34ac9dda76861ed609033c0e9af1d650644c0f9d643c1e2ae9f918bda16fcc5e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 24KB
Sample261023-hee1bsas2x
SHA256 34ac9dda76861ed609033c0e9af1d650644c0f9d643c1e2ae9f918bda16fcc5e
MD5 79cf508354dd9148bb96d5a5ba17d340
SHA1 37a401ebc9765da62cc21e9b557ceea58644c0ec
SHA512 4eeb72a0e9c57bbc5abe0a3ab1c5ca3bb7211c76b1ade8861b215b09a8eb00c35a357d83bbe196535081bb9c80772778520153c34fb2fef8db644d31e9c15167
SSDEEP 768:9UoxH8KWjh6GjWm6JlRH4Dny2tPfSrzqz2X51a+ahbIp+b0Ot:+oxH8KGvjWm6Jd2tPfSrzqz2X51a+ahB
TLSH
T15AB2DC529DE000B70C4E8A90EB2DA70EDFE1D50BEE66C65871FC27821F92EC9C85754E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3820	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{82930DC6-55C1-46B7-BE55-7E454E50ECA1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2480	4708	msedge.exe	84
PID 4708 wrote to memory of 4040	4708	msedge.exe	85
PID 4708 wrote to memory of 3820	4708	msedge.exe	86
PID 4708 wrote to memory of 4040	4708	msedge.exe	85
PID 4708 wrote to memory of 4040	4708	msedge.exe	85
PID 4708 wrote to memory of 996	4708	msedge.exe	87
PID 4708 wrote to memory of 996	4708	msedge.exe	87
PID 4708 wrote to memory of 548	4708	msedge.exe	88
PID 4708 wrote to memory of 548	4708	msedge.exe	88
PID 4708 wrote to memory of 548	4708	msedge.exe	88
PID 4708 wrote to memory of 4256	4708	msedge.exe	89
PID 4708 wrote to memory of 4256	4708	msedge.exe	89
PID 4708 wrote to memory of 4256	4708	msedge.exe	89
PID 4708 wrote to memory of 536	4708	msedge.exe	91
PID 4708 wrote to memory of 1908	4708	msedge.exe	92
PID 4708 wrote to memory of 536	4708	msedge.exe	91
PID 4708 wrote to memory of 536	4708	msedge.exe	91
PID 4708 wrote to memory of 1908	4708	msedge.exe	92
PID 4708 wrote to memory of 1908	4708	msedge.exe	92
PID 4708 wrote to memory of 8	4708	msedge.exe	93
PID 4708 wrote to memory of 8	4708	msedge.exe	93
PID 4708 wrote to memory of 8	4708	msedge.exe	93
PID 4708 wrote to memory of 1356	4708	msedge.exe	97
PID 4708 wrote to memory of 1356	4708	msedge.exe	97
PID 4708 wrote to memory of 1356	4708	msedge.exe	97
PID 4708 wrote to memory of 380	4708	msedge.exe	98
PID 4708 wrote to memory of 380	4708	msedge.exe	98
PID 4708 wrote to memory of 380	4708	msedge.exe	98
PID 4708 wrote to memory of 2088	4708	msedge.exe	99
PID 4708 wrote to memory of 1848	4708	msedge.exe	100
PID 4708 wrote to memory of 2088	4708	msedge.exe	99
PID 4708 wrote to memory of 1848	4708	msedge.exe	100
PID 4708 wrote to memory of 1300	4708	msedge.exe	102
PID 4708 wrote to memory of 4664	4708	msedge.exe	111
PID 4708 wrote to memory of 3028	4708	msedge.exe	112
PID 4708 wrote to memory of 4704	4708	msedge.exe	113
PID 4708 wrote to memory of 3768	4708	msedge.exe	115
PID 4708 wrote to memory of 3768	4708	msedge.exe	115
PID 4708 wrote to memory of 3316	4708	msedge.exe	116
PID 4708 wrote to memory of 3316	4708	msedge.exe	116
PID 4708 wrote to memory of 3296	4708	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff85b01c188,0x7ff85b01c194,0x7ff85b01c1a0
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,2238775584739658014,2534743654447176492,262144 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4465449151899555843,7531431461138695156,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,9891870281466380015,14690792236076023037,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2963255468896861263,6860089622112550596,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15206258709609888061,10325760380702790914,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,14064509332164473226,13050379848088434466,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,14212632370791639707,5406170050185942245,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,3143144695507916773,1471199060513096357,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5236,i,10725663762161102299,4659545532676468712,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5356,i,16551290439622978827,10175735163113605846,2097152 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,3160520994452509653,794944006174366792,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8550582029313861031,18036085465049760848,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2380440060732349538,3885977204451101772,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2380440060732349538,3885977204451101772,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,2105809636857693241,8455783852734559000,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,9972884047829391330,2413778680713586776,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,13476823311840542884,11350786756802889324,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,6151852903871854813,3381016972855048546,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,11566083278932658327,8981455386716698095,524288 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4768,i,9933748190624473719,13517370166753161282,262144 --field-trial-handle=2240,i,6406052707454553152,5797098209355780224,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

169e83d9-7771-4325-af03-fed5bb542485.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\169e83d9-7771-4325-af03-fed5bb542485.tmp
Size 18KB
SHA256 cacc90e5ed3e42ab2d43c2b1b75613c2e0fdbec72d8cf5d4ae7e81998fbdb480
MD5 c7d47bbeb985e1e711534518819a259e
SHA1 c48cd6a1040c86817f16d3b734ff6a516006e352
SHA512 f5b2c90d40433732b6867357d07b1f139a777ca6db4ec39e8079ef7de765c5249dd20e3061cecc7153f8287bb531dfea546e1edbfffdf98e81cdc883b29abef5
SSDEEP 384:oQkUSv0sNk3B4bTlR9h//S3712ImMtUnIIln:g0yRj/I15DUnL5
TLSH
T100827E36A8B57C3789B7E180F54A3A139EB48167D7D41F94D6DDBB1C01CB2AC230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27de2b28-d735-4f23-a581-4e5db95f0c1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27de2b28-d735-4f23-a581-4e5db95f0c1f.tmp
Size 18KB
SHA256 1c1cd5f7d34df6da86c6b0b04db53753822d42e521f424c966219f9b2ca85040
MD5 26cab5b4cb5947dd8ed2188e58ebb252
SHA1 91628cdf320d32cdac4d0e04bf01d7c5a65c2d05
SHA512 36ac4b09a7c041963892f4de413be5cad53c55c6cd3016f60ca3264008a1643f405ed3ba59f3821b05e4eba174b932c95a25a19808166ca65b2ff0ce8dc4840d
SSDEEP 384:rQkUSv0sNkEB4bTlR9h//S3712ImMtUnIIln:l07Rj/I15DUnL5
TLSH
T1CB827D36A8B57C378AB7D180F54A3A139EB48167D7D41F94D6DD7B1C02CB1AC230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92b5a23b-1b7f-4fb4-95c7-7dc126746c55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\92b5a23b-1b7f-4fb4-95c7-7dc126746c55.tmp
Size 21KB
SHA256 d9908c73d6a5ce72deb09fb9e220a780a544055ce80e64058510fb7de92e994b
MD5 2541c4605d4a6047d7d09dd51984bde1
SHA1 74cb0674029c5a66e09b157887c17dcc13f6f301
SHA512 c0a2f6b12d3cb28e3b7e2e1e933e30e1edce8c3569e9ee01de94b9c942a1445626c4462271bea5bfd5585c5894c5d52ad2aa8f8bcd4374ad2ec18fcaaab3a6ef
SSDEEP 384:2iFzQkUSvszsNs8TUNTUlIl3B4bTlR9h//S3h12ImMtUnIIln:dFdQVwgwRj/Y15DUnL5
TLSH
T19EA25B3798E4A97B9EB79A80F54A3613CEB04167CAE56F90E7CDAA1C01CB1DC134BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

1c71e2aa-8203-4aab-8a82-9ce88a1a65db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c71e2aa-8203-4aab-8a82-9ce88a1a65db.tmp
Size 9KB
SHA256 061e4c739afc209d76b4dea0086d75a347f0c67f981aa42d1a6175031908156a
MD5 a8fd07af0e5292c145d8047f94c9b4e1
SHA1 8fe0e5ca6045cf9bb13d3a211d6a83e4c2e2bc3d
SHA512 e2b4a5ef00d003036cde4f584ef54f45b608464fde042fcce4ad3cd7d1c0745cf88d76660e68c13026d8644009dcea8be51b0308be652641e4632d0c648bb40d
SSDEEP 192:sxZu7RWW8L/f94sBQq4sIdpdlHW6+WNGY36WswrIgrJ:sxZ0vk/fasBQr3HbGX29
TLSH
T1ED22A8116E78A93B4CC7D20DBA15BF53E6FA503291D51E58E6FCC51C05E6ADD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20fceba3-6023-43d1-a3b1-990777d65843.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20fceba3-6023-43d1-a3b1-990777d65843.tmp
Size 10KB
SHA256 2efa5931cd96cf716ecb5e0bfd0de97b373bfa82207c121fb02cf438509c63b4
MD5 6dfe72460c7f27c45ba2b7936f6d3626
SHA1 a6d9efdff8498fb88bb82ab680b06c7466438d1f
SHA512 0f1b499386bada151937b2ad2656e1e2fcb6dc2bd6b436dfde04f1a0c24c37f2e55a89de34b0f4cbd348d489e49c956db8613aa83fb17cbffdacf4c09a811473
SSDEEP 192:sxZu7RWW8L/f94sPQq4sIdpdlHW6+WNGY36WOwrIg5NJ:sxZ0vk/fasPQr3HbGXCt
TLSH
T11222B7116E78697B8CC7E209BA15BF53E6FA503291D11E58A6FCC61C05E7BDD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e8a2f96-d037-4b34-9f53-b07fbe5f5f61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e8a2f96-d037-4b34-9f53-b07fbe5f5f61.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f179c8-1ebc-414b-b23d-7485a359d316.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95f179c8-1ebc-414b-b23d-7485a359d316.tmp
Size 10KB
SHA256 e4b7bf3478d504c6138a9c3dc8999bd6dd9e2f4d237b45f137ca10b881e233c6
MD5 a8ecd21eb6d67dc4f3ffd61a78963eb5
SHA1 1feabb32fc81b19ca1ee9e624755d65b44e55943
SHA512 b945e260a48609c7e76f1ee97727a3650886da873a7181d001a6c1fa63740d5d3644b20091fe33b963a52d585e5e475d01e069738875fe12bce020318c6b496b
SSDEEP 192:sxZu7RWW8L/f94s5Qq4sIdpdlHW6+WNGY36WswrIg5vJ:sxZ0vk/fas5Qr3HbGX2r
TLSH
T14C22B8116E78A97B8CC7D20DBA15BF53E6FA503291D11E58E6FC861C05E6BDD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dcefdcee4ac86ac3470c3e008d11863107065188e075dd561eca03d7da47dfce
MD5 8919ecc325e681abcb1bbb94971077df
SHA1 4eb753e092e350c3bda1da6580e96759a4ef2d62
SHA512 f5a4f2922d936e197feaaf3827b15ddfda39117142ed5b8cc176a3440dc28ea7513cafd1dc8ced68cf55e82d21db13f3dccf0c6ac855c6105ce20ac82828fb1d
TLSH
T151E0268424C8C23FB34C754B8AAD438CC380371BDAC0BD2E270CCE897046941A2B2AD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 1c16236b6dbe071426fef2abc0bcd8aae9e2ac131205f0aad7573726edf4ea26
MD5 8d4889da8d7573444b5e2d8557a1167d
SHA1 936048ffea8992c4551524d98ab47d7525f999dd
SHA512 4a73f3c293669195a5fa2c0b59ebc920d81970b7daedb3c0f7c382a46302e75fdfa39ece2dc9ebf8c2b421f7574a5ac95cd803304dab50171757542195af6594
TLSH
T1F85187C19AE407E1FFAC90F549C4258B36396CB25A432E3239D7CEBAE74A759707C484
MD5 SHA1 SHA512 TLSH

Submit Download

c057d6bf-6413-480f-aa08-3d9a32dba9ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c057d6bf-6413-480f-aa08-3d9a32dba9ab.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1d71aed2-3017-4051-b07e-72f3a81da8fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d71aed2-3017-4051-b07e-72f3a81da8fc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

78ac99d2-8f01-4262-8e63-c49b8bac7141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\78ac99d2-8f01-4262-8e63-c49b8bac7141.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d6daa253-fa71-4233-a4e3-f968a3c592f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6daa253-fa71-4233-a4e3-f968a3c592f7.tmp
Size 3KB
SHA256 6b7e6eaeec95c6d2f93df733193120147518498716d841a5cc6a2c2b7428adc4
MD5 76b5083ee3b0fa9ac43d40bb0d236b87
SHA1 6280429ab4f22dfa2c390878f521f55e6ab140e0
SHA512 dbda3921c71665ba829120c8164635a9bf2ceba21ab2560ab2301522778c1ecc93ce96c2bfd17670edc4f411c0df0a0e0018d9ec42d112274ee70b091933ba45
TLSH
T1B151AAB6C7E887BE891156F05B246E2ACD1D051B422C3C628EF9AF4F63F25B1D10219F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8b4438d44cf92eefeec303ccb6e1a16852d7526879a1db2f715adbd55fc1036c
MD5 722bceeed0a884052b1e6ffc934ca866
SHA1 4f1c63bcf53f9397b76014a5696b08bdc536d998
SHA512 52f65915413d79c0b8db16cdfdcbb50e35ad82ce4be58725338a465ec7a77e20d83c29229f2ef0ef490fd718748f76c8c769a83be13943f95edeb90ca43d6683
SSDEEP 96:KUuQKTS2OJWKK0reVA8ewA5PsXUlU5KNQlu5xGuPkAKBVSbXtjG:eDBEeVA8ewA5sXwUaQlufGuPkAKt
TLSH
T1B491330275B7121238BF66484276CA6B42553576341CFD3BBBAC40B2CDAEE051CFE9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b813ea68-6122-4cf4-9d2f-5df532eb63be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b813ea68-6122-4cf4-9d2f-5df532eb63be.tmp
Size 27KB
SHA256 1603ba68bbaac0f38a1f064cb1783732c4525d0a04782b0a4a58baa6a9beb0f3
MD5 7ea729d730ddf9d5a25eedcd9271bf00
SHA1 874cef2e3f3b6d0f5a272ff184386de8535ceeee
SHA512 e767b6a738d87f89fbc16a73465af51c2d81367889b3901d52af70bd47d939dde6a6f1a8342d16916ade8aa0c1352ba2c6a87f4be446527a303987bf95a48515
SSDEEP 768:JpKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/OroFR:JpKlm7QWvUYm0u1ja8/L/E/FFR
TLSH
T1B6C2FB3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cac35b0e-ec73-4673-b94e-1a6ae8f5c54f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cac35b0e-ec73-4673-b94e-1a6ae8f5c54f.tmp
Size 10KB
SHA256 5421340943357bf04676524dd20c23c89a193f0f34a49fdd84ec61e12ad85a25
MD5 c168ef7b5338e6bfcd0ab14e91bd63f8
SHA1 eef265691e7b806a26e026dcee84091e87c313c4
SHA512 a479cff0cc5ed28643b085f4daa04dd4e83108b9bb82fa181d8610664473ea9173d245975b16373c774dc178dca2db908f9f8a6c21065000346d9d02722ff8dd
SSDEEP 192:sxZu7RWW8L/f94sPQq4sIdpHlHW6+WNGY36MRGrIg5NJ:sxZ0vk/fasPQrFHbGXtt
TLSH
T1D622C8516E78697B8CC7E20DBA15BF53E6FA503291911E48A6FCC61C05E7BDD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c76fd403-dfb2-4f7c-b756-997ed280308b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c76fd403-dfb2-4f7c-b756-997ed280308b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b779e792-cc4f-49ab-84c2-fd6e735e8612.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b779e792-cc4f-49ab-84c2-fd6e735e8612.tmp
Size 8KB
SHA256 a4eea8f73023977a6b7ead362a07b1d2da1df413d850342846330f81bd47eca9
MD5 6e3104c665efa7abcfa11c730556ee91
SHA1 41cd47d59ccdf32ace9a15e2d04a1149113ad145
SHA512 84af2a16d94e72667468a5dab4f18764f171ed9015533f7cb003483f6596e62db02accf38d372f96fdff1e476967082ef7f310ad8251dc562b9aced4dd5c0fbd
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop5/aD3BKP4v+Y1xf//ojdDxv3ywlBC2:BONy6JUm0QmiUyUxso//2ywlBCYNU6
TLSH
T16E02F938BC687C7B9EF3AE85B48777239FA5106BA9902F84DAD81E1D01D725C1307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddb3fd01-84c5-43a7-b67c-22d81ed920d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ddb3fd01-84c5-43a7-b67c-22d81ed920d5.tmp
Size 8KB
SHA256 e0a1db1439cfd2da6b9a4dd9759c1544d841e02231646e085fc7c32cded14dd8
MD5 dd459d619adb08ac0efe8d27f7cc17c9
SHA1 5d0ee9d2bfc93464cbb5ed59396ee8efb45e5d1e
SHA512 cf74aa2aa11270a470fa9ce5bf36c811a71f80fc65684dc2fbd77270ba55fa3236f63961d0606970d6b3e1ea4016e37db97470f674fd948db193e9a138eaa512
SSDEEP 96:HqONkNQsjpfbUvH5ih/cIPURHl8h4otop5/fD3B5P4v+Y1xf//ojdDxv3ywxxPLd:KONd6JU4QmiUyjxRo//2yw3FNxTqvmU6
TLSH
T1D0121A35B8B8BC3B5DE39580B48736139EA44127EB896F80D6ED1E1C02DB2AC530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24a42189-ba63-478a-a355-7b91743dbba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\24a42189-ba63-478a-a355-7b91743dbba4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cf80aef6c0a89bc312185d6719888aaa3f36169d2c8b02f8185ea6853951932d
MD5 db4d32b080f6a2101ecdadb5a7d0195f
SHA1 a2b0c6bf33bee37fc40aa3682481543048c94b05
SHA512 771557fbaf801fad7db62d2f4f3537f2cbc0d6e417a26e5a8cb7aae3acc4d3227f30572e43033a21e7ac47386a01e6e84a66f0a4f84e64651ac0a7ea024d54ff
TLSH
T14F410B58A6FD2108B3B66F5A9BF6A46E487E7D372E06C45D40020E4F0A67B41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download