hxxps://authweb-sessions[.]com/portal[.]connects[.]secured[.]share_serviceweb

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://authweb-sessions.com/portal.connects.secured.share_serviceweb
Sample261015-zyvcsssvcx

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	36	https://authweb-sessions.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a4b1cc11cbf21237	1
HTTP URL	156	https://authweb-sessions.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a4b1cf213b1a0339	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6068	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9E44B531-34EE-414E-A9BF-DA71BC3DC749}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3568	4800	msedge.exe	84
PID 4800 wrote to memory of 6068	4800	msedge.exe	85
PID 4800 wrote to memory of 4916	4800	msedge.exe	86
PID 4800 wrote to memory of 4916	4800	msedge.exe	86
PID 4800 wrote to memory of 4916	4800	msedge.exe	86
PID 4800 wrote to memory of 1436	4800	msedge.exe	87
PID 4800 wrote to memory of 1436	4800	msedge.exe	87
PID 4800 wrote to memory of 4928	4800	msedge.exe	89
PID 4800 wrote to memory of 4928	4800	msedge.exe	89
PID 4800 wrote to memory of 4928	4800	msedge.exe	89
PID 4800 wrote to memory of 4992	4800	msedge.exe	88
PID 4800 wrote to memory of 4992	4800	msedge.exe	88
PID 4800 wrote to memory of 4992	4800	msedge.exe	88
PID 4800 wrote to memory of 5012	4800	msedge.exe	93
PID 4800 wrote to memory of 5012	4800	msedge.exe	93
PID 4800 wrote to memory of 5012	4800	msedge.exe	93
PID 4800 wrote to memory of 4948	4800	msedge.exe	94
PID 4800 wrote to memory of 4948	4800	msedge.exe	94
PID 4800 wrote to memory of 4948	4800	msedge.exe	94
PID 4800 wrote to memory of 2112	4800	msedge.exe	95
PID 4800 wrote to memory of 2112	4800	msedge.exe	95
PID 4800 wrote to memory of 2112	4800	msedge.exe	95
PID 4800 wrote to memory of 4064	4800	msedge.exe	98
PID 4800 wrote to memory of 4064	4800	msedge.exe	98
PID 4800 wrote to memory of 696	4800	msedge.exe	99
PID 4800 wrote to memory of 696	4800	msedge.exe	99
PID 4800 wrote to memory of 3644	4800	msedge.exe	101
PID 4800 wrote to memory of 2400	4800	msedge.exe	119
PID 4800 wrote to memory of 1056	4800	msedge.exe	120
PID 4800 wrote to memory of 5516	4800	msedge.exe	121
PID 4800 wrote to memory of 3692	4800	msedge.exe	124
PID 4800 wrote to memory of 3692	4800	msedge.exe	124
PID 4800 wrote to memory of 2572	4800	msedge.exe	126
PID 4800 wrote to memory of 2572	4800	msedge.exe	126
PID 4800 wrote to memory of 3092	4800	msedge.exe	128
PID 4800 wrote to memory of 6116	4800	msedge.exe	129
PID 4800 wrote to memory of 6116	4800	msedge.exe	129
PID 4800 wrote to memory of 6116	4800	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://authweb-sessions.com/portal.connects.secured.share_serviceweb
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdd87ec188,0x7ffdd87ec194,0x7ffdd87ec1a0
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,14215034547516076194,16341361041263307796,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5820241891789903078,10295499834508792942,262144 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,9540231275931815568,16750587921340964733,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12733942144175677355,1607608461600279169,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12926510186407657902,16745578455501443263,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4964,i,9428392440837207768,12793062317473206193,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3360,i,12838871811303666098,8104895908414768445,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5244,i,7808585576308194321,8476712726828794642,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,13030871783231916101,17271590342953800079,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,14902940313120765698,14498911544632671885,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12247941295766250217,12526554612278962309,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12247941295766250217,12526554612278962309,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2342256122450469891,8964105236557644259,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,16836463950482841018,2614090580364164469,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,937454819205968845,15545043213553531748,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,7825710091318583839,15178591949092940340,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,12815729789810005175,7729016953711380259,524288 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,99584804240209738,4066277731878556327,262144 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5208,i,17995717502384894875,13504496571194843099,2097152 --field-trial-handle=2308,i,11372298486999708116,13439538244113951301,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23141805-71cc-465b-81c7-aff829ba92ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23141805-71cc-465b-81c7-aff829ba92ee.tmp
Size 25KB
SHA256 2ce95b882767ee1faf5459aea1fac4b8c33ab5097ff4aa5c4a05d68bbbcf4333
MD5 9b8c5d177a9c170766d91ea5ad9dab6b
SHA1 86d6c218c4343e66f55f7b85edbc0707546809e4
SHA512 52a8657ac91c9af7b7c90a2cf94ee18de35ee44ede9d0ce15ae81a268808ab9745515b6bf35b3483bac00ab83b3fbcccce3c4d5023ccc23a26565027cf847971
SSDEEP 384:nuiFiZcI63sNu8TUNTUlIm2aKMi+4wzWfLBCW/Cv5wXFay7O6R2Feo2bgL/7IzwJ:FFQ63rwgc/HEBC2ChqFz7TRDsJ
TLSH
T1B1C24A36EC98C9BBE9FB4F9AA74A7607EEF00163D59C8AD4D5D81D1C008759E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

444fb131-c53c-4a70-a86c-d2ecc419aa3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\444fb131-c53c-4a70-a86c-d2ecc419aa3b.tmp
Size 32KB
SHA256 39a0260dc4cbd9be366201e8e14db2acc79e62905ed63a2ad75c7a1faca7415d
MD5 a806e0c04269fb29b70ed7a19af446ff
SHA1 fbe44045d87e972a8932e7fa689f5116765d2f46
SHA512 756e6f241c1b556104b3165da2783a70be4dacd12ef3a31c52e86f542d11ba8d328ff25fa901df57702525a651e92c182e266d64738547c67f47a7eb289b325c
SSDEEP 384:nmjiFzQkUSvW43sNa8TUNTUlI4lMaKMiKxwzWfLBCW/Cv5wJuOMm0wogL/7IztIb:mOFdz3vwgqdEEBC2ChICm0wGLw
TLSH
T17DE2A2F1A8D78977D9EE0B97A37D2D4299BCC113B5885A94B7C81C1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55523b6a-c7f3-4f29-87ed-0fef1cfb0a85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55523b6a-c7f3-4f29-87ed-0fef1cfb0a85.tmp
Size 26KB
SHA256 c3d8e63162dd06b8ba178d80fc0daa5a5829d7f08296f6ac74b2cc25d41e3744
MD5 c1e4bbb3f073d12d7857a20f7afab085
SHA1 178bcb447f9079c30302fe33cceb114e1ac01d30
SHA512 2600cc6d000c93b2ebc89901a1566e555490968c655e1992456826be7ef12dc2bfbce6a3cc4fe599b094557e3c72c5338cd55476381accdf0c5b3743bf503871
SSDEEP 384:nmniFzQkUSvl3sNa8TUNTUlI4lMaKMiaxwzWfLBCW/Cv5wJuOji0wogL/7IztIIw:miFdl3vwgqNEEBC2ChIhi0wGLw
TLSH
T147C23B32E898DEBBEDE65E95B25E3643DEE09253D98C5AD4D5C81C1C00DB1DE130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

16319a27-5641-453c-a62e-5e5e7de160d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16319a27-5641-453c-a62e-5e5e7de160d9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2ac24e1c-0b44-480f-be46-cbcd5d8b67f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ac24e1c-0b44-480f-be46-cbcd5d8b67f0.tmp
Size 12KB
SHA256 5de08f9d9b8f6b7d7f565d0f7694a137f2130a4086df5c43d6fa64f4677c0716
MD5 9c65fe2946ea873b1ac9f51fb4752d19
SHA1 979ef28de6e09f75c0e6d6c4824711e913f43170
SHA512 527bae7965943108a611a58b2858c9d380e16d6bb78751c336606f1ee0b4ae1c6a1725f84ae91b8dcf76ca9ac4786d15878aac003088538fe8ba14a3371d364e
SSDEEP 192:sxZIYRdkB/fmsRQZL38DzodpuFiHW6+WNJ4W0//YoZEpK6SyFsIg5+tV1J:sxZlYB/fmsROIYRHbCV//nStSwwEtR
TLSH
T18E42E9556D38AA3B8CC7D219BA55BF63E3F95033A0811F44AAFC8A1C15E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 555fa3a6ec3c8b38d06afcadbb44a7c665c845bc4064c4df316b2f9515e3e19d
MD5 235457feb86c23d6bbe35f23ea7fdad1
SHA1 a1105fbdb22e788e3982de2fe3864b54fcd7a4b8
SHA512 d524534218ea8a3e9aedb2dc36d2f3ecbcc306c8aa5a1a2b6033ff2361c012b87566adbdd024280b112e1a31c3edabd863d48aae4dd0f63028deacab06c63d9f
TLSH
T14DE026A804C8C36EE30874C701BD638F8B8C269BD3C8B90F1740C7857006660B687AA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8a744ffb9763b7f365bf62f8f11476eccbb6b58c7803dbc3765ee9e39b7239f5
MD5 c62fca3213c6bdcf4db367730334de2f
SHA1 328d3e7a7f18597a0750e9f5ad761fb2b5f353a4
SHA512 1acd76e5d7aace2c4d71a3e5c46c8700b2eb2fac0b5ab7b16fad9915a40b41fa3b52c8e116b80fdf0b83dba6007a2f6ebce1c790c16e49bd3d5cebb476e97d3b
TLSH
T15061B549CCA0C5A7FF9ECD7095D81887BABE4E83A5C3EE12045EE4B4AE67714650C154
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fd31406f353a3d73b4056a1e8fdd775b9baa2170059827c97d862075339d0564
MD5 fa86048ad4dc8be13b8ac15b98f8ba7f
SHA1 13ff4b32ead94856e67308e1edf86390c12b4da9
SHA512 19568c3220fd2bd12e43b208b4af9dabd52eafcdef068ab2471ac34a7385ac1180a66372ef73ad48b05c324eab54c4c37e75aca8ca8007e572576092613868bb
TLSH
T13161C649CCA0C5A7FF9ECD3095D81887BABE4D83A5C3EE12049ED4B4EE67710690C154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1dd56671302d39aff18e1035f97cf349c5b46d2ded421c324e50ed2f62bf305d
MD5 a449433a80b7dc7411e2c7599728ac01
SHA1 fd5ff85a1455e410e99fac822f8a51dfcdd32f30
SHA512 0d3b8fa77531ba9924dbe2325a0b609b5a5939569904a43597098653e67b9b7ae659d8d2c8fb48df4e4de06b33ac9e612406cbb5c03dadda8760610940c05889
TLSH
T16561B689CCA0C1A7FF9ECC7099D81C87BABE4D87A5C3EE4204AED4B4AE67350590C154
MD5 SHA1 SHA512 TLSH

Submit Download

1a64ab67-21b5-40dd-86f6-9c61ed3866c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1a64ab67-21b5-40dd-86f6-9c61ed3866c7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1610ccb9-f883-42cd-9d97-7acddd5ddad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1610ccb9-f883-42cd-9d97-7acddd5ddad3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8a72d32f-f1cf-4d44-a478-462592e92a14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a72d32f-f1cf-4d44-a478-462592e92a14.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a0a7c020-5d26-4859-bc15-7dbfa110b5c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0a7c020-5d26-4859-bc15-7dbfa110b5c9.tmp
Size 3KB
SHA256 7d18292d6709d38e6528e79d17cb904c49f1fd71967b39347459aded65f9a452
MD5 9179ee907b79e45d9b89f4e1623ba970
SHA1 b0cb8fc008bfaec12e5d7aff2fdc8b3a43f8bca3
SHA512 5d4b1be1564560288f3a8bee5051871a585cf4f9a11d00ebe87c15d4047203471f3fb758c4336ea079ac6b2561ff5b5adcb86260584910e630c36d7edac4e5e1
TLSH
T14761DEE6C6E4975DD81152F4AA15BE2BCF2E0918432C3D1AC5E4DF1FA7E2070D14168F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d1cef067773544064b938608168aeb88a8755cc9ecb69af9208e6fe31d478ab6
MD5 716d3377788d08987f1b2ae4634bf6b3
SHA1 dfb5269d2531997240d43947dc0b1b6239fb18a2
SHA512 ef5352abd5fce08f68434ec9f3f1aa233915a889a8539552262d92c9ff691702b13245d5010bf94d57decc55bfdb25814b13ef77b6b9f6088bb1a06f044bc174
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgr:ST/2dXOJhJlpfnpp3tNXVrN3S9Dc
TLSH
T179B2211571BB021039FE391891B5972E168231B33119E66B7FBD44B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

b7a35611-b7a6-4d1b-b900-87ba2b62ae06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7a35611-b7a6-4d1b-b900-87ba2b62ae06.tmp
Size 12KB
SHA256 ca7bfef0b2c6b443f6b95f8dedf993d794b6a2a3ced4c0de5ccde52967e03fed
MD5 8396a23a7c5c920d6e81de1b10595581
SHA1 2957e310835026b96ad2945911afc2337347459f
SHA512 112bf6addd57d4f550e0544bffbfeca6c6924d7c66ec8b2bd074e670dbd2cb383d6aee06472dcee58ea1a02d9ffeda1612368a0f36b3b08d660ecc9d736f6e7f
SSDEEP 192:sxZIYRdkB/fmsaaQZLi8DzodpuxcHW6+WNJ4W0//YoZupKCSyFsIg5+tV1J:sxZlYB/fmsDONYzHbCV//nIZSwwEtR
TLSH
T15042E9566D28AA3B8CC7D219FA557F63E3F95032A1811F44AAFC8A1C15E7ACD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9baae1c-78c0-4e7d-bff8-e25f46f04776.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9baae1c-78c0-4e7d-bff8-e25f46f04776.tmp
Size 12KB
SHA256 174dfd5ce0fcb5e92ee388a3b0742bd7052d24b5b4a0ed703b4b3399e8a0b3fa
MD5 5345372093da9bf755cef04974effc7b
SHA1 406c296fd9b0deaad8ffde99975dd055cb87f701
SHA512 8257aa7e77a2d75d0ff39e5fcc40761838b84987d1d773cfedfae25738445e9f5e9ccb7907781d2c5973793bcc1e1c87d96294ecba2ace41245f1226987d807a
SSDEEP 192:sxZIYRdkB/fmsRQZLi8DzodpuxcHW6+WNJ4W0//YoZEpKCSyFsIg5+tV1J:sxZlYB/fmsRONYzHbCV//nSZSwwEtR
TLSH
T12842EA556D38AA3B8CC7D219FA557F63E3F95032A0911F44AAFC8A1C15E7ACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d18ffa86-98f2-4af4-9429-219e035b86bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d18ffa86-98f2-4af4-9429-219e035b86bb.tmp
Size 414B
SHA256 5788b5931249a2b1e5ea6a3adc9f23ad0d0ccd9bb214e46a64661a1407d34362
MD5 67eb1ef5a829d82bd580ae5da0c0ca30
SHA1 b19523623316f52da20b35e106652e76e4418a72
SHA512 3ba2740b2634d7cfb0621819138ba50307f07c54f4090e96ddd39bd088ebdd37274a0bfb0bd56d4349f3771ec3b893bfa7c2ad53bb0001d9c7f16e33031af71d
TLSH
T15CE02BAAC915EC3B08FD4B7860980646E70013272A40985B3B3D900C8FB4577518586C
MD5 SHA1 SHA512 TLSH

Submit Download

eee785ee-55b8-4a60-a47a-fbe14014a15b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eee785ee-55b8-4a60-a47a-fbe14014a15b.tmp
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6421e90-5163-4be9-845a-8d05bcdda739.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6421e90-5163-4be9-845a-8d05bcdda739.tmp
Size 12KB
SHA256 65640c8aed642f03b84430175caac3cedeb3d9782a818655cc4d6f3ac8f3861f
MD5 28b03fb8c1b320f22afa9b875ed93963
SHA1 c05829b89f1458af06cdc9f555a4e59661f12f7f
SHA512 766596e636ca55ba9e2c34fdd0be610eafc434558f7aca257e8c86fb6419228711a720b8d78d18814c673d43291c09b305328ef336cbf30483abfbbea6d648b4
SSDEEP 192:sxZIYRdkB/fms4aQZLi8DzodpuxcHW6+WNJ4W0//YoZupKCSyFsIgjtV1J:sxZlYB/fmsxONYzHbCV//nIZSwwjtR
TLSH
T1C942EA566D28AA3F8CC7D209FA557F63E3F95032A5811F44AAFC8A1C15E7ACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef3c26fb-fecd-41e0-8814-8f5569038984.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef3c26fb-fecd-41e0-8814-8f5569038984.tmp
Size 26KB
SHA256 c87eff7ac829a1e46396cd0719f6b80f6e08721b78bfed901dd7f83c598e250d
MD5 44759750ace4638ef6215df07d01dced
SHA1 3d43d4251687b9dbfb7eaa0994d0eb9c68d09c16
SHA512 7a009408b19a54c3689049a6f3379944658d4d94a827a3b6a2caec0c1aa60dc1f1a82800fc043c0c1b22a8f8a564524b3252536df75b5a650673dfc50222acfa
SSDEEP 384:n7iFzQkUSvl3sNa8TUNTUlI4lMaKMXaxwzWfLBCW/Cv5wJuOji0wogL/7IztIIly:WFdl3vwgq4EEBC2ChIhi0wGLw
TLSH
T1B7C23B32E898DDBBEDE65E95B25E3643DEE09253D98C5AD4D5C81C1C00DB1DE130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4bab0b3-3ff7-4511-93e0-9518742960e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4bab0b3-3ff7-4511-93e0-9518742960e5.tmp
Size 26KB
SHA256 a25731b099bb86a532f742faecd9672e6bcd32049520bfe71bb5ebd3988acb2e
MD5 b4ccf25b7d5e3be8b1f8cb30b4d15695
SHA1 a4f46f78276c7910ca1c16617fae6c27ac4e759e
SHA512 21a098606233bcba1b19d2032e3d4f43c1d5b7a55b417d40a0284f02e80b3551d593ca8008b212d2debf540800effb8f58bbe9cbab04530d4856baaa3ce3f1c7
SSDEEP 384:nziFiZcI63sNG8TUNTUlIm2aKM3SywzWfLBCW/Cv5wJuOli07O6R2Feo2bgL/7IQ:eFQ63/wgckZEBC2ChILi07TRDsJ
TLSH
T1AAC24C32E894C9BBECEA5FE9A64A7603DEF04163D98C9AD0D5C81D1C00DB5DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b2d7962f2c5d933609834fac9e0a5b25c75b201963063eca21016bdc418778eb
MD5 ce05cf3dbb535eda65dcbb5aa228e918
SHA1 86dac763e2af0489320bb18a39e82aab14e63486
SHA512 b8e4f4de80ea828ea650ea09293ae9d67bcef6439e2fbc557ec34ed60684b19edecbe3d34551b4c778665ff28fd3fb787f9cbef70785bf58a48718f537391616
TLSH
T1E5412759B6FA1108B3B7AF569BF6986D487FB8772E0AD45D00010E4F0A23B41D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3644-214-0x00000220042E0000-0x00000220052E0000-memory.dmp

Download