hxxps://maya[.]findshare[.]com/credityes/4105349

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://maya.findshare.com/credityes/4105349
Sample260908-18b5mshm5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333795368709561"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6E33F90E-C297-427B-B052-D178EEBF1910}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2184	4116	msedge.exe	82
PID 4116 wrote to memory of 4608	4116	msedge.exe	83
PID 4116 wrote to memory of 4072	4116	msedge.exe	84
PID 4116 wrote to memory of 4072	4116	msedge.exe	84
PID 4116 wrote to memory of 4072	4116	msedge.exe	84
PID 4116 wrote to memory of 2268	4116	msedge.exe	85
PID 4116 wrote to memory of 2268	4116	msedge.exe	85
PID 4116 wrote to memory of 2092	4116	msedge.exe	87
PID 4116 wrote to memory of 2092	4116	msedge.exe	87
PID 4116 wrote to memory of 2092	4116	msedge.exe	87
PID 4116 wrote to memory of 2280	4116	msedge.exe	88
PID 4116 wrote to memory of 2280	4116	msedge.exe	88
PID 4116 wrote to memory of 2280	4116	msedge.exe	88
PID 4116 wrote to memory of 4452	4116	msedge.exe	89
PID 4116 wrote to memory of 2008	4116	msedge.exe	90
PID 4116 wrote to memory of 4452	4116	msedge.exe	89
PID 4116 wrote to memory of 4452	4116	msedge.exe	89
PID 4116 wrote to memory of 2008	4116	msedge.exe	90
PID 4116 wrote to memory of 2008	4116	msedge.exe	90
PID 4116 wrote to memory of 4508	4116	msedge.exe	95
PID 4116 wrote to memory of 2396	4116	msedge.exe	96
PID 4116 wrote to memory of 4508	4116	msedge.exe	95
PID 4116 wrote to memory of 2396	4116	msedge.exe	96
PID 4116 wrote to memory of 4212	4116	msedge.exe	99
PID 4116 wrote to memory of 372	4116	msedge.exe	107
PID 4116 wrote to memory of 372	4116	msedge.exe	107
PID 4116 wrote to memory of 372	4116	msedge.exe	107
PID 4116 wrote to memory of 1712	4116	msedge.exe	109
PID 4116 wrote to memory of 1712	4116	msedge.exe	109
PID 4116 wrote to memory of 1712	4116	msedge.exe	109
PID 4116 wrote to memory of 3652	4116	msedge.exe	113
PID 4116 wrote to memory of 3704	4116	msedge.exe	114
PID 4116 wrote to memory of 4876	4116	msedge.exe	115
PID 4116 wrote to memory of 2876	4116	msedge.exe	121
PID 4116 wrote to memory of 2876	4116	msedge.exe	121
PID 4116 wrote to memory of 664	4116	msedge.exe	124
PID 4116 wrote to memory of 664	4116	msedge.exe	124
PID 4116 wrote to memory of 664	4116	msedge.exe	124
PID 4116 wrote to memory of 1404	4116	msedge.exe	128
PID 4116 wrote to memory of 4692	4116	msedge.exe	129
PID 4116 wrote to memory of 4692	4116	msedge.exe	129
PID 4116 wrote to memory of 4692	4116	msedge.exe	129
PID 4116 wrote to memory of 1772	4116	msedge.exe	130
PID 4116 wrote to memory of 1772	4116	msedge.exe	130
PID 4116 wrote to memory of 1772	4116	msedge.exe	130
PID 4116 wrote to memory of 4004	4116	msedge.exe	131
PID 4116 wrote to memory of 4004	4116	msedge.exe	131
PID 4116 wrote to memory of 4004	4116	msedge.exe	131
PID 4116 wrote to memory of 436	4116	msedge.exe	132
PID 4116 wrote to memory of 436	4116	msedge.exe	132
PID 4116 wrote to memory of 436	4116	msedge.exe	132
PID 4116 wrote to memory of 2364	4116	msedge.exe	133
PID 4116 wrote to memory of 2364	4116	msedge.exe	133
PID 4116 wrote to memory of 2364	4116	msedge.exe	133
PID 4116 wrote to memory of 8	4116	msedge.exe	134
PID 4116 wrote to memory of 8	4116	msedge.exe	134
PID 4116 wrote to memory of 8	4116	msedge.exe	134
PID 4116 wrote to memory of 4556	4116	msedge.exe	135
PID 4116 wrote to memory of 4556	4116	msedge.exe	135
PID 4116 wrote to memory of 4556	4116	msedge.exe	135
PID 4116 wrote to memory of 536	4116	msedge.exe	136
PID 4116 wrote to memory of 536	4116	msedge.exe	136
PID 4116 wrote to memory of 536	4116	msedge.exe	136
PID 4116 wrote to memory of 3564	4116	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://maya.findshare.com/credityes/4105349
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbda2ec188,0x7ffbda2ec194,0x7ffbda2ec1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10209653643843337108,10274826066751686582,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5925350731630273736,5080083272601541413,262144 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,2577975157246697546,1909374158168966568,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,12594923193876028264,11790929895516213024,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,6397729967591214905,111473945127071800,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,18190161350762654347,17094969602536462012,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,1421877343406684321,17705569223408449751,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15667303644161917564,6790979041814644875,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9952317816969812988,2331565024988070977,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14139169833471437228,17993320212655309610,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14139169833471437228,17993320212655309610,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4404,i,16043615843604446058,5615876276046495111,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3544,i,5663772947852398491,12713255038002715680,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2195091457843308661,15143339990502199108,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3978235069037633479,15973944708316010155,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16677702028392030076,3264048673663569388,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,7723003316940155713,10546905473480526439,524288 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4496,i,14661323747365154503,13171297524666882811,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3544,i,9386274517207288487,123624744405285391,262144 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3752,i,14423413870827018518,13617084490742283788,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5448,i,9719201256885608314,6613060493291556575,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5880,i,17634639703685044234,7506067742293436573,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6392,i,392509579839348974,8283215592918643484,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5652,i,4813760017112832667,18208345985523711303,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6488,i,7672881011809916976,26332008150490072,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6572,i,15867362908370709966,15908532032653843427,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3524,i,1732371869405719828,5070303898344967584,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6768,i,15009159090805573776,17604001977039680746,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6992,i,13543372783828349558,936332163971626146,2097152 --field-trial-handle=2276,i,18375521286763859860,10118943011659063880,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1988deec-b1b1-4af7-9d12-e2e8921f3f02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1988deec-b1b1-4af7-9d12-e2e8921f3f02.tmp
Size 12KB
SHA256 8dee3009139ecf1772cb00e361f6850c38d4fdbc7e813963622a755d333a10fa
MD5 f58ebc1408d512d0aabbbb0054d48091
SHA1 22571b83a68d568a5ddc7ec8dd42f25fe59a6fab
SHA512 8729e553adb1c9f80a2aaa2ac3e0a2903f4d2846579779b863aca49c6623203107d95c67e13c8eb9768471b8eb0fa6f89a31090c7a43f6f469f22b0d3e377ab9
SSDEEP 192:uTXLsN29Q50YiY+YLeDmQmiU1BuUB4e+CGLOD9ojh8UJiT1qgLqyBMK8:87sN29c0YiYziOiUue+CeODejhATlX6/
TLSH
T17C525A3278385C76AEE29681F54736139EB491A3EA893F9094DD6F0D01DF69C230682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1ce565fdeb92fe2c45b80b20bfd633103b06260e767eb85e31a9515904e5b77
MD5 b77d2506423a41462a6e063e783e16de
SHA1 7cc5df9e811b45b84c184ad18fb4785a6551a557
SHA512 0d61faed33e255bf34e27c909a4948a1e0f7212ce84bf7656e60bacb4c044289140ceeefe2ca54efb945cd2b0a7e4221d0ef0f14db43dd72c0561f3eae9cf0c3
TLSH
T12E613C3800554C53E7C52133E4FFC94074B985EAFBA3EE2691336CBD6A0E729804DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d963.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d963.TMP
Size 3KB
SHA256 212aef094288d5010ad0f49b2a1c567cedad75d8ee39b31d20b247714dba9a6b
MD5 e63eb40ba3f183def2d93f6f5d4e4871
SHA1 39697e9a11b7192f747fba36d0ea1189e5ac76f4
SHA512 86fcde87b34f05ca000c3b8043254fd2a16136c09af97a76150f304e08ce6faef3716292fac83110faf46880ef64809b333b8d1f9c0c7ec661d8d0d0d01d858c
TLSH
T1F5612D3800454C53E7C52133D4FFC94474B985DAFBA3DE2691376CBD660E725814DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e6b8116216b74abba4604100e42a6c7303f4c40888243d245c1885a1937ca961
MD5 4c53aad258f62baff7498cc4502457be
SHA1 660b462a252ecf78e5f2931a2f96d1963ee9d036
SHA512 c1333c9685608ad12717eef56823b4f2e9a52459435d375742d68721ef9f9a8b7de7a5ac85021830db71a7e19cfebe71895873aa8abb17a41d913f09c8a93a6e
TLSH
T1CA11DDF3C7E185AE8A0106F05A18AE2BCE1D0612422C3C19C5D4EF27D3F30B5E00198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 908d83973b56e96742805ca174d3299fd7e8ac524fba9ede2d32bfde576b2dcf
MD5 e0c2eeec5d08ca155ed1cdd3093db1f5
SHA1 bd5b3fd47cb633601f0465e6bd7450bca9b46b53
SHA512 3708cb7f941c1633b9cb1128d5801aa45aadbbf9d26a58a6ac350795011c40cf5b973eef053cbac75006a7ee5be1572f68bc7f8670ae1535f867f033431e75a9
SSDEEP 192:sxZ7Rlkt/fushB9IbjIdpJHW6+WNGY9IoKuMZIgrJ:sxZ7wt/fushBWoJHbGH9
TLSH
T11322B8126E28A5778CC7D21DBB25BF03E6F95072A1D41E58EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 549b64c4b5ad1334e0238f26ab3984d851c7e281bd564c480eefac81817279c0
MD5 d89d66928b3d279ef0a12d4e63c62370
SHA1 f997d7d87e8d9434189cf88fcbe2fb8b98de19b2
SHA512 1ca2af2407bac2f7455a8e1a385967de3e5194a825e99e30951f2c19180874d8df22670de88e70aba47d20a953a68090393a45e0c31a991c50d667184d16e2db
SSDEEP 192:sxZ7Rlkt/fuszB9IbjIdpJHW6+WNGY9IoKuMZIg5wJ:sxZ7wt/fuszBWoJHbGHm
TLSH
T11922B7126E38A4778CC7D219BB65BF43E6F95072A1D41E58EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 928dd8bc935f36d095471cc02ffa6c3f59a4056e107ae9b5e44a3536acd52c07
MD5 d0b977c8091953413a8ca6e0ed3334f1
SHA1 76a3487f03ae025566dcff2c6814424f2c10b4a1
SHA512 34b249f2c604b159a9d8e6c27d0a118993ed106aebd464fec8b6ecc9b8b9df000f474e453b024beb35251cb485c7619ec1fe0e5323fcebd3c4b19f9a30fc6557
SSDEEP 192:sxZ7Rlkt/fuszBnIijIdpmDHW6+WNGY9I1NyuMZIg5iJ:sxZ7wt/fuszBI7cHbG9Uk
TLSH
T1CE22B8126E28A9778CC7E209BB55BF03E6F95072A1951E58E6FC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dbbab251bc1eba1f7c2e659d32f1bfeb2c3d979b00f1a4a22fb9f39e74d03d92
MD5 b05d54c09e889994c15d68357c9bd4d1
SHA1 8feb3e1d999b2f2fea5dc22741f7d5dce46c3ac2
SHA512 969ff51236bac9da9386370c368d8ff9144cb5ada6c40dae500cc820479a24d544e719dc25b96132cf2a60a8b741dc28e5078a8dea35d13cdfa8621a77608ec7
SSDEEP 768:jByvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7srombqK:jByvIZwWvu+Q+u1jamFLeR73mf
TLSH
T14DC2F92B640CCB7E5F801E9D9D5A6F9B3EA802C7A7588D4047FD894C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4d3fc92464d3ff100add1d4d7fda437a475c31aaf40a099f7cb00bbcdf002760
MD5 7b569290e2cef9c621abeb62b3b7a914
SHA1 95f8784ad8d60539e48fd0a96c358c0d6845ebad
SHA512 57363172ef0e87760ae9891a07684cd2526de87d9c5d0a9057f257e6523febbe2b2332295f9a3d30d0b5df2a4f124c050d6e86a153bdf6c6587c755382851b86
SSDEEP 192:umXLsN2BQ50YiY+YLeDmQmiU1BuUB4e+CGLOD9ojh8UJiT1qgLqyBMK8:Z7sN2Bc0YiYziOiUue+CeODejhATlX6/
TLSH
T1E9424B32BC385C766EE29685F44B36139EB491A3EA853F9494DD6F0C01DF69C2306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74b48f9aaf1e491124611612e1d0d4c7db8e51980ecc59bf0b4d4243ce7da8d3
MD5 631eeef948cf9e91bd76edeff13be345
SHA1 7f5f4414a82a389a5053add4eed9a931d7a78c95
SHA512 bbda53baf55ea1aca0dd39d26546aa61676cb30ecb33a9bd40112ecff5aa862be46e2040fb77b9e8d164fb6d6b361312cfc8c897770ddb255af067abd71e6a4c
SSDEEP 384:knZcInsNPNc0YiYziOiUue+CeODejhiTlsa+VY/GKPoE:kPnBikg82OijhiTlhgGlf
TLSH
T1C8827E326D345C7B59F6A285F94776039EB891A7E6897E9084DC6F0D00DB6DC230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 a8fe5395270f686498b308c121e9f5b236c9f039016935136a748bc584a14c47
MD5 ef4dfe3148bf9dbb72974a3e0a9b901e
SHA1 a60687d5e291adf736847f7220ca3c0f10715cc0
SHA512 7fb6752f1a1703b13b98c8165523ee8fe8b1c87f43c08c9b2fdcdf4a198154a1b243cd6c78ad27ab25339fdb4d2b0069314cfe2e60203ca7e4994b8a3d16c94f
SSDEEP 384:kesN2tc0YiYziOiUue+CeODejhjTlsa+VY/GKg:keEikg82OijhjTlhgGS
TLSH
T1AF624B3279386C779DE79681F94B32139EB491A7E6893F9485DC6F0C01DF68C230691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6705467d21a9cfd48dde8e03aa74358618e4ea0bee36e73f917d4c0a2ee2c540
MD5 b393efb52aa9103add24555cd63ca8b3
SHA1 cda629f466c644b6c5698f40a1ae551da1dedec7
SHA512 2ce4d4ba16a690b8a42ffa5205562e48bfc1138e9bd95843af2259df9e26fe6022e4b7b6e01590ebcd4003ee12b0568f4cd68387a12aeccff6415d4422f07822
SSDEEP 192:JONj6v+YLNQmiUyM4Zh+CGLOD9oqusT+ZU6:JONj6vz/yZh+CeODeMTKU6
TLSH
T1E202E935BD382C7B9FF2AE45F98736139FA82177E5552F80D9E82B0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7474dc23c4adb8550aba94abf424b32175a6b9dbe497d22f0f06fe9cb861b2a1
MD5 fe7ae6820aad28f0e4f9f114b546f5b6
SHA1 760b70cbd4561bccd80f1452db0efadbe34ffbff
SHA512 6f2e37659a799b164373588fcc3349223ea12873d0b14c2eda2c45b2153369eb65d324afc5a8a50f79aa798c1eb73c6062be82765998c9a5d660b7babd960b6a
SSDEEP 192:pON/6v+YLoQmiUyf4/h+CGLOD9ojhrCHT1qgU6:pON/6vz8v/h+CeODejh4TlU6
TLSH
T1A9122B36BC386C775EE26985F48735139EA85277EA467F80D4DC3E0C01DF69C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 048711452d389a6af6c6c0af7a94846b91291a3d41dbf63c6acd5a04c148cd02
MD5 95385e9fb21d777a487257fd8fa67c7a
SHA1 06750f91aa4bc6fb9910cd4452cd0faf177eee35
SHA512 bf7dc1a21422007bfc8d5105a952eaaa39a3d28a0baeb30f792b45aa3c9d045c833f05e312e1495db149b41d677f15bf7bb1e8f244aaa479e85932729206b077
SSDEEP 384:87sN2tc0YiYziOiUue+CeODejhATlsa+VY/GKg:87Eikg82OijhATlhgGS
TLSH
T1C0625C3279386C779DA79681F94B32139EB491A7E6893F9485DC6F0C01DF6CC230691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2efefe06-3293-49c1-b5df-3477eaa3548d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2efefe06-3293-49c1-b5df-3477eaa3548d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00e2b8316665e6c6a1ea5215c5e6923e207558b2fa778abed38208a4d7a3bffc
MD5 a6f9b879e89468f9d48b20111f546a3a
SHA1 b1793f9c45b68497d69380dcb4c0b85a0af2d28c
SHA512 344526a880d349fe6e07a85017d3cc8b9e49e37a8cb0c845ec549bff849e8f55422629b228b104600f4bbcc946cf89abcd5ff353ba6bff09fdc1a9f9479fd1fa
TLSH
T11941F858A6EA1148B3B36F16AFF6A86D487FB9771F07D45E10010E4F4A22A40C861777
MD5 SHA1 SHA512 TLSH

Submit Download