hxxp://closewithclio[.]com

Resubmissions

16/09/2026, 22:27

260916-2dbq3afa653

16/09/2026, 22:24

260916-2bqgfafa473

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://closewithclio.com
Sample260916-2dbq3afa65

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340712848517305"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{1DF38F31-8E50-4DA1-8236-4781A6DF7C36}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3296	1684	msedge.exe	83
PID 1684 wrote to memory of 1244	1684	msedge.exe	84
PID 1684 wrote to memory of 4300	1684	msedge.exe	85
PID 1684 wrote to memory of 4300	1684	msedge.exe	85
PID 1684 wrote to memory of 4300	1684	msedge.exe	85
PID 1684 wrote to memory of 4544	1684	msedge.exe	86
PID 1684 wrote to memory of 4544	1684	msedge.exe	86
PID 1684 wrote to memory of 3636	1684	msedge.exe	88
PID 1684 wrote to memory of 3636	1684	msedge.exe	88
PID 1684 wrote to memory of 3636	1684	msedge.exe	88
PID 1684 wrote to memory of 4248	1684	msedge.exe	87
PID 1684 wrote to memory of 4248	1684	msedge.exe	87
PID 1684 wrote to memory of 4248	1684	msedge.exe	87
PID 1684 wrote to memory of 4264	1684	msedge.exe	90
PID 1684 wrote to memory of 4264	1684	msedge.exe	90
PID 1684 wrote to memory of 4264	1684	msedge.exe	90
PID 1684 wrote to memory of 1608	1684	msedge.exe	91
PID 1684 wrote to memory of 1608	1684	msedge.exe	91
PID 1684 wrote to memory of 1608	1684	msedge.exe	91
PID 1684 wrote to memory of 984	1684	msedge.exe	95
PID 1684 wrote to memory of 984	1684	msedge.exe	95
PID 1684 wrote to memory of 984	1684	msedge.exe	95
PID 1684 wrote to memory of 2896	1684	msedge.exe	96
PID 1684 wrote to memory of 2896	1684	msedge.exe	96
PID 1684 wrote to memory of 2584	1684	msedge.exe	97
PID 1684 wrote to memory of 2584	1684	msedge.exe	97
PID 1684 wrote to memory of 4776	1684	msedge.exe	98
PID 1684 wrote to memory of 4776	1684	msedge.exe	98
PID 1684 wrote to memory of 4776	1684	msedge.exe	98
PID 1684 wrote to memory of 1068	1684	msedge.exe	100
PID 1684 wrote to memory of 3540	1684	msedge.exe	101
PID 1684 wrote to memory of 3540	1684	msedge.exe	101
PID 1684 wrote to memory of 3540	1684	msedge.exe	101
PID 1684 wrote to memory of 388	1684	msedge.exe	106
PID 1684 wrote to memory of 3808	1684	msedge.exe	107
PID 1684 wrote to memory of 4592	1684	msedge.exe	108
PID 1684 wrote to memory of 1172	1684	msedge.exe	109
PID 1684 wrote to memory of 1172	1684	msedge.exe	109
PID 1684 wrote to memory of 3924	1684	msedge.exe	110
PID 1684 wrote to memory of 3924	1684	msedge.exe	110
PID 1684 wrote to memory of 1292	1684	msedge.exe	111
PID 1684 wrote to memory of 2592	1684	msedge.exe	112
PID 1684 wrote to memory of 2592	1684	msedge.exe	112
PID 1684 wrote to memory of 2592	1684	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://closewithclio.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ffed829c188,0x7ffed829c194,0x7ffed829c1a0
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,9201973068993414154,15093069495799029693,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,9720967560313381716,4300698001208926273,262144 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,2428604944722801845,14321702376329058748,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13572914733649017757,1459539017880445765,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1161399325319145977,11287700650151792613,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,7672043128955655451,6665737301030600017,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,16623415038950056174,14469302989986591061,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3928,i,13228150865492947862,15380567887881622939,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1881460705933746549,10058118776834293374,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,11167007010954849253,4360107544859691550,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5580,i,8964991340925832426,11127213554687513960,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,17622886407937715470,2614708222676059895,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,17622886407937715470,2614708222676059895,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4884,i,15130495545087169094,7365246387678277296,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,15218932350600810555,5297028227162269160,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,4823508655328163852,5333432460923694164,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,1649737961658745792,11595420633169964304,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,7897875977085390179,6188000445468043072,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,407586818920586953,11305571262164136189,524288 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6224,i,3176759623623218789,60261997158505800,262144 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6584,i,13795813769678306596,1889326449737856279,2097152 --field-trial-handle=2892,i,4876776222135006510,1825564269710973094,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 793527cf075279f9c06b727aee62d70ea19bd6b5ad7439caec07bc18b4d35a36
MD5 9208456925785ea73b305f9e1813d1ab
SHA1 c2c9ba50cdd71cd0220812b1213d2ae0cdb608d6
SHA512 27759fd67fe8d40ae6ed58464cc270e57b2062af273342e4f9940eae10d9fe55aabdf88976d94aed560a0f7d227a2abb3a70d383bc3edcf8e8a1de18b17c26ae
TLSH
T10ED02BC9D5443440C4233438117B4319314CDC40C803100558D8925188C1D430510860
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f349e7fa3f2d116df801eec298d7a36538858fa5536541a4e5a5e829551dfc24
MD5 bf24fed1a983cdec1a8fa7b5f52a20e2
SHA1 3a4be58385305e0c2ae36df109c56ea3fa8bb1b4
SHA512 4eb7ff8b9f16fc5befe6b12026cc83a3d85ed02629b3310a685b3e978bb6d51961d5446c9452931fd600891fd21b51203a1b4e6d1227e7674837b3629a5ce9eb
TLSH
T11CD02BC9D5843840C8233438117B4319314CDC40C803110658D8925188C2D830510860
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b19484fb662885d9d603fd47fcd17f6b7a86396832940145af4b3413fc7a21f4
MD5 9287cb772680aa1a631bd7d6967908ee
SHA1 dd7daf24ab0637c9f487ca0df02bc20a610b86e0
SHA512 58426eb81fd1db75b92e93aa85fcfb30a414926db37241c9269bf6b15635ae56e09c199175d05c510b5d5f8daa072d5e7dd44d3baf08825b47e028822b35c17a
TLSH
T1096194A89DC04CA4CFDA733095E41087397392E97EC38FED2E98DAB4D772BE52164064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5937fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5937fe.TMP
Size 3KB
SHA256 02fffcb31bb673217a733971386f989a009c07a4bd5940c31f4467682c2dcb82
MD5 36f0d80ce07dec11a4f306941fe2bcb3
SHA1 c977760564c3583a4a394d27ed64bc50f7bf6035
SHA512 165817a166a34135abf688d9cd660106834f9a647bf76d60306dff4d4dfd8c84e06dc8b5c158d14000421440a1721e84fcd88143caf1782cb582c1635398543a
TLSH
T1E26183689DC04CA4CFDA7330A5E41087397392E97EC78FDD2EA8DAB4DB72BE52164054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 919417e738650fa882ce0c03238b1aa1f40c6c2a50be7b8808effdf450a0815e
MD5 71d09f98c27a008d9a628b80aaddbf49
SHA1 caed757ea3510ed3379492913069ed273ee4516c
SHA512 c1a13720a179f387cc8448f070325a185495f8807ade3a436f873e6d8c9aa44a4e823a8e4bee6c788d0a1d0be1a5492c0daae19f4fc8279c05f02d4bfee8434e
TLSH
T10641CCF2C3D5831EDA5152F06A186E2ACE2D0A5443583D2AC9D5EF4F97F20B6D10294F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 914688cb9c6523df91656e73d711933beeeea564b2e1b3a2a3de4985b5bb4982
MD5 02ca5a361f5528539e54ebdd45be19ba
SHA1 1ca4123f299783b814f99051f2fec8474769fbed
SHA512 2553aec4d489cda1a1a8a7297106c3d8c91879209c6038d3831662f36b03b302d082fba82c14b85ba249da2f3029ae6b8942d4dc8468272901592517ea532f50
SSDEEP 192:sxZNRwWb/fIs9BTIdp3GlHW6+WNUp//Y/0GDzIgrJ:sxZNBb/fIs9BM6Hb+/6v9
TLSH
T1F522C8567E28A53B8CC7D219FA15BF13E6F9503291D41E58EAFC8A1C44E66CD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 118c2f1ccbdf65828e4a3e849383f5ebda593ac727cec55bc6f2c109a482ee35
MD5 049e8d7924dbb3d7c500ef098288ee08
SHA1 f8518535a9489f7a3b6231d1c8a16fad6c88a4f7
SHA512 1be5f6a1427ba8d5337634ef91bd9dfe2592007c1f71bab0a23dd42e3abeaa397637045fb551145f9756e2c483d9263e3c7c8b3674aa774c7fb414bfede29d68
SSDEEP 192:sxZNRwWb/fIstBTIdp3GlHW6+WNUp//Y/0GDzIg54J:sxZNBb/fIstBM6Hb+/6vi
TLSH
T12122C8567E28A53B8CC7D21DFA15BF13D6F9503291D41E58AAFC8A1C44E66CD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e1fab4d0ea9b7e5b8720e670fc62c2462a297a4b939181da1b2839cc3881846c
MD5 566047c8e0c84f12b9b3204dc0ef14f6
SHA1 030ce39e0c6c48302dd50257f7de0425767e11dd
SHA512 dfe6231acfb93998d852889a9269534b891439af1f6d7f72cc51fe549ad2d4e9944940167c2c4b119609ba573592bcd30d2b7c4a116e344d238935b841f1afce
SSDEEP 192:sxZNRwWb/fIsXnBTIdpZGlHW6+WNUp//Y/VGDzIg5aJ:sxZNBb/fIs3BMoHb+/7vg
TLSH
T16422C8567E28693B8CC7D20DFA15BF13E7F9503251911E48A6FCCA1C44E66CD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b85f895c39577a83e2dd0fc7fcaa96c72c5937edbcbd5339bc29354e70ca28fd
MD5 f6ae83d69deb3c5ab4a9723ec1a67694
SHA1 11849f2e321febc442581a5fb3145bc98664c658
SHA512 af49bfd433d9a1a2d8350e60c013cfd8557d0e22538948be742daa4e7448cf8fca26a7fc8130d6f549212e9a99f549cbcffd3b9c76aa0313abc2487c0fea33c6
SSDEEP 192:sxZNRwWb/fIsXnBTIdpZorHW6+WNUp//Y/VGDzIg5aJ:sxZNBb/fIs3BMMHb+/7vg
TLSH
T1A722C8567E28A93B8CC7D21DFA15BF13E7F9503291911E48AAFCCA1C44E76CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 13d53aa035fc2dff7c913e30cbd9b10f2efa6470023538eadfcc7a37059b6a71
MD5 02ee75d9212f27da3fbeced968488c63
SHA1 910b0bfb447698073f52e518bb5945d1f99f9b1f
SHA512 b2fb9f0872c2a04019cdf106a59ba121039c8b47c40b74a57f6776e0414dcdb8b444df6506f749e676af19571e81d8e926d1577814e116369d8af7131fd7c457
SSDEEP 192:sxZNRwWb/fIsXnBTIdp3GlHW6+WNUp//Y/3GDzIg5aJ:sxZNBb/fIs3BM6Hb+/pvg
TLSH
T19822C7567E28693B8CC7D209FA15BF13E6F9503251951E58A6FCCB1C44E66CD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 88b7079ef6a635233c38a142c85eee409b28197e0c232e44448a9cac2d00bbeb
MD5 ece70acbd626852ca5f8f9367d420a0d
SHA1 8cf644a82c45895e103b9713e2d713bc2a71e37b
SHA512 af6a1b6937b73930dcbf5427cd7836a0cdb439f886894518a7dad02482ca60e8d7d02a3c6c124bf9f5c6f98e6e2a0be4bfd15f069e891124307d8309ed2df148
SSDEEP 768:4umtKXIWvEgKc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3Llztc7vroXFo:4umtKXIWvEgKcu1jas3L9O78i
TLSH
T1EFC2EA3B240CCB7E5FC01A9DDD5A6F9B6EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ad536aa6f01343654ab25dc77c7281eac595eefa11938b5df5ef22cfd990b549
MD5 1dc7d19f220be74915eb47a0154784d7
SHA1 843c9a3e265229fe054cd1d73143b8c511db09d3
SHA512 53bfcec3c060a8f3c9656f0e73158cd75f9e92c24598ad6f0cfc15c2d4c364dfabb591d0c56dbf8b2a713c2147df7ea0a842f80993c23cd2ecf9af9948dfaffc
SSDEEP 96:KUsYKxy6aYgKhCOj7KKYYaqqEKDKoV6KmkCg:iXX76BXKtg
TLSH
T1B4E1F41131BB0201387E3D0885758B2EDA4236673428FA3B7FBD44569D6BE186EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a9e39364262962f8f3a3a2a5106e4250d24293741e4af179644ce8b64ab21a62
MD5 4dde1e757113e6b5673fbd4329a5da4e
SHA1 0897bd9b6ba1fa62265570f9812f309c0a5effa0
SHA512 15eedeb87ed40a320ef0a1027772682a27c61bbcde0659c7362f48f54363f9a38a8a8c15b1725df9c5eb2a0a9cffadf6397b631cbf5b6f3e3d08aa22df6f4d16
SSDEEP 384:xZcIzsNCkNAx3dWuDP04WysPYPcSRIZiRwzAO/77UHQ:Zz9zzWhYPQZiSL
TLSH
T1D6826C325CB8787A9EE7A141F44B3A179EF89167E3C53F5099EC9B0D01DB298031B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 fa765b7e021c2082c65f56e2ac39c14c80e68055b19a6eeb160404b8086acd3a
MD5 b9e291697dd6a535dc0e55375063d111
SHA1 bb3f9ae8aef8a9fd9d9dc99bbe453547a3f94da1
SHA512 9f57d3ebc00e90d8b83725858fb7190bb18d5296dcf9613e5a8c227709cccdd910a4a25cf0b9cf8a9f129c0947b7f83149ecbcfa1075988b88b126c7af628316
SSDEEP 384:WsNCkKAx3dLuDP04WysPYPcSRIZiRwzAO/77UI:WcEzWhYPQZiSx
TLSH
T1E66239366CB87C668FA7A141F40B3A239EB8916B96883F5496EC5B0D41DF29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 903f1f7e7e5f8885dc691c154faa78e220e500c535b859126fba9e0fec5e167f
MD5 2fbd9a9eea5722d6827580887133b125
SHA1 fe7d31bfea609b1d759876a0e7f1df74e6115087
SHA512 558cf24494c60cc8debaa0ecc958bc8f30ecc583d7bd22dce5716c43ac782ffe3b50bce25577ed0dfafbae662822eea2a2432f5079cbf7d66597757303276fdb
SSDEEP 192:vOND6ILeY9QmiUyJGRW04Wys/19YX/cURRaNIV/vU6:vOND6yn7PRW04WysPYPcSRPZU6
TLSH
T19112FB36AC79B87B5FE3A541F4473A139DA49227EA893F44D9DC2A1C01EF25C130BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 6ebef4411802836aee77d247ebe46ac74821c40556eeac6c04f3c27c35d24d0d
MD5 07a1c68c0e355523b29fa0d12e80999a
SHA1 856d8d0b44b90cdc6b66b6dee30ad1b13580d7af
SHA512 707e74c49bbf9d987c9ac51aff736d08ffab97c8bd43096afadfdc4da41c1a48ea23989f3099b703b20ce9f99c53e65182a5e1890cc8e85ab457e00a8438a2b4
SSDEEP 384:ZZcI1hsNCkwAx3dWVDP04WysPYPcSRlZiRwzAO/77UHQ:xXqEzWhYP9ZiSL
TLSH
T165B2E6F158E76836DAAE9303A77E2D179EBCD017B2842A4077E8560DCCDA27FC306516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 447acff69c48a3fe94003e5b298b7d223657762d819dc1aac6904e4538dfdc81
MD5 a8eb844a7584378829030bdb246b12be
SHA1 f94520f169087b3986fe0df96b45ca3575c1584f
SHA512 c6f87b07f0d86efcab9afd04725f419fcf654845e03126014f77c7f604185789c34437334c81cf330e5304119e62c68a2e37728a6d02962f85be8edf2c072448
SSDEEP 384:NZcIzsNCkwAx3dWuDP04WysPYPcSRIZiRwzAO/77UHQ:VzqzzWhYPQZiSL
TLSH
T1F1826C315CB8787A9EE7A141F44B3E179EF89167E3C92F5099EC9B0E01DB298031B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 efb54e40692db5ef1cf1f794d60ceb4a116f146354dc171ec0efe06bfd99298d
MD5 2bfa5e7deca8fd0a551f68534e2d5cca
SHA1 ae20a97b58767f175a5940536b8902477640f454
SHA512 f7c7a038994b7df4ef9fccc6289a97807cf1e74e099cc9e74336f1f0dddc44bab0d1eba6a5cd65524cb35b25ce3d4225d7b56b45665be1e71fb11b09e5e2b155
SSDEEP 192:vONO6ILecQmiUyqGvW04Wys/19YXK57OwRrLU6:vONO6yFUvW04WysPYQ9rLU6
TLSH
T1BD02F935AC7D78BB8FF36E45F4472B13AE94112BA6952F44DAD81A1C00DB28C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 076ae9b0c234e95e28881257c05e54eb404bc0a28b668f362bb8105207fb0f57
MD5 eff868be7592234916cc4efdb8f22394
SHA1 8cfea2452ce6889ce9b9aaa720e86b8905e3f7ac
SHA512 40119f242c678d2710c48ee8d65f7f5a582f2c72aa564002b639e736fd837d78c294aa9e37252fda6b426244aa62ae5555317220051d20dd2d225d6c6fdea3fe
TLSH
T19241254CB6F91088B3777F1A9BF7A96E497E78372E06C49E10110E4F0622A40CC62B37
MD5 SHA1 SHA512 TLSH

Submit Download