hxxps://alameda-hc[.]com/blog/2025/04/20/alameda-healthcare-group-and-giza-chamber-of-commerce-forge-strategic-partnership-to-enhance-access-to-healthcare/

Analysis

user interaction
yes
max time kernel
300s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://alameda-hc.com/blog/2025/04/20/alameda-healthcare-group-and-giza-chamber-of-commerce-forge-strategic-partnership-to-enhance-access-to-healthcare/
Sample260903-ps33msxbpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329125948221844"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{DD408797-067D-4703-B6E3-B71748BF63D1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1832	4912	msedge.exe	85
PID 4912 wrote to memory of 4712	4912	msedge.exe	86
PID 4912 wrote to memory of 4420	4912	msedge.exe	87
PID 4912 wrote to memory of 4420	4912	msedge.exe	87
PID 4912 wrote to memory of 4420	4912	msedge.exe	87
PID 4912 wrote to memory of 2000	4912	msedge.exe	89
PID 4912 wrote to memory of 2000	4912	msedge.exe	89
PID 4912 wrote to memory of 3940	4912	msedge.exe	90
PID 4912 wrote to memory of 4148	4912	msedge.exe	91
PID 4912 wrote to memory of 3940	4912	msedge.exe	90
PID 4912 wrote to memory of 3940	4912	msedge.exe	90
PID 4912 wrote to memory of 4148	4912	msedge.exe	91
PID 4912 wrote to memory of 4148	4912	msedge.exe	91
PID 4912 wrote to memory of 4284	4912	msedge.exe	92
PID 4912 wrote to memory of 3252	4912	msedge.exe	93
PID 4912 wrote to memory of 4284	4912	msedge.exe	92
PID 4912 wrote to memory of 4284	4912	msedge.exe	92
PID 4912 wrote to memory of 3252	4912	msedge.exe	93
PID 4912 wrote to memory of 3252	4912	msedge.exe	93
PID 4912 wrote to memory of 4856	4912	msedge.exe	98
PID 4912 wrote to memory of 4856	4912	msedge.exe	98
PID 4912 wrote to memory of 2256	4912	msedge.exe	99
PID 4912 wrote to memory of 2256	4912	msedge.exe	99
PID 4912 wrote to memory of 2264	4912	msedge.exe	102
PID 4912 wrote to memory of 3172	4912	msedge.exe	104
PID 4912 wrote to memory of 3172	4912	msedge.exe	104
PID 4912 wrote to memory of 3172	4912	msedge.exe	104
PID 4912 wrote to memory of 4876	4912	msedge.exe	105
PID 4912 wrote to memory of 4876	4912	msedge.exe	105
PID 4912 wrote to memory of 4876	4912	msedge.exe	105
PID 4912 wrote to memory of 2480	4912	msedge.exe	108
PID 4912 wrote to memory of 2480	4912	msedge.exe	108
PID 4912 wrote to memory of 2480	4912	msedge.exe	108
PID 4912 wrote to memory of 4752	4912	msedge.exe	109
PID 4912 wrote to memory of 2996	4912	msedge.exe	110
PID 4912 wrote to memory of 764	4912	msedge.exe	111
PID 4912 wrote to memory of 4180	4912	msedge.exe	120
PID 4912 wrote to memory of 4180	4912	msedge.exe	120
PID 4912 wrote to memory of 3860	4912	msedge.exe	121
PID 4912 wrote to memory of 3860	4912	msedge.exe	121
PID 4912 wrote to memory of 3860	4912	msedge.exe	121
PID 4912 wrote to memory of 1676	4912	msedge.exe	127
PID 4912 wrote to memory of 4788	4912	msedge.exe	128
PID 4912 wrote to memory of 4788	4912	msedge.exe	128
PID 4912 wrote to memory of 4788	4912	msedge.exe	128
PID 4912 wrote to memory of 2200	4912	msedge.exe	130
PID 4912 wrote to memory of 1124	4912	msedge.exe	129
PID 4912 wrote to memory of 2200	4912	msedge.exe	130
PID 4912 wrote to memory of 1124	4912	msedge.exe	129
PID 4912 wrote to memory of 3804	4912	msedge.exe	131
PID 4912 wrote to memory of 3804	4912	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://alameda-hc.com/blog/2025/04/20/alameda-healthcare-group-and-giza-chamber-of-commerce-forge-strategic-partnership-to-enhance-access-to-healthcare/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9022642487745352287,10259575268195537410,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14194240391297931133,515408786461699044,262144 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,3588640741219726400,4680427904426180668,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,10712417319346977321,4309371254434853840,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7725942581399734437,3856055002133666577,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,16906859811868119650,9271446678768043434,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3758609407006780700,4398815286299474727,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,12862506826623745247,15594259680188390767,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,14762891453801119013,1750825313192315425,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14244380260509842558,16610588381159701222,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14244380260509842558,16610588381159701222,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,1695624264749407241,12371416902899992875,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5860,i,2927669015758367780,18276005641580162145,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3432,i,12402510163320729980,8473962920057758914,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,6390386374613930611,17778226504450553058,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6449194762961283138,6270357137571407507,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,8996421035615787289,13062833395312526863,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,9717416707719064888,6434519076641524611,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5812,i,13939894774427412643,3637466801727981520,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4968,i,15988246021245669949,14449694706384397974,262144 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6128,i,6522348549267246817,5586301545540191219,2097152 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15989638340466707365,17082394827147075914,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2199139317754381093,2572451445476508804,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5774373726133450833,4245945072845946069,524288 --field-trial-handle=2252,i,15211938568784621342,11703112045525582232,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

30ecf03a-bfd7-4ef4-8f3f-6f0553393324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30ecf03a-bfd7-4ef4-8f3f-6f0553393324.tmp
Size 12KB
SHA256 0708db38c787b5e5e16226b570c13b61dd8fd9f347fcb51885eae2d76833af6c
MD5 a15a5362eefe5e71be72937cb2bacd8d
SHA1 9522faf2ba58d2d3b5e2d2929dc9049717bf2e78
SHA512 9eb73dfa89215d9fa178b496aeed848ff853c2d759aab894629653c556976994da9e610edb59e15c745d40a8a33a8d5b556dea028eb041f664b926d706d84e8f
SSDEEP 192:sxZTRGyM/jK1Ml8MkV/fNs9Emi9V3IdpJHW6+WNGYvxGjMwIgrJ:sxZTQMV/fNs9mQJHbGL39
TLSH
T11442F811AA34697BCCCBD20DFA55BF53D6F94462A2900E44A9FCCA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 29fdc2b5e230bd11b667912ccf8efd988aaca79c1e9d05192285cf9fb817a447
MD5 bfb3a4349bf17cf1a97cdc2af474c143
SHA1 df3e64a07c4a142e55b59ed7ccb6a5b4ae923604
SHA512 b7f2ad8d1689592108cf9972bf3186b12bfd84914535324e323f19344d8605a0174d8350fa932ebec2ea3d40de82fa7909956969dfcc3481b539706b2b5616df
TLSH
T1BA61C5710A9312B1EF14C63294DD025D3773C6F7FA1B6E8990805633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ffb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586ffb.TMP
Size 3KB
SHA256 bab7c400671dbf15865cdd32699e990c43a967557932e9389bbc68cb17814ffe
MD5 174047710c90f72c380f03af03253a79
SHA1 8845113b88aced6591212c37d99586d7484bc9c8
SHA512 85eebd2f9e6eff204a41ef75f7c51924242393ea655f588afc1da0d6d1fe60113d6644b08585a33487d362230063578eaa81d74b5bc27c61a8514cc8d22a07e2
TLSH
T17461C5750A9312B1EF24C63294DD025D3773C6F7FA1B6E8990805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 706f4b9cd1e54a693722867784167f390044bb2293c3b85bd551cca537e20e6f
MD5 c7d1b7b01f1471bc8cccbe3fd2448f1c
SHA1 4f653c2066092160b9ed5d251587afb3f4918400
SHA512 dbbeba5fc5442d5c475373aa2f319d7c945823532152a587cc71565b18f8b867450f00819a41163eaca357e327c008eba463bdc2671e4e3683e569e3fa2fc6c8
TLSH
T1CF117DB3C3D585AE891116F0AA28AE2BCE2D0516831C7C59C5D8EF2793E3075D10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed78960a815c535de2ebd15201d3974d307a3dd8a0f1d149bfcb2b03ee14cde1
MD5 43f8da4f3fcaa44a5de9738194bd0abf
SHA1 fd01d43c5fd6103607524dde43f7a836bfe2753e
SHA512 fa6e516648d1d7debfb6985dede5e0170f497373f76d80bb14a10b95d112d676e37683257453f1f5d8c7223340ef83a14e99fb5ec1897f7a7038d3d37b8f117a
SSDEEP 192:sxZTRGyM/jK1Ml8UQFkV/fNsKEdioV3IdprDHW6+WNGYvRPpjMwIg5+J:sxZTQqOV/fNsKh/fHbG6Z3U
TLSH
T11F52D712AA34697BCCDBE20DFA51BF53D6F5547292900E44A9FCCA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 11fcf121a9b78a19636ede29cc97c39f20fcd9a8885ba93790a9044bb9efe29a
MD5 33af96b11e43c1b9c3728460fcd4d20a
SHA1 6b2dd54a0fe21cb6129797c6d70d1c83f5d9d0d1
SHA512 37be4a4727012cff908c4f5143443771ecd526d648df2aea1381f73cc9dbf3f8726352eee12716715bfdc9a0c7207c0aa90c5224df45cdaa457dac4ac4e6dec9
SSDEEP 768:v/seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppYro89:v/seJ3xWvhfynu1jaVcL88pjC
TLSH
T1ACD20A2B680CCB7E4F844E6CEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3cdb033612c1983dc867eb0e9210466b046ca42243935ba7a08adfb5e98ed4e
MD5 a9bd343b5d60d50e5072377e9ce7ff87
SHA1 482cf23470bf41cf2695333493ceab79f3e64f45
SHA512 b1057c87aec09db2caa5971c912fc21d496f00eb8b5dfbd1ddecb0695791efd59fc0c47c532696544be09c186c43de5bd040073a31cc3dc83a19afcd1c47bc14
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EX:KYHIhKggkXySdIxK+cMjyxIIjKtCs7yV
TLSH
T1A891751A703A03453C7E284DB292963A5E8136A37419F6AF7FB800615D67E264FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590c3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590c3b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5a9b9f159a0141e48e388ed360f7692e6732a4e1084e6b0e0761f08151f6eafe
MD5 aa6f5df7527c5ac668007cb04451b6ac
SHA1 a14f4022783d1ee0a1907031835f8ee2a18366ae
SHA512 f8a5dd84a46a0850d6b5d557b91c87d66eee4ee1096395243a89bdd3977aefdcb7efa6ffdf892c452ef51d6c29701bd6ff65590658ac101c412f26591a43e728
SSDEEP 192:uHqm+xasuheOwQxMGsNgWoQQrvM7M/W8QmiU1nIKX4MTobWCIK++Wyi48z1BqQNa:yJZcIhsNgjVrU7GWMeKIzFIKPlIxNa
TLSH
T1C3626CB2ACA89C7A9DA7F146F4CA33134FF89167D6C45A40E5ED6F1D00DA268130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 26b0d6de6c3306f70f3dac51d86ad66688f00a7c47004c8f6708972b9de319e3
MD5 afa998950ce0f49c5e24e0e09b081dc0
SHA1 24db05644eb1ab776ee7554030a5a5bbf6aa1b7f
SHA512 348f7da3d71b73582e43840a511f98afd7a1f4c517a3844f0e112556ebc943749c116a668e144f5341d5e212f4aa0f563482b73a98945a7b39e01131ade13b1e
SSDEEP 384:ZAiFiZcIXsNg8TUNTUlIlmVrU7GWMeKIzFIKPlCxNa:BFQXJwgIULPFxlCxNa
TLSH
T185825B73AC94987BADB7BA45F98D33138EF49167C680AA50F6DD6F1C009B1AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f873264f1166cae54e7dfbc71f20f7bbbf1ebc99ba98f426eb9d659c47d10b21
MD5 5c39272c37c30f9e0545eaac1e454ec7
SHA1 cc7ae427a6eb030dad2e56a9ce9a28f5357a4d8a
SHA512 7e189acb5e3d6787739e86790add9a56e1446249a7f4276ad4522a5f045d985817451f72b21c21cfab131edba4a18389c73ded644c43f0726b9f1dd389f74903
SSDEEP 192:uoqm+xasuheOwQxMGsNgloQQrvM7M/W8QmiU1nIKX4MTobWCIK++Wyi48z1BqQNa:BJZcIhsNgmVrU7GWMeKIzFIKPlIxNa
TLSH
T17D626CB2ACA89C7A9DA7F146F4CA33134FF89167D6C45B40E5ED6F1D00DA268130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4403e8b4d08f45e2416f6a1683e1620a9073386191e8d221619a5c0f43afb6a
MD5 0acdb69a574a2472d3a8d93e52190628
SHA1 f8a20f210133eb18e4facaf5fc80e0fa5e03def8
SHA512 06356e357b0d266cf18d146c562b06aab4be5e83f4024cbd8e8027e46393514252908ce3fe1c8692c107b78918598d94f5a2f553b35a0177328dfd33061a4fad
SSDEEP 192:lONG6vMtPQmiUyubThTobWCIKp8478LU/u:lONG6UtR9TiFIKRiU/u
TLSH
T1A5020875BC686C7BDEA3BE45F48E23171FE411ABA5905B40EAE82F1C00D765C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7128fec67496495f1d06c548d01a1e6548b66fefd8fa522b60a202f8faaa54f3
MD5 296934ffa6c6fdb5749bd2f1cac2a694
SHA1 bdc91a49d4cda8122b0f740c3f2b381d50f920b2
SHA512 16bb36fb7678c9d3ecaa3c1019e6a9ef9541311f104c9c55ed3922d464ae6fc3b0646766e3a869810460c18a19ff0ba91ebb068beee4cacc34105bfd1710c6a2
SSDEEP 192:KoONp6vMVWPQmiUyWbK4hTobWCIK++WyiT80IBqQU/u:KoONp6UVWR/K4iFIKPlNxU/u
TLSH
T1D7121B72BCA49C6B9D93B555F48E32131EB4826BE6849B50EADC3F2C01DF66C2307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e5145f20484f15dea07418770f6b138a189ee6e3f8604e88604895ebaf24c39
MD5 806ad03d55718309665ca77136fe4279
SHA1 e60ae34bf8b3cded11e96d2da5f7b7e931cf5de1
SHA512 9d36647968a4154ba390679baf18df84bc6f7c75522deacf196f0ad0f7bb1b3823441d981dea17fe00b34c018f77d904410afb985b71c9e1885cf6eab54ec16d
TLSH
T15E41E958A6FD1148B3B7BF5A9BF6A86D44BEB9372F06945D10110E4F0A62B00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download