hxxps://cloud[.]boldreports[.]com/reporting/site/b2173946/reports/31c5eaaf-5a28-4f19-8693-79b537079be2/Sample%20Reports/Settlement%20Statement

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cloud.boldreports.com/reporting/site/b2173946/reports/31c5eaaf-5a28-4f19-8693-79b537079be2/Sample%20Reports/Settlement%20Statement
Sample260714-e8d4caet8m

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
88	href.li
89	href.li
90	href.li

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284773983186646"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4895237D-7E50-499B-B950-F72ADB7509E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1672	2780	msedge.exe	86
PID 2780 wrote to memory of 3620	2780	msedge.exe	88
PID 2780 wrote to memory of 3748	2780	msedge.exe	89
PID 2780 wrote to memory of 3748	2780	msedge.exe	89
PID 2780 wrote to memory of 3748	2780	msedge.exe	89
PID 2780 wrote to memory of 4012	2780	msedge.exe	90
PID 2780 wrote to memory of 4012	2780	msedge.exe	90
PID 2780 wrote to memory of 2336	2780	msedge.exe	91
PID 2780 wrote to memory of 2336	2780	msedge.exe	91
PID 2780 wrote to memory of 2336	2780	msedge.exe	91
PID 2780 wrote to memory of 2992	2780	msedge.exe	92
PID 2780 wrote to memory of 2992	2780	msedge.exe	92
PID 2780 wrote to memory of 2992	2780	msedge.exe	92
PID 2780 wrote to memory of 2816	2780	msedge.exe	93
PID 2780 wrote to memory of 4284	2780	msedge.exe	94
PID 2780 wrote to memory of 2816	2780	msedge.exe	93
PID 2780 wrote to memory of 2816	2780	msedge.exe	93
PID 2780 wrote to memory of 4284	2780	msedge.exe	94
PID 2780 wrote to memory of 4284	2780	msedge.exe	94
PID 2780 wrote to memory of 2376	2780	msedge.exe	99
PID 2780 wrote to memory of 2376	2780	msedge.exe	99
PID 2780 wrote to memory of 4092	2780	msedge.exe	100
PID 2780 wrote to memory of 4092	2780	msedge.exe	100
PID 2780 wrote to memory of 2772	2780	msedge.exe	102
PID 2780 wrote to memory of 2432	2780	msedge.exe	104
PID 2780 wrote to memory of 2432	2780	msedge.exe	104
PID 2780 wrote to memory of 2336	2780	msedge.exe	105
PID 2780 wrote to memory of 2336	2780	msedge.exe	105
PID 2780 wrote to memory of 2336	2780	msedge.exe	105
PID 2780 wrote to memory of 1756	2780	msedge.exe	109
PID 2780 wrote to memory of 1272	2780	msedge.exe	110
PID 2780 wrote to memory of 1080	2780	msedge.exe	111
PID 2780 wrote to memory of 4216	2780	msedge.exe	112
PID 2780 wrote to memory of 4216	2780	msedge.exe	112
PID 2780 wrote to memory of 4216	2780	msedge.exe	112
PID 2780 wrote to memory of 3580	2780	msedge.exe	113
PID 2780 wrote to memory of 3580	2780	msedge.exe	113
PID 2780 wrote to memory of 3580	2780	msedge.exe	113
PID 2780 wrote to memory of 4008	2780	msedge.exe	114
PID 2780 wrote to memory of 4008	2780	msedge.exe	114
PID 2780 wrote to memory of 4008	2780	msedge.exe	114
PID 2780 wrote to memory of 3004	2780	msedge.exe	115
PID 2780 wrote to memory of 3004	2780	msedge.exe	115
PID 2780 wrote to memory of 3004	2780	msedge.exe	115
PID 2780 wrote to memory of 4496	2780	msedge.exe	124
PID 2780 wrote to memory of 4496	2780	msedge.exe	124
PID 2780 wrote to memory of 4916	2780	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloud.boldreports.com/reporting/site/b2173946/reports/31c5eaaf-5a28-4f19-8693-79b537079be2/Sample%20Reports/Settlement%20Statement
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffdba86c188,0x7ffdba86c194,0x7ffdba86c1a0
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,5566368230422301384,17048953940009767693,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,13971152569901291354,16579208263723488032,262144 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,15656321821061821348,14837606704108777417,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,8439899348688636757,4304761795462378404,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,11940296265156553037,16034571346660388790,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3259577220700501936,16870606428630159069,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1777173569799660093,10527619420876660567,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,1134860438610378761,6313708157565050246,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,11926440820660620141,1841638044299469639,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,12513793112424675658,17239430222952312969,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,12513793112424675658,17239430222952312969,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,1622668577359101615,234016075386746986,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6260,i,9631011483040411087,7441813728485243599,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16062024946359767182,2906416671084372350,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,17464723669896452814,7435051139598418378,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,9918335086462296452,12119843432398518751,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5372,i,1005443602226464704,18112169838578438869,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4320,i,5610276451191836366,9119729932398483032,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5392,i,7925714565036585324,4226012917194804147,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6692,i,15219923202579292783,12098233564184270599,2097152 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,18027200541843324230,10530897512655815304,524288 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=1212 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4566740023226744969,1390230729970669274,262144 --field-trial-handle=2308,i,9094992451806987444,9139837828552166952,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

47a946e0-89ce-4277-a66d-42201c925222.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47a946e0-89ce-4277-a66d-42201c925222.tmp
Size 13KB
SHA256 f9fa3ec1fcbc2ee3c2fb26836d0c7d55e68206c2da6107cd30269063472bb2c5
MD5 6494dbcc83bdf505bfcd6a85922d07e4
SHA1 f1dd94e4bbdc736b61ad1e061d551b1e2f6cfde8
SHA512 b828c1cdaeace15d923ce146d2b3c881e37cfb8985ceb29a29260f1773114feeb0a0e3388c4a88cd01c949137b8b13268aaee7215751b88f567dd4c164f39368
SSDEEP 192:sxZzRvyM/jK1Ml8M9K/fcsaRZLIdpe/HW6+WNWaT1XYzYBCrkFIg5HJ:sxZzV1K/fcsaRysHbhXTt/
TLSH
T15752D7526A345977CCDBD208BA45BF93D6F5047292940E48AAFC8B0C05F6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ab2e1f057027bdd516e195cb710613dfd7752415d8b03c4ddb3fda41a56a0411
MD5 7cb70a14f6151e9c4591f6674d0d67b3
SHA1 e6f482730b68b00e34806297c64d213001f5e563
SHA512 9c96b3faae7df08f742fd5ddd06ec8655044b3c272a305f0765851f094a440e6ef03b532ce709b71f76e9d1680a4334a1de16e35a8de392011a30684e308be29
SSDEEP 96:9niGlXkcJ7wEU/yn9HvR6TWbx3xnwzIQWGvlKJyO:9niHC9HnjHJyO
TLSH
T11C81A53520A74FBAEB21A27364CE245C3B3042F8F5135ECE9D60D67261D2398CDC2749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f015bf7340ef27f72d21d7365acb5aba5543593ef94894412f3d78955239b6a5
MD5 de29fc2eda94849be9171e8a06b103e3
SHA1 48af726b77d4e6ee4fcf601b4d46300a73dfd24f
SHA512 2492f01d04b46618387f34d5894212427cd3bbd4c54d45d891b1268ca05a9848f1fe3903ea87ff4b50a7b332637a1c67d553e501a04acce04f87575aaf852aa6
TLSH
T1AC81A534209B4FBAEB21A27254CE249C773082F8F4134ECE9DA0D67221D1359CDC6749
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a57.TMP
Size 3KB
SHA256 81d4e0a566225e4bbba929093623049341007e7cb19dc7c8e587d100dc86c738
MD5 26e7b20c9401a9336fe7eac7cf2d1ff3
SHA1 bf10c85f160a008b157b3f798eec208f0d188f74
SHA512 e4e0abe1a81dd2687276e935cc4899fc09d11e12bc181099799ee82571547973e8d8530f564c04f3a0b2c60cc8f3061dff6061e6f8fe2b30d547b2f2c0671f85
TLSH
T17E715F3820474FB9EB22A17388DE209D7B3082F5F8135ECD5CA4EA7565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bfe95e5c6ed45659eb3dd1baf43d60d5b418c14f2a6b3c384ffb2f8c262cf578
MD5 330e6a18483acd8d798689abbf3f56fe
SHA1 22e03631fc377dd55969f0938f8984a924e6f5b7
SHA512 e7405ed651e995ccef35f242a667a92eeb00e6eb2c7ad4334cbab1d2e2d838920d2f1728c690eb311abf573a438ec233106c6457f100447b2f7fbe0825d79a23
TLSH
T1FF51A2F743E0855EDA11D6F1AA187F1FCE1D0515832C382ACAE5AF5BA3E3461E10298F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a97080a10b2ec1ca32f4f0bb943c3afd91a83b73a07eb4818ae555c0ba0e7761
MD5 bc24e521d2098d86b339946e63875707
SHA1 045dd2c3a2692075e2ab1b55a5524a9a09ef0c5a
SHA512 3b751f8cfcca150540ba332e326214807bd15f2bbac2c0e7d173b989519169af20538cc3a5328911bf53a5bf43e0407ab5fc63bd09e53b93249276439cd0b0ef
SSDEEP 192:sxZzRvyM/jK1Ml8MkK/fcs8UZLIdpe/HW6+WNWKE/YzCBmrkFIgrJ:sxZzVMK/fcs8UysHbg/tx9
TLSH
T17052E8526A345977CCDBD209BA45BF93D6F9047296940E48AAFC8A0C05F6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f431a82178ca0e9dcef80c3bfa8db0204d2bb221d0aac87657acbc9416cbb895
MD5 e1e46355cc6e43f9496ab7cc874b6b06
SHA1 c1c00715317bd8b5e6128e65327f9a0540632e1d
SHA512 818eb5ac9d819d1ad1bfa6b6f9095b0ee093b181ef56af0649b9391adfe9afab3064874c7aade25b6781c336d7fd66c1d28a824b51b198ff61b5baa098ec21f1
SSDEEP 192:sxZzRvyM/jK1Ml8UQC9K/fcsaR/LIdpNNW9RZ6HW6+WNDO9aT1LNs0/YzdBNxkF/:sxZzVq0K/fcsaRMNhHb/L1/QU/
TLSH
T18162D6526A349A77CCDBD209B945FB93D6F51472D6940E48AAFC8A0C01F6BED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5be3dd6b54535dde03fc30899711c0bc86d4d08eb9a3b2deefebdb01bb495678
MD5 d511a19d7973e6dc99a94f57c648bfb2
SHA1 e7ec7b66a37707308b38689abf4bd7b724ac9257
SHA512 f73daa58854b9b219c43a9ff76f05cbe1ec8131cd54db57c5afd0cb693ece1e1206dd98782dac2873ccce1fe0eb423171f7b387bceed46de7fa2957c64a3ecf7
SSDEEP 768:07W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjProIuiVYu:07W7kf0Wvqidau1jaa5LA3jcnu
TLSH
T189D20B3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c1f3abb2067ed13fce1bdcd6e367f2c628c4e035322c1f20aaa6f40efef37c68
MD5 a7de276143fc1818995ea8cef6e66650
SHA1 4c2126a77c319343367db6a46aea95ad00b1737c
SHA512 7d75509e8879c7db34433cda4eff8a5eff6d5031535a52b2a5976f58dc3b76cdbfaeaf5ee222d9aa3fa91091663ee5cbb24da2e4fef5425b091ced4534882a84
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfJIdKiQoPyVvI5KYIMMgIrKhql:KIbCKcfJiKiQamvGKYIXgwKhql
TLSH
T154913992773B0611387D2818975A8A374E8336537419A46F7BB801B21F67F221EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5d7a61b-cdaf-4c41-b48b-062adc1e3c7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c5d7a61b-cdaf-4c41-b48b-062adc1e3c7f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ad1a5003e4ace5adfd6a558a71df1b5c5dcdbfc6b5cb4b91dbdbdbb104caf246
MD5 45748184b3cb3ca7dbcad845586581e9
SHA1 b38337d41a977b37154ccffa8aa98f4985a6328c
SHA512 8cea19edc594680b5990abba386d11539ccefbfc3c9ae20f75e0deff80680984d8fda7a03993480950644eccbd8f590f798226bc305d76e30a36dbad1b10a13e
SSDEEP 384:ftNn/s3n9SfsNYyn5kbNUJuOdWGimPf2OObjI9G6w7b:fj+9U2KmvoGiaf229Mb
TLSH
T14C928E366C399E675DA29145F0873A175FF8417F97C82F48F6ECAB0C02EA3AC5316806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d21a359810e99544dba12c86e17e8e1d8b4ccb4cc09608832edb2d05e351834e
MD5 97fc57ad34282fd15231c3c098baf3b3
SHA1 9bf9827c25cf0a17d9148b6bce9c0506ef6feb95
SHA512 9011f3b37095365867410cfb52221b3ed0d14a616a4a129758620332d25275e67349133f910101984de27785755e8f1ef750c71f5590af1ef45aa32a32d6cb0a
SSDEEP 384:JiF1tNn/s3n9S1zsNI8TUNTUlIl9n5kbN3JP2OdWGimgf2OObjI9G6w7b:gF1j+9yFwgTK5l9oGirf229Mb
TLSH
T155C22AF258D7893BD96E5747B37E2D024EBCC16BB5852A44B3D89A0CCD962BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 655e4ca29b75816c78765833cceff21073dae1c72a53927193872a74fbf1934a
MD5 6b7a89504bfc32f821085e01441e3d7c
SHA1 be14372940ebd8e5606107caace6366093bd258b
SHA512 aa4acd45aad1eb06b0eb6991c5309d5f3796ff5360cbd111a7d95a7434276e683572f5026ff51c3e2d39c83f808ff599e565aa9be1a6ac15c4e12b96099ddb47
SSDEEP 192:MON364BAQmiUyB1YW5GBPKmx+FdG+Po5Z4aDfMZ6U6:MON36eAWCWldWFfi6U6
TLSH
T13702D835AC796C7B9EB26E45F48637175F98113BE6852F44EAE85B0C01A735C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 71878e3f5dbf29b1d06edaf436725a36e00eed092677fe6cd0b8ab291424d580
MD5 9b55b628a5dc1096785f7610b1876748
SHA1 563ee4ea906bf0d8623a12a6d4f3580e8d21ebe6
SHA512 d1d39b64503fdd1c11f7b9fa9664a529fe8677ec208d294536a704a248a3ced3c54c5f9e8b63a625096d2c485e165a06642b81462de77af6fc4df6e873fbdc48
SSDEEP 384:ttNn/s3n9SfsNY9n5kbNBJP2OdWGimPf2OObjI9G6w7b:tj+9UNKnl9oGiaf229Mb
TLSH
T1B2929E366C359E275DA2A145F0873A175FF8517F97C82F48F6ECAB0C02EA7AC5316806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 739c3e5266a2392aedf1ccff5a61a9fd1551d301b7b3454416324f069bf0909c
MD5 68bbd721ac9699f265f9952988849990
SHA1 040f525cff94bde716044dd86835e3a3414e9eba
SHA512 d79dac8cdce53f755515c76e49628cfba94391ef3949e0be5bbb87eb5eec15b2bae9a51b004b1d5ec4bad06cd0ff86da748832f3acded3e151e67d3b6cd5b2a8
SSDEEP 192:iONB64BpQmiUywYU5GBPKmx+FdG+Po5Z7pEimM8WwfSrqGU6:iONB6eH6UldWGimFf2U6
TLSH
T11A121B366C78AC6B5EA26545F48636435EA8512BEBC57F44F7EC670C02EF3AC2307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f13dc7ab85db471001483924e73093ddf2eb50868b60721e509c928d831c500a
MD5 2480265b273afa98abd75dffbfa0815e
SHA1 9735bc80abcbc39437e29d7f00167685eb07abe8
SHA512 eb872a0e244a48cb429614ff31d61c3ffc48f0b3f8962fe9820222c7e5841a52fdb8111facbc278874dde44a795e7c8caaf5768d1bd724a2e3efb76b7f7f4995
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59be64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59be64.TMP
Size 392B
SHA256 a5d1a24df716f9fae562f32139418fdef3849668e8c5ed7241eb81eaec932dc5
MD5 c9207956a8c246e0494d53a392424c75
SHA1 59c1e8f01d6afa642f3ba59f01323f2f01a2826d
SHA512 04b5b38f41970c90adea68be6e8db1ecb974ad1b570de18b5d390f8a76505e78cd35e4ca566f3a63792a3a6a06f795ba6b2b3f5779f938bdfcfa61c28baab19b
MD5 SHA1 SHA512

Submit Download

836c6da4-470e-4a57-8a58-8d989bb333ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\836c6da4-470e-4a57-8a58-8d989bb333ed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e62d14f127339fba1ec245f4227fec4abeedf847cd0e926c3774bdf71c7d8a23
MD5 b1e636992e5061e239535dc7b3f3d9d9
SHA1 21a73d95c6a7ef77a376827b0de1f093dd0ab202
SHA512 2a65258a494c8213d6b13e933e148fe1927612a38b23f8c410c2dd892bbbe2632ee2cd38a081e768b119e2bba62335b64785b79584cae6615b60fde755e8af7e
TLSH
T13D41289CB6FA1109B3737E56ABF6686D487BBD372E0A949D00010D4F0623B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download