hxxp://newyroklife[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://newyroklife.com
Sample260809-dbtxvssxev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307174390596765"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{659F5041-7C4A-4FF9-AAEC-ED643D8052C7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 988	2960	msedge.exe	85
PID 2960 wrote to memory of 4416	2960	msedge.exe	86
PID 2960 wrote to memory of 1424	2960	msedge.exe	87
PID 2960 wrote to memory of 1424	2960	msedge.exe	87
PID 2960 wrote to memory of 1424	2960	msedge.exe	87
PID 2960 wrote to memory of 4876	2960	msedge.exe	88
PID 2960 wrote to memory of 4876	2960	msedge.exe	88
PID 2960 wrote to memory of 4660	2960	msedge.exe	89
PID 2960 wrote to memory of 4660	2960	msedge.exe	89
PID 2960 wrote to memory of 4660	2960	msedge.exe	89
PID 2960 wrote to memory of 5068	2960	msedge.exe	90
PID 2960 wrote to memory of 5068	2960	msedge.exe	90
PID 2960 wrote to memory of 5068	2960	msedge.exe	90
PID 2960 wrote to memory of 2060	2960	msedge.exe	91
PID 2960 wrote to memory of 2060	2960	msedge.exe	91
PID 2960 wrote to memory of 2060	2960	msedge.exe	91
PID 2960 wrote to memory of 3864	2960	msedge.exe	92
PID 2960 wrote to memory of 3864	2960	msedge.exe	92
PID 2960 wrote to memory of 3864	2960	msedge.exe	92
PID 2960 wrote to memory of 600	2960	msedge.exe	97
PID 2960 wrote to memory of 600	2960	msedge.exe	97
PID 2960 wrote to memory of 600	2960	msedge.exe	97
PID 2960 wrote to memory of 4456	2960	msedge.exe	98
PID 2960 wrote to memory of 4456	2960	msedge.exe	98
PID 2960 wrote to memory of 5048	2960	msedge.exe	99
PID 2960 wrote to memory of 5048	2960	msedge.exe	99
PID 2960 wrote to memory of 2392	2960	msedge.exe	101
PID 2960 wrote to memory of 4504	2960	msedge.exe	102
PID 2960 wrote to memory of 4504	2960	msedge.exe	102
PID 2960 wrote to memory of 4504	2960	msedge.exe	102
PID 2960 wrote to memory of 4688	2960	msedge.exe	108
PID 2960 wrote to memory of 4688	2960	msedge.exe	108
PID 2960 wrote to memory of 4688	2960	msedge.exe	108
PID 2960 wrote to memory of 3992	2960	msedge.exe	109
PID 2960 wrote to memory of 3992	2960	msedge.exe	109
PID 2960 wrote to memory of 3992	2960	msedge.exe	109
PID 2960 wrote to memory of 1804	2960	msedge.exe	110
PID 2960 wrote to memory of 1804	2960	msedge.exe	110
PID 2960 wrote to memory of 1804	2960	msedge.exe	110
PID 2960 wrote to memory of 2884	2960	msedge.exe	113
PID 2960 wrote to memory of 4344	2960	msedge.exe	114
PID 2960 wrote to memory of 5044	2960	msedge.exe	115
PID 2960 wrote to memory of 3172	2960	msedge.exe	119
PID 2960 wrote to memory of 3172	2960	msedge.exe	119
PID 2960 wrote to memory of 2216	2960	msedge.exe	127
PID 2960 wrote to memory of 2216	2960	msedge.exe	127
PID 2960 wrote to memory of 4092	2960	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://newyroklife.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a0
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,211190069469382815,9059125602571985434,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12045364640869649209,8687593064324994642,262144 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2060384799354346084,16780278851581259697,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3143044288889943170,16242358470842805555,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12722849748441546181,15570434625170671760,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3627273725993511937,14251541873575205571,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1795546779348610084,10010424040388581092,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4888,i,915560148378655734,1589317378107163380,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,11915387295081685314,6463947900264196289,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,11006232890055326799,15689696509552057471,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5477011103028570857,5662092574633527846,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5477011103028570857,5662092574633527846,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6184,i,6812352475775177437,9577261412156292634,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6252,i,16289417113735096521,13485353345215670608,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3444,i,17701594217571756818,12384908592789464406,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4816,i,10251312722720516460,4059943105987818432,2097152 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17775023338663117448,13859313302021112161,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10283715251339391713,2623259571765740436,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15478677198704209450,9868601716067499126,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,7738299541467625252,9390249773600685767,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,9480462930535168142,16283761682042991765,524288 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,5092609106855546023,10656418185886642889,262144 --field-trial-handle=2144,i,1577865221073478236,17942254593271196596,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a17f6071cb2e02887d74e9d06cfac09c2b2d25921c4bf687bb9ab20aa38b04e4
MD5 4e777e516b7af58e27af6b15d9b9597c
SHA1 b81fb9a30ae0f6c7e15d7cd93d4542641ae19b2f
SHA512 17c83e548a61c733f53b2f8d34a568d5f356b3aac4b3b801fcc241823e0a54f271d852c92291ee6093dc6c58a323a1f1e42921c2b9336e1e332b9ddab29a97d6
TLSH
T1C6713C16835EA053D79A1732C0DD0B023572A5FD5A5BBF1A0580B47F6133BD2D7A901D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6d2e93be7825958012251ac2b18b8d5c99d576cccfaaf7afa623c4fc3e0f386
MD5 04ccc4e4111a7890bd38fd0720dbb95b
SHA1 0f88e71bce7a813016758f806f9520cbcf62f4b1
SHA512 fd414cc7bb47429c09ec6b9149b9ad5d5f68f599f9edcde8d27f46d91903670a01517f435e615409ebf5ace6d9869a8b37786deb5438e0630d11b9cbcadfb641
TLSH
T13561281A8369A013D79E1731C0DD0B0235B2B5FD495BBF2A0A80B07FA537BA1D7AD04C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2b4c25248c8a889586d39cec1433c8ac54f09008136f7f54970475d099bb33de
MD5 d25228f076064e0aa83c2ccd144f7bcf
SHA1 9075a9d24431259b604b62dcc1e52ec4e89cb1f5
SHA512 30c6c6866307f9091985987d5c2315b20694ef0f5b27161022422afcb2cadf804f0fa1b1d387176858c435baf8d2e28432ef2cb2b26a069d85428509e6444400
TLSH
T1A6219CF3C3E4896E890516F0AB28AE2BCE2D0905421C7C1ACAD4EF5B93E3465E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 31d31de5d1b7db04d6d1913f6fe5d323825a57b6866f0c690d048f6d0d8e3e2a
MD5 d3d77b9b3313a525e0f3673457aeabb7
SHA1 20a1bf58d864272f764c23f4a66ff091417311e6
SHA512 dfa54d2dd6d69068104e52d218ba481d0e8344c444e357a50a606ef0a00ccf18ee3ccee8693eecc40a39b2bc5257d25516c8c2ba72e3e30b037d09ec04928997
SSDEEP 192:sxZGR2yM/jK1Ml8Mkd/fAse/nXIdpJMHCa6+WNe6J/YwqzBQNIgrJ:sxZGYMd/fAsef4KHih/T9
TLSH
T1DF52F9056A34A97BCCDFD209FA45BF53D6F5157292900E44A9FCDA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 973d6eb3fc24803bc3316d2a6a0895be74e995d4d09969550de8086d19f2fc6d
MD5 b74c92155d9976b03cce515c8f1a52c5
SHA1 ea769ca340a98949fc6af4b4a30c12b66aa119fb
SHA512 8cffb4630689abb1a9b5be43cd70b3d18ff3b1eceaf1796e06cc3705b7d4a755a2b73845de72b5b4f9bc54e470bc9654bc36ac02b78d128189d1a1160f43d007
SSDEEP 192:sxZGR2yM/jK1Ml8Mkd/fAsi/xXIdpTvkHW6+WNe6J/Ywgfzi/NIg5pJ:sxZG4Md/fAsi54AHbh/WaJ
TLSH
T11252F8466A34A977CCDFD209BA41BF53D6F5107291900E48AAFCDA0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3666d30ed40aeface87822be3ea39790c0407e02e90c03f9264f81931bf7d10e
MD5 d23a5937db97c4997656dbb33dc7e112
SHA1 5db7d0135b49204dc0ec0866fd9826af30c0c8cf
SHA512 e863bb3e447cc046f40845675ee1b13cc9691a47bd1caa81a9d363b240c7e368968d9f7a887f0d270ff1d1ae81b1ee6a434570ff67b686431b6dc7f54cfbbfb6
SSDEEP 192:sxZGR2yM/jK1Ml8UQUkd/fAsi/xXIdpTvkHW6+WNe6J/Ywgfzi/NIg5pJ:sxZG4qvd/fAsi54AHbh/WaJ
TLSH
T13A5208556A34A977CCDBD209FA41BF63D6F5147291900E48A9FCDA0C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 36b20d301025cad2b04ba6cce188204db0658939db14f1bb3b70ed8148e66bda
MD5 ce924739bc3216af5566423425984f44
SHA1 4c3bea1bb9a15d813607167d36d14f70831beaaf
SHA512 229f707054f977b499188aebd3efcc4db94c3359ecf49f0cdd1be906ad36565ea6ba78f8e34c11fdce124f8084dbdf99249e98d02898b1a62d7243f7ed30b154
SSDEEP 768:kZ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+drrohJscRa5:kZ4jeXmWvmKLEu1jacPLZQdYHs
TLSH
T1F8D2F93B280CCB7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8b1076864006f87eb1a176a5193a3560076bdaeabfec978a4e8b986b0f5c77b
MD5 58e3ee513997a393bbb1e3675863074c
SHA1 83e84631229113845698b457948cb5bf5eb4a1cd
SHA512 0fb3f64fc2890d78f99173b8ebf373bb521309a75021f5912c12dd4d41e97bbe964ecd3c45a836e7a0b138de9f8456d22c477673f31e63e69e08554790b21718
SSDEEP 48:K4TINKEkY7yFTI1KQE4gNIRK+88TyU3CB13Rxxk+:K4TaKEkuOT2KQEXN+K+8ySx
TLSH
T18891734531BF12163C7E651C92A89A5BCA417BA37114E92B7BED00620F67E640CFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aa11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aa11.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 37d7258ae40a1b92a139c85401ea36747ddb6016c1c12d448147be0cf0438cf1
MD5 41248be6766a0b5dda928d73b5c3426e
SHA1 2feb708d46c75dfe07d8dcd1ce32adca5ef3d547
SHA512 feb3d2b2c448c7b9f5ae47a6268b3d49c9b3d3c219bed9372069d7c34aebee83a0b5001d5737276dbb3c9d722876fcb750e4cce2cc1f4a9769f022362a1ee37d
SSDEEP 384:dZcIhsNDEsjapGEf+uOdKc+2+FZwnTKwBODNZOCRWY:Fh8EjOAclwZwnewBKZOwWY
TLSH
T1EC928D366C38AC768DE6A645F84736178FF89163E5C53B98A5EDBF1C00C666C130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 84104003e03921b4abcc912a13d4d2f1ddc26c59f6b075dde9a2f434b067aac5
MD5 67415213689931153733b2ee0bf6c7a5
SHA1 4265c94721c584cef5ccdf54df64c1958cbf50e8
SHA512 8fe5dc775ed9130f753c95863e7506536f63ea2b0f130457c90a4cae96478b318735c7c524f884cf3e0a4cf3571c05206e9b53b0bfc3173dc7daedddbd43f913
SSDEEP 384:JiFiZcIuzsNa8TUNTUlIllsjapVEf+uOdKc+2kFZwnTKwBODNZOCRWY:gFQu1wg/EjOAclCZwnewBKZOwWY
TLSH
T157D207F258DB9836D99D5B47E73E2D138EBCD063F4816694B398AA1CCC8617FD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fa7e12e74c3159feb94042326857a43be5ca0f0f34e7272bc3584341418ffe1d
MD5 df146e901e159f15e0dd4a9078345ff9
SHA1 042e2708561a3e88f77b0e22aa26094dbae6294b
SHA512 9945e6d373267eea86795818331493b603e7e7dd6c016c1e28702cf9a6b20d64e2c868eb27b8f31d1fecfcefbace11d730fae9e3238aaa7aa730ea3c5f6f7059
SSDEEP 384:FFiZcIuzsNd8TUNTUlIllsjapVEf+uOdKc+2iFZwnTKwBODNZOCRWY:FFQuAwg/EjOAcl0ZwnewBKZOwWY
TLSH
T1C9C207F258DB9836D9AD5747E73E2D138EBCD063F4816694B398AA1CCC8617FD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3ac3f53717c0aaa99e64507234217e009f019409f73db3044f446fb9a2e10197
MD5 55aa6f42c81bbfcc46aa6d6c67a6cc55
SHA1 0a1141cae563812f637b4086b570eec9e512b870
SHA512 a3fc25597db7e09122dd73d1b229a530e1edb3099a09211f2718aaeb3353867b3b2d007f1664ab0243712973cee8f12f9f39c8e0fcd1a4acfe6e5ae220858a2d
SSDEEP 384:SZcIhsNDlsjapGEf+uOdKc+2+FZwnTKwBODNZOCRWY:ghjEjOAclwZwnewBKZOwWY
TLSH
T161928D366C38AC768DE6A645F44736178FF89163E5C52B98A5EDFF1D00C666C130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 79b4074cf3c387b9c384905319fd61f3068f8811953b85abe0d6e0c7f3ad762c
MD5 bdfd62904c343ee167521f555139ba71
SHA1 ecfc7722bb7c1887a14f961e73e2fac69844d057
SHA512 5536ce0cd07fba9bef4dd18dcc0975fd85b4ab16d61545a40f7f112c0d7736e571861683c892457744977d903bf57d428ee6f54e01fe535e20c028229120c65c
SSDEEP 192:EONo6hZ0QmiUyOwpc/+jVQO1L75wOZZHx1WU6:EONo6o2pu+uOdC2ZHWU6
TLSH
T1B902D93568686C778EE2AE45F48737239FE5217BE9916F84D6E86B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc8529fb26823d7d774b289ee6f7eb941657dec328ff83831177bc1484015466
MD5 8cb2ee8c6ab41c0fc726808e1038b39c
SHA1 c143128ce4084bdac5389626eb0d4eed72ea0b61
SHA512 cebd7097d508e61d83989427a7ee9a8b8c39a365852c9a000b8d6c5d4c25f7b94f82d14b1f8da874c07ec2e4c94414b56361f258e2017f08874c6b8fd5bece8d
SSDEEP 192:MONe6hZFQmiUy6wEc/+jVQO1LKc+2BW5cOqZ3qvU6:MONe6vAEu+uOdKc+2L9ZwU6
TLSH
T11612F9366868EC274DE1A655F48736238EE5512BEA86BFC4D5DC6F1D00DB6AC230F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0d8d5f5-2674-465a-826a-5461fd7c0c3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f0d8d5f5-2674-465a-826a-5461fd7c0c3a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 39ecd6af4dc560df817222ce21644bc7b3b76682f26fe8610236c78ea6b6d9b8
MD5 02a9364d072a539733088d50d6b07a2b
SHA1 01bca84cad12043cb9b857c3cff44420e5392d22
SHA512 3a09759ea96b42eb52e9adbefd318f000052479ed28ddee86d9ff6e64bf2f7070c1f1dcf615aec0639387f551590b92b331ba63cf3c5e9928d9689e9c964c529
TLSH
T1DC41095DB6EA1148B3B37E5A9BF6982D487A7D772E07C45E00120E4F4667B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download