrixdesk[.]co[.]in

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bku7ah23w1njgb.infomatrixdesk.co.in
Sample260925-x49cssvz7n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{71196DD9-BB50-4C85-BF29-5490FFB10A2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3940	4812	msedge.exe	86
PID 4812 wrote to memory of 3308	4812	msedge.exe	87
PID 4812 wrote to memory of 4012	4812	msedge.exe	88
PID 4812 wrote to memory of 4012	4812	msedge.exe	88
PID 4812 wrote to memory of 4012	4812	msedge.exe	88
PID 4812 wrote to memory of 4740	4812	msedge.exe	89
PID 4812 wrote to memory of 4740	4812	msedge.exe	89
PID 4812 wrote to memory of 3480	4812	msedge.exe	90
PID 4812 wrote to memory of 4896	4812	msedge.exe	91
PID 4812 wrote to memory of 3480	4812	msedge.exe	90
PID 4812 wrote to memory of 3480	4812	msedge.exe	90
PID 4812 wrote to memory of 4896	4812	msedge.exe	91
PID 4812 wrote to memory of 4896	4812	msedge.exe	91
PID 4812 wrote to memory of 1780	4812	msedge.exe	93
PID 4812 wrote to memory of 1780	4812	msedge.exe	93
PID 4812 wrote to memory of 1780	4812	msedge.exe	93
PID 4812 wrote to memory of 3520	4812	msedge.exe	94
PID 4812 wrote to memory of 3520	4812	msedge.exe	94
PID 4812 wrote to memory of 3520	4812	msedge.exe	94
PID 4812 wrote to memory of 4348	4812	msedge.exe	98
PID 4812 wrote to memory of 4348	4812	msedge.exe	98
PID 4812 wrote to memory of 4348	4812	msedge.exe	98
PID 4812 wrote to memory of 3808	4812	msedge.exe	99
PID 4812 wrote to memory of 3808	4812	msedge.exe	99
PID 4812 wrote to memory of 3808	4812	msedge.exe	99
PID 4812 wrote to memory of 2020	4812	msedge.exe	101
PID 4812 wrote to memory of 4276	4812	msedge.exe	102
PID 4812 wrote to memory of 2020	4812	msedge.exe	101
PID 4812 wrote to memory of 4276	4812	msedge.exe	102
PID 4812 wrote to memory of 4624	4812	msedge.exe	104
PID 4812 wrote to memory of 4472	4812	msedge.exe	114
PID 4812 wrote to memory of 4472	4812	msedge.exe	114
PID 4812 wrote to memory of 4472	4812	msedge.exe	114
PID 4812 wrote to memory of 2196	4812	msedge.exe	115
PID 4812 wrote to memory of 2196	4812	msedge.exe	115
PID 4812 wrote to memory of 2196	4812	msedge.exe	115
PID 4812 wrote to memory of 4160	4812	msedge.exe	116
PID 4812 wrote to memory of 4160	4812	msedge.exe	116
PID 4812 wrote to memory of 4160	4812	msedge.exe	116
PID 4812 wrote to memory of 1096	4812	msedge.exe	118
PID 4812 wrote to memory of 1508	4812	msedge.exe	119
PID 4812 wrote to memory of 3156	4812	msedge.exe	120
PID 4812 wrote to memory of 2464	4812	msedge.exe	129
PID 4812 wrote to memory of 2464	4812	msedge.exe	129
PID 4812 wrote to memory of 2464	4812	msedge.exe	129
PID 4812 wrote to memory of 4120	4812	msedge.exe	130
PID 4812 wrote to memory of 4120	4812	msedge.exe	130
PID 4812 wrote to memory of 2628	4812	msedge.exe	131
PID 4812 wrote to memory of 2628	4812	msedge.exe	131
PID 4812 wrote to memory of 5052	4812	msedge.exe	135
PID 4812 wrote to memory of 5052	4812	msedge.exe	135
PID 4812 wrote to memory of 5052	4812	msedge.exe	135
PID 4812 wrote to memory of 1856	4812	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bku7ah23w1njgb.infomatrixdesk.co.in
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7ff9f6afc188,0x7ff9f6afc194,0x7ff9f6afc1a0
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5814890470119807850,4468426748894833276,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,14238777016643543001,10972835149814254961,262144 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,13244432115284862619,16469559128803046897,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,579161735405059588,965978445558873862,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17362538607596420866,4211046273371890447,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,7626912669682347257,8271017473685294228,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,1193812924883403184,18262012384636480130,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4940,i,10381145087954355755,8930487477707667807,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5224,i,13294275066041403242,13577800554886652231,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,5848477553698634762,12350847161186126201,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,8038516347854930092,10212169404877388860,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1076238538798552795,11688699415984287253,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1076238538798552795,11688699415984287253,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6232,i,17210154134901662185,4527520512763563831,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5220,i,11692342497315853712,16759661377942083381,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6264,i,5931689732246681931,5540716927383346609,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7724196103629498090,14445068373148578537,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,8622418891726938848,14677428043210498299,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10337160486040518104,2160825934430433284,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2708,i,8027406304964408785,14124375710765842984,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3687750359001105993,17440959926876703805,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9039971149853621203,11208588061580068841,524288 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=760,i,7642618507426882464,7596451342623819799,2097152 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4208,i,1631985840481382529,8757228980724970956,262144 --field-trial-handle=2660,i,12275934604958293438,13477853552857423540,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

3e9580c3-9d6b-4b10-abb2-3accf59ff0cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e9580c3-9d6b-4b10-abb2-3accf59ff0cc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c77473a368af60e0eca3fb9b41219ab4f8bd4ddc5adf5ae081e1118ff7256894
MD5 83ec88ab552e1c92b384769b7c91a04b
SHA1 3c473d9d27df0fd22f0f8372110556b51458a9a8
SHA512 4ae1b023a2c8cf26b30fb5bc8382e27d81dd08fda04eff9779a0354432ed76433e8396cc54e95211bd36d6ddd24988473f02a3e90c18172ed243b2f99097ea70
TLSH
T190615D811BB088B3FBA451F8C6F498D7BA32938D54839D110AE4F56D5C5332741F720B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b7d65c6255db174e43d4607f49927a039a24746e938e8272556badf4a95c613f
MD5 e1c6d73203a59bcb514ed4fa36946fdb
SHA1 fca901671c371958847e88c3fc81681efb76f332
SHA512 972765116b2820362c74ae725388c6cb6842b0060075b738ce43644f353234880a5d96a41f23f307b6abae7dc2949b0c104a2c6e3bcca9ddc38a1735e9d9eca8
TLSH
T1CC417CF3C2E8829DC92516F09A246E3FDE1D491943283C19C9D8EF1BA7E2071E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 cd84f1f6ce912a77438dab654aeae5f54e6071fe6da115796c500a38516ba3fc
MD5 8ebcc3eab3a48ad442e28b6784d46e2d
SHA1 15d25c474c60f8cbe734c18e51bd5e3f9ba08263
SHA512 b8650406d2ba19df67e7fd0b6d84edbce45e701846786eed3621fda9cdc099f9b4d24b27acbc2a5167d5eba7d0a2ad8ebe1d6ad0e128ee9f3ae467db469f1c54
TLSH
T1B6D0236B731C31B9657D2DE14067EC9FC36750200443FDD550D1545D19B557C07C7140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5954dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5954dd.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 409eaa9b9887513bd734a2a01214f51dd808f6d768c5f37bee00384676ca6606
MD5 df5267aaa7e5c1fb0a4cc43038636b9c
SHA1 f8af8bf94cfd6dae2dc7720f06521e250954f8d8
SHA512 762b4e43ded6d63d0b3d7f61af81ce0faa98d5856d4b70a111b3faafd1a8af51389fda659f9ac224f950d66a6653c2a7bc0f0740a3197271e9fce6473f412a06
SSDEEP 192:sxZERLWu/fBsaWaIdpmhHW6+WNGYgUo3aIgrJ:sxZEku/fBsDzyHbGn69
TLSH
T1D522C7566E38A97B8CCBD20DBB15BF53D6F9503265D01E58EAFC861C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f79a18443e0c7eb29950ceddca20d3bb8004fe1069079cf7cadd2ada58094ec9
MD5 2863fde361c98bea36492cd082e11df0
SHA1 aa043f10ea1532fbcde3d8c6c6873e7c9a3c7c5c
SHA512 b70092b0de382fa0cee53f9fb71cc751b516c215ce9f9db913a4a466d78cdf32cb9831a2a7d9e5e8ec45a577dd7164db60916be5e98a1bd1ad7b538133bbd7fd
SSDEEP 192:sxZERLWu/fBsRGaIdpmiHW6+WNGYgZo3aIg51J:sxZEku/fBs4zNHbGE65
TLSH
T10C22C8596E28A97B8CCBD20DBB15BF53E2F9503265D01E58E6FC871C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 57c4f748f30dcc6add4fd6b3dce758e88e88f0e30be2c8eda3d2235829332d77
MD5 5490ce029cf89e033debc61afeed4e68
SHA1 cb532338ce24a17126b043ac7637a56ce002ade0
SHA512 74a8b55383a8463754cc5f6263ea25ee40464b7284acc6db094b9f55826e48b55ce113cda85e16a6656f7fe6ccdaaed10e3574d3eb823f23035190ddb36aa000
SSDEEP 192:sxZERLWu/fBsRGaIdpsiHW6+WNGYgro3aIg51J:sxZEku/fBs4zbHbG265
TLSH
T1FE22C75A6E28A97B8CCBD20DBB15BF53E2F9507265D01E58EAFC871C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 84f313ddea5aff0b06cef1b0cfc361099ec13b7b0ed76a88c1e7ac5ae1ef29ff
MD5 c513c809ea74f18a5f5bf58d07b569ee
SHA1 20204e699c8011e6e308c2640b83d0d55c36e6fa
SHA512 7cf631335f5bd3656b1dc6239d9ee3342c6999714c97b7c72549c260a2e2e2baedb99f04fa07257061e8888d789b29eaa3328731268e83ef750979ad35eee158
SSDEEP 192:sxZERLWu/fBsRWaIdpmiHW6+WNGYgUo3aIg5nJ:sxZEku/fBs0zNHbGn6H
TLSH
T13222C75A6E38A97B8CCBD20DBB15BF53D6F9507265D01E58EAFC861C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 20d1467d0bd8030eee0ed541370c7e2ea25f99b12b7bacc5d1f1d0f58b4ea637
MD5 25110ddf335d496a4f1def2ed79ea79b
SHA1 ef747db1eea4b052832bc3e1ec115627a98cc67d
SHA512 52e1cea301f8a39e8b5d4bd5e41d83faa7722a04fe56e08c8ca4a848abd72d35c4acd40d419b23d566a94ec1c921b5ed64ffcf40553a79612d2e2376d3c86831
SSDEEP 768:ZuichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz2rosT2X:ZuichfPWvPZplu1jan+LKgzNi2X
TLSH
T1A7C2E97B640CCA7E4FC01E9DDD1A6F9B7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 924dc4b4e6d3191b63668abfae278a3ad749eadde19788161a3f79da547c8f85
MD5 6446c4354e949c7a29239a68e95f4ead
SHA1 1f23cc0ac593a313aa5ebdeddc5d8417bb878317
SHA512 b2e8d703a18b935537a501a28b4bee8f344cc58bb29dafea06619daa480c4f3845e2d01c7b78a91aca6e77498b7665c27c1c937f37ceb739bd1fd5f95538d546
SSDEEP 96:KAdOKOY6VAr8QuC+giapzIIgKQ1IWgsYIZ2XJCKKw6i:URVAr8QuC+1ap8IU1IWdYIZ26Bi
TLSH
T14091021135BF038139FE6C4585F4872A064131EA3358FA7B7FA844A38D6AE151DFEAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b627.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 abf8325dfacea5de3850b73897c3c26e49125e6f39932761ab49966ab911e4db
MD5 bde6790ca670a8f72b1b03fa3db0ab3e
SHA1 f426ff74dda1005f24495412b67aa5eca9cd63cc
SHA512 626c1360497a960e569cf7a8d6ba540c0db38bf51c640931631d2014802056b766e8d58b8f3e0715043814e8b22f8b5bd6d95c1725950807da2e551ba65b8a2a
SSDEEP 384:7ZcIhsNoBT5qIBBGYX5EzyOi6Q1ILtgOIwZOyeLboQ:jhtBzGYuzyO3Q1qXslXf
TLSH
T17D827D7A9CB89C7B5CEB9245F54636035FB89027E6C8AF60D5DC2B1D01DA2D8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b2e06ae1c7733ecfdacc7eb7676be02fe2e3bf353b5305575239fd2f1b44d06f
MD5 f39be1fc6b314abe2d5c593a782e8c22
SHA1 441a8535e933f2490286651811c4833747e5a5e7
SHA512 0b1f37ad2a6fd72b5d28ecdd9d081872263d107c515cbc4984299e125cec2a1a3641f0b4edfa4a0f6a286967934f1a66b47baf9076d04d2104fcb68631c09cb6
SSDEEP 384:eiFiZcIozsNY8TUNTUlIliT5qXBBGYX5EzyOi6Q3ILtgOIwZOyeLboQ:1FQUhwgw+zGYuzyO3Q3qXslXf
TLSH
T1BCA25C7788B8DD7B6CEA9B84F54A36038EB85067D5C5EB60E2DC6A1D00DA1D8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a6c858c2077d1b4042f5ca477e0c80acbe1b6ab71fa18d4347fa46d7ffba8540
MD5 76b409ba925c3713fae89ca757f7b7f3
SHA1 800308d9c74812e9988e839ff6d5107323d70b6d
SHA512 580e8b6e04da6b80309b6b9ea1f9022c85821b10b3954bee245431b110f393fb128efec843014077f86514203b03d93f2ce5f53dd56f21e15143f6fcb0d5a418
SSDEEP 384:KZcIhsNoiT5qXBBGYX5EzyOi6Q1ILtgOIwZOyeLboQ:oha+zGYuzyO3Q1qXslXf
TLSH
T1A2827D7A9C789C7B5CEB9241F54636035FB89027E6C8AF60D5EC2B1D01DA6D8130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ca6e55ddf0330651d9afd465e0fbd799d595bd23349e29e7b66b108e6cd43aa
MD5 81e517d96c1ff80aaf4fabe45a6d61c5
SHA1 beaf9afc61a72c591033f7d1ba9ee794b614ffb6
SHA512 115bbf6c5e7c3165b102a3e5e8176cbf0b1507e0de3f00ef991acf6c6ec2f87a6d80ce3061ff38beeff33948252b01693031c5037eb36e53697d73bbf171b633
SSDEEP 192:LJONf6DphmqQmiUyVkq8wGYX59ez6CyORMWkk7byU6:lONf6195RwGYX5EzyOiw+U6
TLSH
T16502E939AD78BC7B8DE36E45F58737136FE4112BAA942F54D6D82A1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 817fe568af76ddcfd7c88fb2c242ef9425be43685a1c2a1ff56ad4f0fd7780ce
MD5 0e59845202db0853d876a3d84a8d09c5
SHA1 ade318cc3bf130d90251fd3db839270f44aa7fb4
SHA512 f2083d264a3dfd06116cfed5d69026f04b2f60430336ee029873e94af42b44ec866817b16e757b3828dbb0a6778811ffd41c0263a4404726942c90070db311a5
SSDEEP 192:LJONZ6Dph5qQmiUyOkzwGYX59ez6CyORM6QkkIIIo/5gU6:lONZ61S8zwGYX5EzyOi6QFILU6
TLSH
T11B120A35A9B8AC7B1DD26591F48736139FA95127EA887F60D2DC3B1C01DF69C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69286c1b-557f-4fd5-99dc-b8d3fb37b196.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69286c1b-557f-4fd5-99dc-b8d3fb37b196.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aaa45c847bbc59d7504303446311c7f1fefcacbba4df1d7d772e301c8b135143
MD5 c3a2553d7f9b1171acd8270abe5893c2
SHA1 0be54709b3902116225d8ab6106b14132042f989
SHA512 471f86c715a99b0588b6dadd64734fd19c8829177dccc07e77bc8285250fed4670c025be43110ca3d62a266e821b3c910b8db6b9f2b2f993a9a8d8563d8824d6
TLSH
T1C8412658A6E91108B3776F5A9BF6A8AD887EB8773F46949D10120E8F0663B00C961737
MD5 SHA1 SHA512 TLSH

Submit Download