hxxps://resolutioncircle[.]co[.]za/

Analysis

max time kernel
899s
max time network
735s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://resolutioncircle.co.za/
Sample260930-chvmascd22

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{BE7BBE63-08CB-41BA-A3BE-F753C114A21C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4668	4568	msedge.exe	85
PID 4568 wrote to memory of 4024	4568	msedge.exe	86
PID 4568 wrote to memory of 2376	4568	msedge.exe	87
PID 4568 wrote to memory of 4024	4568	msedge.exe	86
PID 4568 wrote to memory of 4024	4568	msedge.exe	86
PID 4568 wrote to memory of 4484	4568	msedge.exe	88
PID 4568 wrote to memory of 4484	4568	msedge.exe	88
PID 4568 wrote to memory of 464	4568	msedge.exe	90
PID 4568 wrote to memory of 1604	4568	msedge.exe	91
PID 4568 wrote to memory of 464	4568	msedge.exe	90
PID 4568 wrote to memory of 464	4568	msedge.exe	90
PID 4568 wrote to memory of 1604	4568	msedge.exe	91
PID 4568 wrote to memory of 1604	4568	msedge.exe	91
PID 4568 wrote to memory of 3456	4568	msedge.exe	103
PID 4568 wrote to memory of 1960	4568	msedge.exe	104
PID 4568 wrote to memory of 3456	4568	msedge.exe	103
PID 4568 wrote to memory of 1960	4568	msedge.exe	104
PID 4568 wrote to memory of 5596	4568	msedge.exe	106
PID 4568 wrote to memory of 3576	4568	msedge.exe	113
PID 4568 wrote to memory of 3576	4568	msedge.exe	113
PID 4568 wrote to memory of 3576	4568	msedge.exe	113
PID 4568 wrote to memory of 1872	4568	msedge.exe	114
PID 4568 wrote to memory of 1872	4568	msedge.exe	114
PID 4568 wrote to memory of 1872	4568	msedge.exe	114
PID 4568 wrote to memory of 3884	4568	msedge.exe	117
PID 4568 wrote to memory of 3884	4568	msedge.exe	117
PID 4568 wrote to memory of 3884	4568	msedge.exe	117
PID 4568 wrote to memory of 5788	4568	msedge.exe	118
PID 4568 wrote to memory of 1716	4568	msedge.exe	119
PID 4568 wrote to memory of 5112	4568	msedge.exe	120
PID 4568 wrote to memory of 4204	4568	msedge.exe	130
PID 4568 wrote to memory of 4204	4568	msedge.exe	130
PID 4568 wrote to memory of 5876	4568	msedge.exe	131
PID 4568 wrote to memory of 5876	4568	msedge.exe	131
PID 4568 wrote to memory of 5876	4568	msedge.exe	131
PID 4568 wrote to memory of 3036	4568	msedge.exe	134
PID 4568 wrote to memory of 3036	4568	msedge.exe	134
PID 4568 wrote to memory of 5924	4568	msedge.exe	136
PID 4568 wrote to memory of 5584	4568	msedge.exe	137
PID 4568 wrote to memory of 5584	4568	msedge.exe	137
PID 4568 wrote to memory of 5584	4568	msedge.exe	137
PID 4568 wrote to memory of 5156	4568	msedge.exe	138
PID 4568 wrote to memory of 5156	4568	msedge.exe	138
PID 4568 wrote to memory of 4336	4568	msedge.exe	139
PID 4568 wrote to memory of 4336	4568	msedge.exe	139
PID 4568 wrote to memory of 3796	4568	msedge.exe	148
PID 4568 wrote to memory of 3796	4568	msedge.exe	148
PID 4568 wrote to memory of 3796	4568	msedge.exe	148
PID 4568 wrote to memory of 716	4568	msedge.exe	153
PID 4568 wrote to memory of 716	4568	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://resolutioncircle.co.za/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffb33a6c188,0x7ffb33a6c194,0x7ffb33a6c1a0
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,3053324649765916676,9508740927747335172,262144 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,8400751217704372636,18089944108018213706,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,7743248483778569650,10016113121833110174,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9766516066530696633,4513703162565814127,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7711653413181385743,8972688551001450230,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,5672793687368007522,10462829652221554771,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,6757898036943594650,10250520139850023082,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10596245926193612489,16281683806557147154,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10596245926193612489,16281683806557147154,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6080,i,16262586683706378036,5301305636852001649,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3496,i,8881803435739275383,7562018355674467832,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3712,i,11029500130984104359,11345677982967487227,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,4316077482792637565,12754067695957284426,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,6847486997190043878,13206863426930211713,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10207731583575951330,17645262455743686039,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,2462248621429667975,2663932948413296583,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5860,i,4649284765639870934,9651969673362419398,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,17919069728211209896,16639044243028071272,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,2148119527230706843,17171881690321171543,262144 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5332,i,3896713158265695862,10558172644880059151,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15917102519308554039,5795698614207293098,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1356,i,16337319626120230168,9654619866160763559,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5376,i,12922762681478394521,18400794198709856894,2097152 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,5124072623194777036,11899762359860835780,524288 --field-trial-handle=2292,i,3474557584330271291,1732988066017571715,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0d4ca9628c39e6ac8c5af8439b2a2229943201ec5255edd8f54735a05eb8a49d
MD5 e78f6c027ce519d0a11a7e83f4b0fa2b
SHA1 a7dd0299dd1bc90da0f0ea7571012fd65f2aba4d
SHA512 1fb308c770d4bcbf21363d09d092659ef3c00e9128c5bac4fba435f53499e1da117282b6316eca30ed0fa5c33886707789d20909a0d86554b9af9454e86e05c6
TLSH
T178E026E49AE8C22EE214B4474178970DD2C13B1BD6CCAF0A270088CD7842850EA82BD8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3eaf4cd2eb86cd174dbe6142999bcad190b4485732321caefddfcd4f421cd1b6
MD5 8312add2b9815caab3b4f8f3a0245fcd
SHA1 763f62b10c5f1798740f520a74e8e49fd79b77f9
SHA512 769d83c549b288b4c329949168516ac73bb4002c987f26fd283d943efec6700ddd239aa44e95219051334627a87f2926f9d97f6400069ba3a53aadbfb52a9fad
TLSH
T1FDE0DFE456C8C3AEA61064C7D178678DC2C13B1A9BC8AF1A2700848DB002690AB82E98
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f514be08dec6d00dbea2a990416022335428da827a69e555a01a4ecd733f7385
MD5 725e2620e8eebf43885b2c5cca1bf48e
SHA1 18425d5e21447b4bf93f73da6fabe77343b39f81
SHA512 97ed235682909a50993726fdaa980c1ea0bd405163575598c030a93d81f1db3f90fb4bdb1316f0c921e90662fd95e7fd0dad8bfb60677a60bca7704443eed3cb
TLSH
T180E07DA49ADCC22EE714648741BC678D82C13F0ED2CC7E4A770089887101140F6D3BD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 18a20f567a3a122e0d88fa0a3a83f0fa8f485469e93c1847cbdf81fc122c8f51
MD5 fdcebe43ca961a50d459a52e00c5dcdf
SHA1 ed1d836b250afcd7fd823172636728a4300d8075
SHA512 5085efd38a12de26222e3d8b8d381680f207d761bb4948d73fcb38fc1ec5f3f99a4f088130459a445aa73807ebf7899ff7ada6a05b99a91d25609c570ad062fa
TLSH
T1EEF02DB5CD25BC3B08FC5B292064064BEB5113572780989F3B3D911D8FF1637854699C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cf5ef7d8eaacbc695797c1c6d236602a7e68820ad4c162db720727e24bf9bc71
MD5 5c08a2b25bc09472e8de5ad526a4ad38
SHA1 87407509e8528e23aedbc4830e46ef3fdb10b1ac
SHA512 f39d6c852b0699fdcf3896693b7491977a6b09bd11a46bb5857db4eb5a9c46576d88996c922c94e015d1823cc29fabe6c8a67269f36bf856f1dc2dc44b930899
TLSH
T15941AFF7C3E8866EC90156F0AA18BE2BDF1D0954432C3D5AC5E4AF1B93E2471D24169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 74af92c66b7753c5250d32b8799db77391c11960c6e185c490418c39f2006ca2
MD5 598a6222d369071edc2b6eea08e6994a
SHA1 4c7e8204dc66ce0cdcf478edd1b9ef1fc888eb69
SHA512 d9ac5830bf46a0ef002feb23ed9c0dbec8284093751c94ffd3e845a456ce52b5107150d6a0e2793487a5f62fc8d072d2a08f47214d8df4343fe613566d74daa9
TLSH
T1C331CFF7C3E8866E890196F0AB18AE2BDE2D0954432C3D5AC5E4AF2B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6fb8a02c1064530151b29dd9bd0fc718324fbe77e4827e8123433ddb91047c50
MD5 a9f7d825fba226aa60f31003be95bf09
SHA1 a448b88cb36ca3aff4face5236f580b1f8c4fd32
SHA512 aabb7f9fc0bf8a1532a86e03a83e7c38d798bd3cecbc368062b89b6dfbd613b1d8b43c2717dbd3e8db494ba75033c2f3c6a4c59b86fcb4fbe802ab954fc11abe
SSDEEP 192:sxZlRJkx/f0Xs5QZZx+zodpLHW6+WNGYbImKYDwMIgjNJ:sxZl4x/fWs5OZxlLHbGFtYDdjX
TLSH
T13032C7156E38A97B8CC7D20DBA557F53D7F95033A0945E48A6FC8A2C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 433c0ea362f081a9603f721d1a882db35606bce951131771ac1a6e4a1fb1cca6
MD5 84ab94498b7166e0c6186b4b4a6b3c0f
SHA1 15233b1b1a1aa8e818657666aa894466b6a9467a
SHA512 c537a8c7ebbcdf90fefa3729587c80a81996b3a39ab98f3841e9dfc941546ae0022631e99c5d80023637cc33e40b1c7e7b58b282b573cdd39c893d1cca0154ad
SSDEEP 192:sxZlRJkx/f0XsxQZZu+zodpArHW6+WNGYbIsKYDwMIg5jMNJ:sxZl4x/fWsxOZul+HbGFTYDd+X
TLSH
T1F642C7156E78A97B8CC7D20DBA55BF53E7F95033A0955E48A6FC8A2C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fa3a385d473984dc242205a3fd7c58b6fb87a25798aff55af47bcad4fcaad7c2
MD5 da7f9c5ac4d6335bfa076435773d826c
SHA1 df65b99a9a56e0422c433984439f0b3f51b6c5cb
SHA512 92208a4875bfe1a3bab27e7484edebf97ebe4bd55f09748ac08a5afa592ce155d797a5bb1e801a5db1a63ab4fc3dd6752ed02a26bf3c68b24b878045d063e35a
SSDEEP 192:sxZlRJkx/f0Xs3QZZu+zodpArHW6+WNGYbIaKYDwMIg5jMNJ:sxZl4x/fWs3OZul+HbGFhYDd+X
TLSH
T1EE42C7156E78A97B8CC7D20DBA55BF53E7F95033A0945E48A6FC8A2C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3eadd858-2c54-4e56-9523-d21a3d6608dd\index-dir\the-real-index
Size 3KB
SHA256 07424ed80e08587a201d19656c31af9b7b27cb3495e20a5b29dd3fd6314bdcae
MD5 5f8a9147f67e52cc3a92cca51e106175
SHA1 9fe2cc566242630f39410f6b326fff7370b55395
SHA512 e3f349c2adbe622b2ade04e937d0b5fd6e142ce84e088fe24fd5a7a4895c1f7f1302f371c268e7780b4debf61cc6488fc4fc474e6812ecbad885fcfe6d66172b
TLSH
T13D51FA4F0E631F66EDAC617204791845373491CC2384791F95FD8138FC8B7186C5BB68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5eeb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3eadd858-2c54-4e56-9523-d21a3d6608dd\index-dir\the-real-index~RFe5d5eeb.TMP
Size 3KB
SHA256 62a23a1902b818b7706f6755be7ff76ed719b5520c4e00ffc2d37291f8a5222a
MD5 27c4d79f6dbb947e360fb6f8c50a78e3
SHA1 96e4176e66011588bc96f74733f79b7dd52ff8e2
SHA512 cc33290b4a120b821218c6b834b25bcd4863446d17bef537e164a841d97055ebc97e469b8d185ec9c048a81e0201db4ea5640f619ee9642787ad8c951e96cc2c
TLSH
T1BA51735A5C030735EC94527309EA58A63739A54487483E0F72EDD132FCC279C7C597E4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6894adf584c410544464235bcd06293c79e514f80e15ff986142c8e05c035c29
MD5 052d360176db12ee093808ba8a79ac80
SHA1 068d59d829188e878938c02b1599a08bbf966c1e
SHA512 e2c5ed2f6ac6c90953d5c29d702c9614a55dd91d82808ade7ed37cc52eca22a0d96628960f9cd6c598ad8b8704ae42cf841f4994cd5a0cf3351636a5ebbb5d4d
TLSH
T1D2E0D8BBADE72A10EDAB87D6643145644407B9688941ED4F646AB6C764717483405C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 df1bdf3dedbd81fea90df0f2968cf15a0780cd0d734f8d104e2429536f803925
MD5 1a762dbc1a3779b5c8ba846532b97511
SHA1 f79bd331e381b88d8b67c434903fa7185e96cb0d
SHA512 fe4d821154ec11dd6e4b4d97199118db368b72cdcb5c044497774619d98103f51a525bc3d217c3bde05285e7ee760c6478411564c9edb12e8207c5625574fbc8
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX0vvM:OtfFvpopPxrB4Rhf0XM
TLSH
T19DB2131471BA021138FE690881B68B5F464232733259E72B7FBD14A69E6BF085DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e0b6a296-86f0-4be1-9a7e-9c0b4fc9b6d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0b6a296-86f0-4be1-9a7e-9c0b4fc9b6d5.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cee9dcb8a7154cd0daeedba2e3aa00ea7e077537652b14bef52ac222926ecfcc
MD5 d09043826a08fc993d335aac8faad6b2
SHA1 5d54709b79f60bb7c70668a0b0bb46fb446fd67e
SHA512 b2581b3cff974ad395b9d4543ab329f07f6e985b51288da94c8dd2fe3e05f86e4c3bbd9d6d454f1d8b90f8c735d96801609075da7fb369d82adcf044bdb536e1
SSDEEP 384:nuiFiZcI43sNB8TUNTUlI4B5mgACTKzfMBVgrCioFl/vlvVZh6DKhHsgL/7IzSo4:FFQ43QwgpGbBVgwF1lvfYGH7L
TLSH
T1FFC25B36E8A4DABBECEA8A95A74A3A07EEE04153C6CC9AC4D5C85D2C00D75DD0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1cd3b97faed9601b503b9dbc7e15936c79b8e3718dc964ec748ece5193029490
MD5 a488bc84479d8fde45475e8be0a764d8
SHA1 3ee0853b275b0116f7671615a0bf8998fdf9141c
SHA512 7579ccd8afe03d05e7ded1d993811ab48c6830fa2e4a4d35b0904b51960cbc497a799e85adb851cfaf00b45da5d1344265aa9f570f09a51a725b43382cf316e5
SSDEEP 384:ntiFiZcIlG3sNB8TUNTUlI4B5mgACTKzfMBVgrCioFl/vNvVZh6DKhHsgL/7IzSL:kFQc3QwgpGbBVgwF1NvfYGH7L
TLSH
T1ADC25C36E8A4D9BBECEA8A95B74A3A07EEE04153D6CC9AC4D5C85D2C00D75DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 424fa06ee0d19509a7b891f4e0aeecebcff07d725afcdbdb93b4009b4ef80216
MD5 da26c8b36b44d2c18f8c672c3f772167
SHA1 02c74b79e1d73bb45ac1a77a49400945c0b822a2
SHA512 8e0b385b2fe9c6a801f5f6e6cd90d7460bd537bd7f9f551122c16b29b437d014a708060eefd0b3d802c08a7d1e53f15ad4132b0001b39bf73d87d3fc7b3fc531
SSDEEP 384:nqiFiZcI63sNg8TUNTUlIm25mg5/nKzfMBVgrCioFlSj7O6R2Feo9rgL/7IzBor:hFQ63RwgSMvBVgwFkj7TRoVs
TLSH
T112C25B35EC94DABBEDEB8F9AA74A7A07EEE00163819C89C4D9C85E2D00975DD0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0863f3c49111d60a03c2ef4550311ba4b93ac1e481242620cee2fe04e8440b66
MD5 2c64660c908111853e75d0a2a08e333b
SHA1 9cf4ab5f43b73a1433fbff5d66d129f7e7633a78
SHA512 c3656ab99c60760c4e3626053514c7ece10653208a00dcf0df34e00759b2d0f9de48cd546089a1ebb4389c26ebcbbc527d1269d4552a80142fc5e14469511fc9
SSDEEP 384:nqiFiZcI43sNB8TUNTUlI4B5mgfCTKzfMBVgrCioFl/vlvVZh6DKhHsgL/7IzSo4:hFQ43QwgptbBVgwF1lvfYGH7L
TLSH
T1C4C25B36ECA4DABBECEA8A95B74A3A07EEE04153D6CC9AC4D5C85D2C00D75DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f8b07fb648b0195f971b41088e13204426c5c7f01c6844d76532fa960f73dcc6
MD5 822bde29bc6c93ab2c48b994702cc7a7
SHA1 7644be8ee3d9ef356c4cd52ae31d8d2fda6dea57
SHA512 45cb0b446183d13b8f1abd60ae5a5d0c80952da3ffbb1f135d4e80ac5536348fd3198a0ddad9ede18e7b43ab8207e76eef575725f206ef486559655375365774
TLSH
T18C414A58BAEA1158B3B76E56ABF2A86E487E79772E06D15D10010D4F0633B00CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5596-186-0x0000026384FC0000-0x0000026385FC0000-memory.dmp

Download