hxxp://ttps/bc[.]backgroundchecking[.]com/authportal/session/signin

Analysis

user interaction
yes
max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ttps/bc.backgroundchecking.com/authportal/session/signin
Sample260729-vrp3aa1set

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298188291215651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E06329A0-F1B9-4A0D-86CD-93E321B809E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4316	3976	msedge.exe	86
PID 3976 wrote to memory of 2804	3976	msedge.exe	87
PID 3976 wrote to memory of 3452	3976	msedge.exe	88
PID 3976 wrote to memory of 3452	3976	msedge.exe	88
PID 3976 wrote to memory of 3452	3976	msedge.exe	88
PID 3976 wrote to memory of 1804	3976	msedge.exe	89
PID 3976 wrote to memory of 1804	3976	msedge.exe	89
PID 3976 wrote to memory of 4120	3976	msedge.exe	90
PID 3976 wrote to memory of 4120	3976	msedge.exe	90
PID 3976 wrote to memory of 3956	3976	msedge.exe	91
PID 3976 wrote to memory of 4120	3976	msedge.exe	90
PID 3976 wrote to memory of 3956	3976	msedge.exe	91
PID 3976 wrote to memory of 3956	3976	msedge.exe	91
PID 3976 wrote to memory of 3944	3976	msedge.exe	93
PID 3976 wrote to memory of 1376	3976	msedge.exe	94
PID 3976 wrote to memory of 3944	3976	msedge.exe	93
PID 3976 wrote to memory of 3944	3976	msedge.exe	93
PID 3976 wrote to memory of 1376	3976	msedge.exe	94
PID 3976 wrote to memory of 1376	3976	msedge.exe	94
PID 3976 wrote to memory of 3128	3976	msedge.exe	98
PID 3976 wrote to memory of 3128	3976	msedge.exe	98
PID 3976 wrote to memory of 3128	3976	msedge.exe	98
PID 3976 wrote to memory of 4176	3976	msedge.exe	101
PID 3976 wrote to memory of 1312	3976	msedge.exe	102
PID 3976 wrote to memory of 4176	3976	msedge.exe	101
PID 3976 wrote to memory of 1312	3976	msedge.exe	102
PID 3976 wrote to memory of 1388	3976	msedge.exe	103
PID 3976 wrote to memory of 1388	3976	msedge.exe	103
PID 3976 wrote to memory of 1388	3976	msedge.exe	103
PID 3976 wrote to memory of 2156	3976	msedge.exe	105
PID 3976 wrote to memory of 3740	3976	msedge.exe	114
PID 3976 wrote to memory of 3740	3976	msedge.exe	114
PID 3976 wrote to memory of 3740	3976	msedge.exe	114
PID 3976 wrote to memory of 2320	3976	msedge.exe	115
PID 3976 wrote to memory of 2320	3976	msedge.exe	115
PID 3976 wrote to memory of 2320	3976	msedge.exe	115
PID 3976 wrote to memory of 2360	3976	msedge.exe	119
PID 3976 wrote to memory of 1888	3976	msedge.exe	120
PID 3976 wrote to memory of 4124	3976	msedge.exe	121
PID 3976 wrote to memory of 5232	3976	msedge.exe	122
PID 3976 wrote to memory of 5232	3976	msedge.exe	122
PID 3976 wrote to memory of 5480	3976	msedge.exe	123
PID 3976 wrote to memory of 5480	3976	msedge.exe	123
PID 3976 wrote to memory of 5480	3976	msedge.exe	123
PID 3976 wrote to memory of 5728	3976	msedge.exe	125
PID 3976 wrote to memory of 5728	3976	msedge.exe	125
PID 3976 wrote to memory of 5820	3976	msedge.exe	126
PID 3976 wrote to memory of 5820	3976	msedge.exe	126
PID 3976 wrote to memory of 5820	3976	msedge.exe	126
PID 3976 wrote to memory of 4776	3976	msedge.exe	133
PID 3976 wrote to memory of 736	3976	msedge.exe	134
PID 3976 wrote to memory of 736	3976	msedge.exe	134
PID 3976 wrote to memory of 736	3976	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ttps/bc.backgroundchecking.com/authportal/session/signin
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa6214c188,0x7ffa6214c194,0x7ffa6214c1a0
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,8567440038358867807,17888774086781063190,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10761016622508282520,15252537048200628630,262144 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,12813315622926225542,3815261824829444046,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11084823869538822214,15859367440140677992,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11533937827655021752,16749681868317351701,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,15658808191269149852,16515214335548860305,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14523435847919877608,14024943391503124393,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3516,i,5941151682971897051,2504323273869667419,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12516935082939269070,6269107373354700392,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,7682154784997530565,3210442783614514213,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5128,i,17441968580078803005,2671300864031107546,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13173898954890661540,17199174824303676072,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13173898954890661540,17199174824303676072,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6336,i,13653868589202668392,7073263023412345003,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4264,i,12403975859818736640,18201747793256201808,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6403336633078557755,2181215658314222697,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14913327036945753782,15782904588037060323,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12431194353079849897,12845106561527545399,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,17486184049950059632,7936659051176055860,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4476,i,4483475589262966955,15803663402773792083,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,1375403534539371497,295233580535388918,524288 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5208,i,8283727025770998991,15260156538023479074,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,665897745543503337,17860022244854021601,262144 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5008,i,12661477985798099804,1457467339470934546,2097152 --field-trial-handle=2132,i,4003025652342119087,10150673698939585653,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

023bd6ec-b7ae-40f7-9042-55193fccbfdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\023bd6ec-b7ae-40f7-9042-55193fccbfdf.tmp
Size 12KB
SHA256 9eaa05b0a7242a0e7dd44f937e519b0e9912c63b262dee1fd53b4fab70a5e0f5
MD5 bc31f9a3f9db5afe57e07ad3e7c03bd9
SHA1 d8c68213a938c9364e8cb52b81e64a50589882bf
SHA512 b60adea68bd30858f86cccaf69baa602547833b0b37c37b282795fbb9c470c2d7d59a85a9a098291f31de42ab0aff8c526f8244e0c822746fe8265e45d8a5d20
SSDEEP 192:sxZARayM/jK1Ml8Mkw/fas9E8lIdpfBHW6+WNGYzQGumIgrJ:sxZAgMw/fas9EpZHbG+9
TLSH
T1AF42E816AB349977CCCBD209FA557F53D6F51472E2900E44AAFCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58ae9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ae9a.TMP
Size 3KB
SHA256 890b1c7b687341fb0cc414442e3b6696fbc960c999c69208728e98a83241dc33
MD5 61e6e178004dd5b491061d244013ed0e
SHA1 db4e5f730ff5b77b41002893bd2cf2e224b83544
SHA512 adcae8ead401ae2e261065273d91517c476784aa9c1f469d51f744ab2d15925a0cb76b74a978babb552e5f2e61e306eca01372fe036d3ba380bd967d91e805eb
TLSH
T153715FB0150EB899E35E01389CD25E0D7F3140E9F4177F7D1A508F75551D72981FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fce04892f5d7377fdfb4e05a2babeede1964c7d1aa04b35c8346bad83dcb2f97
MD5 09c33475731089b8ccc683c492eafba1
SHA1 a72933336a591b7828cce3eaca7c38e0df201334
SHA512 e8e1822f0ec1fbf28f8ead6300dbfe0980b837e2065a4e3393b7b92a17651e03cb26748297b652b0f7167aaad8a63f499d6709ef7bbf3dc346bd50557d0c3bc6
TLSH
T1BC117DF7C3D5856E890157F06A28AE1BCE1D0606831C7D1989D4EF6BD3E3079E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d509542f224b67b95a01f00a96cf4d493e789667097396393c3758ed2aead9c4
MD5 b647f74bd2e4f33fdf6a56e251bdcc91
SHA1 e5033943e0fab18bd43dc593d9ab240e3f9223b8
SHA512 4c48f3c264353d73e88010581a39809eb8005e0c0c7e5f703160d86cd59decb0fec7d0b1def0e1a419be401404f4cca863abb783a2494518ff16814daa3491bb
SSDEEP 192:sxZARayM/jK1Ml8UQ/kw/fasaQ8lIdpJjHW6+WNpkj/Yz8tumIg5fJ:sxZAQqsw/fasaQpVHb2/3T
TLSH
T11C52C656AA349977CCDBD209FA517F53D6F51472E2900E44AAFCDA1C00E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7c9aac635877a27d2fab2fed1710476a678ed32d870a7cf2f9144e74addfa0d4
MD5 744277b27faa5e9fa8388fe05a7f7da0
SHA1 895dbeab4ff90c0be58b21c48756a1c2df1aa15c
SHA512 2b5884e18695b436410ceb8ecdd0feb6f826a68a997a12cc4bf6c3caeb3a73a04b9a56510dd680b454fe7a9d1cafbda205cd5d2a9c0accb8ea7ad3221f38e43b
SSDEEP 192:sxZARayM/jK1Ml8Mkw/fasaQ8lIdpfDHW6+WNpgW/YzPiumIg5fJ:sxZAQMw/fasaQpLHbT/DT
TLSH
T1AE52D656AB34997BCCDBD209BA517B53D6F51472E2900E44AAFCDA1C00E6BDD230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4dcb9c78362b74cb6950997d6dc6b5dba5278fcdc41bb69a578526a66558d150
MD5 d954a98868c1e57a03512f0e69a649d9
SHA1 3c3f6958f5645ada3a4322e88997f41888283dd4
SHA512 a059b27ae2446100e25bcd4d3a7f90363dafb2ec375759e46dccbadff6c1f22dba5a505c787aaaf54a746d0e03e472932db3a909b7ef0d798957db51e6a77931
SSDEEP 768:0XW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjLroInilYD:0XW7kf0Wvqidau1jaa5LA3j4+D
TLSH
T1C6D2FA3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 40220115c4c8d7c0182e4d648546daaee386f889608e5ec23bfbdb33b9c801a7
MD5 ee6ee986131ed8c1910c0ad304191c06
SHA1 e5f1731be819f83266ea05b5fb2e20fb7e3fa1c9
SHA512 96acff9703f6c11110f304ee565dc0d9a2b31e7c07d385d0760abf58383963ee717dd9f3267df74208217753dd1d9b0c03195470b2d298c4ef70081ea7e532f2
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT73sbnR9JkZ9uPIufkKjB7pkPH08ORH5yljIBKIwEUYA:KIbCKcrUAKdamuj6KIwrYIKJel
TLSH
T106912B16323B091178BD284DA3A696374F4231A33054B4AF7FB911B95E2BD224DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596085.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596085.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0f13db9c428bd8266fb7e4815a1e822b748478c684fe55a0730964b7a7bc4206
MD5 f693dd77156162a33c6442cf74b5b323
SHA1 642f0a61b15a0fe9149160cf7b141c56ed8aa6c0
SHA512 7d003066c2ec1956df2595ddb0a701119f37c1d8e5fea36cd3e03b1b4cde91f3e7f21a79e9a49fcb0f3ed71e518606efefef7bfb1d924fd97136b63034e24f2b
SSDEEP 192:uPLsNsLQK5BBbNJQmiU15T64aGBPKb++FdG24RFC1SJroydNeqKU8:ysNsLPJb5zlSd3UCEJr/GU8
TLSH
T1B032F935AC749C3B5AA2A245F44736139FF44167DBC46F48F6EC9B1C01DB69C131AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1fc880ea8a3097d6631c4daeec05b6cf369333174b6be767eeb50a2d9b7e8592
MD5 c0dd0296fedb9870e2fb2800e8095477
SHA1 62025224a9b77d08aabf2036da851e17cfd14007
SHA512 438edd5b11a5ecd1e74518060305c564aa6db075bed02c96d986254240e057ec9532040d0925835489f89dcf9c48823dba213a5c9a014eb665382804e7999d91
SSDEEP 192:uyLsNs2QK5BBbNJQmiU15T64aGBPKb++FdG24RFC1SJroydNeqKU8:RsNs2PJb5zlSd3UCEJr/GU8
TLSH
T18142F835AC749C3B5AA2A245F4473613AFF4412BDBC86F44B6EC9B1C01EB79C131AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 771accbcd759c78fa9c9ff557a63429cd7d95dd9c8875b615690647d86c963aa
MD5 ae7fe138964b840f85c58f944a20ef7b
SHA1 7ea7f0af290f958f1bfcf04f1e4d0ac0a1ca31f6
SHA512 499f0ca7f49e956e78337a0737ca1e3a17baab5ce4f112237dad1c68c4b76444f26a8af3d7f39b2be7bb3371158f7c748a3564ddb6a207b938fd8b3de3f6f8b0
SSDEEP 192:uyLsNsYQK5BBbNJQmiU15T64aGBPKb++FdG24RFC1SJroydNeqKXbxQk:RsNsYPJb5zlSd3UCEJr/GtQk
TLSH
T18252083AAC745C375AA2A241F8473613AFB8416BDBC46F44B7ECAB1C01EB69C1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b25aaaf4becef3acc4240cc6939b46c1577a44268e6a921a416b849aa2ee3f82
MD5 5ee28d9d30934ad0bc5f94b1e16b3b89
SHA1 731380b7c734fcbb944ce64bc10025bbc75bd319
SHA512 c4bdc0e7779799705a65c07e5f00f11a0473794ba62f040768d5746b6561dca354b28eacd3718ad8e8ba3046b6fb0e5d6cf758fc20b0c7c8d50f04b36dc40918
SSDEEP 192:MONi64BAQmiUyZ1wW5GBPKb++FdG2MaDztWU6:MONi6eAeCWNd39pWU6
TLSH
T12902F938AC796C7B9EA2AE45F58737175FE8113BE6C55B44EAE85B1C009774C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6e71172f058c4f6fcc9e6ce166b8d91cf1a636e155175d09a7868eb697400e4f
MD5 954f998d85be7dcdf75d53f26a595079
SHA1 a73c3263f61ec242f50d7118f727e252b892cc53
SHA512 28e35e1aae640ad8f5b048e3d0cdaf009c66b9088a31e017cf5edfc5de64e790646ad9baf335c25294ad8795bbccdce47925b7733de1e15dcf01c61d52c407f4
SSDEEP 384:FiFiZcICzsNk8TUNTUlIlEPJb5zlSd3UCEJrCGScjmwrp:MFQKJwgChwYhCG1jHp
TLSH
T1FBA26C379DA4893BAAB69645F88636138FF45173CAC4AA84F7D8EB0C01D75EC0307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1389e736d234ffd658153af02663c97604ebece3fca97c5312b51060020ea36f
MD5 502c0ed8d58883fcc28d51ba8dff09f3
SHA1 f484aa49d67f539e6770077d090a7e357e025e54
SHA512 3de989296c001b274a00d45de30d637da7bb9e48a2894dd576764c15bea4ef5581c172b5127343049372ad9b810e90bbc69b8feeca4df1bf66cfae92c6f81a98
SSDEEP 192:IONt64BUQmiUyMwX5GBPKb++FdG24RFC1SJro6WweqKU6:IONt6ekuXNd3UCEJrzGU6
TLSH
T1D6120935AC646C2B5EA2B545F48736139FA4413BEBC56F44F6EC6B1C01EB69C2306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e911b81f38f2fec83f6e9c616a82ba70271dd1707aed9f4776721fe5f2c54f06
MD5 45ef84e447e975bdcb7029006ff2af0d
SHA1 5da9f89676d18358cdeda8d53bd0251afdae3483
SHA512 0e2a558abb47856141bf1ed0ec12fc92e6bd9368d0a708899a2de24b409f29baa30e9c7c0413eae635ba291dd6339b387b39f2e4f6da3436a1e0528521f061e7
TLSH
T17A412958BAEA1148B3736E1AABF6A96E483E7D372E07D05D00010E4E4663B00CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download