hxxp://studio[.]vogue[.]co[.]nz

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://studio.vogue.co.nz
Sample260817-kfe3tsac89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314291561900092"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{896192C4-54AB-4A88-BCEF-D98224DCFC0B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1952	2984	msedge.exe	86
PID 2984 wrote to memory of 1548	2984	msedge.exe	87
PID 2984 wrote to memory of 2696	2984	msedge.exe	88
PID 2984 wrote to memory of 2696	2984	msedge.exe	88
PID 2984 wrote to memory of 2696	2984	msedge.exe	88
PID 2984 wrote to memory of 3468	2984	msedge.exe	90
PID 2984 wrote to memory of 3468	2984	msedge.exe	90
PID 2984 wrote to memory of 1084	2984	msedge.exe	91
PID 2984 wrote to memory of 2668	2984	msedge.exe	92
PID 2984 wrote to memory of 1084	2984	msedge.exe	91
PID 2984 wrote to memory of 1084	2984	msedge.exe	91
PID 2984 wrote to memory of 2668	2984	msedge.exe	92
PID 2984 wrote to memory of 2668	2984	msedge.exe	92
PID 2984 wrote to memory of 2600	2984	msedge.exe	93
PID 2984 wrote to memory of 608	2984	msedge.exe	94
PID 2984 wrote to memory of 2600	2984	msedge.exe	93
PID 2984 wrote to memory of 2600	2984	msedge.exe	93
PID 2984 wrote to memory of 608	2984	msedge.exe	94
PID 2984 wrote to memory of 608	2984	msedge.exe	94
PID 2984 wrote to memory of 1744	2984	msedge.exe	98
PID 2984 wrote to memory of 4868	2984	msedge.exe	99
PID 2984 wrote to memory of 1744	2984	msedge.exe	98
PID 2984 wrote to memory of 4868	2984	msedge.exe	99
PID 2984 wrote to memory of 4092	2984	msedge.exe	101
PID 2984 wrote to memory of 4676	2984	msedge.exe	103
PID 2984 wrote to memory of 4676	2984	msedge.exe	103
PID 2984 wrote to memory of 4676	2984	msedge.exe	103
PID 2984 wrote to memory of 2608	2984	msedge.exe	104
PID 2984 wrote to memory of 2608	2984	msedge.exe	104
PID 2984 wrote to memory of 2608	2984	msedge.exe	104
PID 2984 wrote to memory of 3240	2984	msedge.exe	105
PID 2984 wrote to memory of 3240	2984	msedge.exe	105
PID 2984 wrote to memory of 3240	2984	msedge.exe	105
PID 2984 wrote to memory of 4480	2984	msedge.exe	106
PID 2984 wrote to memory of 4480	2984	msedge.exe	106
PID 2984 wrote to memory of 4480	2984	msedge.exe	106
PID 2984 wrote to memory of 4020	2984	msedge.exe	107
PID 2984 wrote to memory of 4020	2984	msedge.exe	107
PID 2984 wrote to memory of 4020	2984	msedge.exe	107
PID 2984 wrote to memory of 1488	2984	msedge.exe	118
PID 2984 wrote to memory of 1488	2984	msedge.exe	118
PID 2984 wrote to memory of 1488	2984	msedge.exe	118
PID 2984 wrote to memory of 2768	2984	msedge.exe	121
PID 2984 wrote to memory of 2768	2984	msedge.exe	121
PID 2984 wrote to memory of 2768	2984	msedge.exe	121
PID 2984 wrote to memory of 5628	2984	msedge.exe	124
PID 2984 wrote to memory of 5636	2984	msedge.exe	125
PID 2984 wrote to memory of 5644	2984	msedge.exe	126
PID 2984 wrote to memory of 6080	2984	msedge.exe	129
PID 2984 wrote to memory of 6080	2984	msedge.exe	129
PID 2984 wrote to memory of 2292	2984	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://studio.vogue.co.nz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdba86c188,0x7ffdba86c194,0x7ffdba86c1a0
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,14300446582049923689,12238969615188570292,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,11157854403888631745,16154888173835773278,262144 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,12229016845844662557,15909286018207143679,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,7536321005592355793,15417511314615712448,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,10334201108118437539,7619158158189756221,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16512478960786218289,1008343868739616357,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10683581189574024200,11921391225929241750,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15580678928538847950,15750200400269403858,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3384219984412899284,16102320898090576222,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,4325593148276337857,13342740947116419316,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,4325593148276337857,13342740947116419316,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,16506741438560176114,13323979473205359086,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3692,i,16116284407465404771,17606314347091035013,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6348,i,4349623858650684890,2453958929690499905,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6476,i,8220949265497398938,8477462075878072553,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6684,i,4320586273916417345,3452860412170168082,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4296,i,6345127733462556412,9266011009950078355,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3452,i,10427211390089639554,13468229565832139956,2097152 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8999080642426840576,16745904545448204464,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,7823531282344837494,4385006758598730329,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,18254514871917031988,2640043259732151091,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7591265677694278811,15787577143379473217,524288 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,12754925432155952513,12808305638233927657,262144 --field-trial-handle=2304,i,15300154466776961467,12813423215979089988,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

56db86c9e4253956_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56db86c9e4253956_0
Size 264B
SHA256 7992b3b698aeba85f7008d0a9faf96124a033301923132ad3ec36c957513656d
MD5 e0fcd0a99b6afdf252139f20f3293313
SHA1 77416f85a3c7031b8a0e269d61c2f8093a3499bc
SHA512 0fba65f0dac50f986f310f7bbb2147e03f45dee9a37ea5d62a49e2076e12f4cbc78e26afab65a24e5096446e016cf0c7847dbed042fb19521fb7d499d7818144
TLSH
T105D097E390080A41CDFD47F2EA9E12ABD113108A0C3F90DE780224720B00BFAF20DB10
MD5 SHA1 SHA512 TLSH

Submit Download

a9ace14092c68bb1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9ace14092c68bb1_0
Size 206B
SHA256 a34f2b3b97c7e3526d69d027e35bc5d8bc0d8649ec7b66326b5a70c875591835
MD5 93ea6963e7957154633c59f559e57cc7
SHA1 2b358be4b50dfc3efab4aa1be65a2430f7408968
SHA512 af53cabe2997ff32d4f82e2d1e55c602549c99990ca9cec86ef1efd49300ee6bef4c287d052861d6167afaa24ff3066b99fbdb897720c74d6c37b237017ffdc9
TLSH
T132D022E3090A0829C61885F2C99F739B8A3791AA0A0AE3B240449861A320870AEC8520
MD5 SHA1 SHA512 TLSH

Submit Download

da15e6c903b7b446_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da15e6c903b7b446_0
Size 253B
SHA256 824153128c97e81b25f1bf81f2d9a008dda4692d994141586ea3c1762cb63d8b
MD5 898ec1329d591af0b768a8352693e3fe
SHA1 8f6b6f0305e18b102819f3cdc5f03e3b4bf83109
SHA512 e67630cfa781d240e1b64355e22585f99da7d94d2e997021f21e34b704014ef68f645b84d33847f3c3a5543e2c6ccc6ca0b4cfc95639def967e798a27ef3c76e
TLSH
T14BD097F324480A20C97D82F3C68E250F920300D5187EC0E02090A1B20310FE87202210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 63e2e3de43874a02518e83f9e898292853644cbeac77bbfaacb4605956b0d154
MD5 dee389dbc0e9ab7a50aed57981cb040e
SHA1 7a487af5f8c17c5d44f144d7096fa1172995b3b2
SHA512 37206cddf54b24f95edbba8e2fe5ab16aea4ef9bb5ba7eb9fa3da5516e605b3ed4bbf628351f82371b4f5f4eb00b2382f8c0d6b54a826a5918f1c65d2b38512e
SSDEEP 96:WwFv5enivi0UNhMbFoeYM6ZqGXi2V3PexlehJs+v8yy2H:EnicNhQWvdfJh
TLSH
T13DA19534609B2F75DB21B1B2A4CA18CDBB3145E5F60B0EDE0DA0ED78648235DCEC6B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594d5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594d5b.TMP
Size 3KB
SHA256 b7cde97eca61654744d3834664d6e0dc1703c535adf64cc904e4e9d57af9d488
MD5 5e59e5690f16ef697d4dad614883bb1a
SHA1 afc58df56a7720a44ab695395019992e8b2a2f5f
SHA512 25eac3f1fbc50c5c26993b0810766e71cb63003372a586bf1093157fccaeb04badfa70bfa22fa2e5a4d81aa1efec5eb10ab4825dcf032be9c13fda6f6e222e8f
TLSH
T100715F3820474FB9EB22A17388DE209D7B3082F5F4225ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 9a85c7729d472b702958246396715736bcac99560f5727fbf5a97a090cd1ccd3
MD5 1b8e702303ea190b7483bd016929647e
SHA1 48e06bc026505861554d1b750e63c211dd5b1c25
SHA512 d76278c4e047c51abed2cef4c6b36b851bfbc9026bce7c7ca9d02206e50f6253811505d3dad356787be24983996cfc36bceef3dfb0d34697a37f6746c9d13054
SSDEEP 384:DQaOgSL7iBeRehByqeEe/eYGRouJVJl/Gv2xz2BsS6cx24p7gR2ir29Qpm2c1QYW:fnH3Ma6B2mb74cs
TLSH
T12B8287E78BF4962E8E2691F29A542D1BCF5A0815832C7867CDE46F4F93E5070E201F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6398b98cce67ea90192f630613035eb21311ec4d2d58c72368dcd78660b1fcd0
MD5 2c9a2e7401cda62512d2d57ed3b15bf3
SHA1 37d16631d7d7f11fb2fa61c3f8260570214f47c3
SHA512 908672e7452f31f54fd561ee871af63d2a5f54666c9176481de5632dcc090050a00b104be45a11a1b6de54ba9e669d78e9b4211f0230b213ae293a0e12f3820d
SSDEEP 192:sxZBHcRShks/fcspdBaFIdpodHd+d6+WNoE6/Yz0jlpIgrJ:sxZywys/fcspdBDwHdfW/h9
TLSH
T16E22A7526E38A97B8CC7D21ABA15BB13E6F55032D1952E48EAFC851C04E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cd526df95188d04a39c76ecfd7facbe7cbbc097231e67bf43e43ecde2d45239e
MD5 4a3cabe0cce482b0ffc4a8fe6282b8a5
SHA1 b4631c7f649995ddfec474f45c4ba38418d5d9af
SHA512 f5ed1ff718f045567b530c4719294b62d812f13248b14eb225ff11991a309e69be372291bc22c75019ac1d6060459f52e9fde70ccbdb905eeec8c7982bf4893d
SSDEEP 192:sxZBHcRShks/fcso2dBaFIdpodHd+d6+WNoE6/Yz0jlpIg5aJ:sxZywys/fcso2dBDwHdfW/hs
TLSH
T1F932B7526E38B97B8CCBD21AFA15BB13E6F55032D1952E48EAFC851C04E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 42a861b3a170a4109e5d3c9b9283a310dc4ffbe12603f262080a19aee4cf73fe
MD5 43e8fbc71e2c68db793e3809a4787708
SHA1 d7bb20eaeade4a44a796aad42828aa12129677cd
SHA512 416a040f07b80eafc77ff2d565dd9a7398decac06b43eef347938f92aff3ee6ee2788e8a3a5df57c1d3c0bcb047178a00c4716c3939cdd781df57db0e48fa9ff
SSDEEP 192:sxZBHPRShks/fcso2dJaFIdpV5dHd+d6+WNopGXYznxlpIg5wJ:sxZVwys/fcso2dJDVHdfLX4m
TLSH
T18432B7526E24797B9CCBE21AFA15BF13E7F5102291951E48EAFCC61C04E7BDD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f69bd4b3f5bec9b39554c057db3cc417119169ef3949d169fb9701d226aad935
MD5 861f917e8f3bc5e2e58b110571e59099
SHA1 c04fc55771bbfcfa16e63aa8b3ec1e675e11a6c2
SHA512 8e2d68655250baaaf8d326ea236fc3e9d92934673b69ed7faec6f7cc1f32572ab11c59897b65121c192d771eca7bdd39ced103e205d1b9045d898fad0b5938f9
SSDEEP 768:zzk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBeroy8YB:zzk7u70WvqiEau1jai5LA3B12B
TLSH
T11EC2E93B740CCB7E4F801E9DAD566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 1f5a59dfe6a9c028a52901bc276bb1fa820b1224d661fa89502aef86076427c4
MD5 957ed1d4fd4960ed521c73f271547227
SHA1 cd01e28ce61ac15d0eec5cba78664786fc1c7a96
SHA512 df0b20b0eade477fc78f7d7a9e06c1a7864ac89b51390bb6551fcf58a00965d24ddc647c7ce978218fe3aa9a6f7f8385c9dcf3bf0ae84065d87086f67c1db265
TLSH
T19BA002101B846256C0084AB260C643D173A1DC101115436351E089E8CCA01D0AD43501
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 597c002974f01da36f5060b92ef9c3ee17a6b607c94d2d32ea622a86d52eb826
MD5 40fdda92acadc325d8b19080b49b3d40
SHA1 33f923edfe6c69748e31bd77ae8024a1c95489d1
SHA512 b46b0a0f392465dfb81242b1eb7f5edd7e30e89776043669125615b97e7234047766f6a975613f49bbd04b8f43d86691fc4a25f9f4bd2d270c5644ec8ab547af
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfJIdKiQoPyVvI5KYIMArIZKcE:KIbCKcfJiKiQamvGKYIDruKcE
TLSH
T168919492373B16013C7E290C975A9A374E4336637418A46F7BB801611E6BF211EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcfa77b7-c3b8-451a-b852-ab46d99241bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bcfa77b7-c3b8-451a-b852-ab46d99241bb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8e5fa521c26367866274065922ae8e14ae644369d8f3fef68ca8be88978e79dc
MD5 213798b236e624b21266eb319b2b45cd
SHA1 1623371d9803e4090295d4d54a01bf3bc1071d7a
SHA512 960aabc491059a3f8b961d93050a09c14660330ad3859fccbfd325548971e49364dfcb9b8fdbd057fc8a4188152474aab40bb8061ed380bc6c306169fc48d883
SSDEEP 384:cZcIhsNJhSP+3b2I0OdWGimK0POOPrXLpe8C/sy1:KhkSSXvoGiH0POi9PLy1
TLSH
T143929DB058787C676EB6B642F48627035EFC5137F6C42B84E2ECE70C06DA6AC131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba0eb104dd086e181779f7780515f83a55636e710a81c19b5551d60cd9a1c041
MD5 5a23b27d6b3c57d2cdc23267a07ce254
SHA1 15726595ffe80b34e37f1ff6887c61104c5abc2d
SHA512 d13c307b697a03af282a997a2eee46d11f8d813cc35fa3449773609f2ed44aa1514eb215d87346cd7d22912f64384ce62aaca560730ee0c4e53dbcc77fe8bd46
SSDEEP 384:6iFiZcIusNr8TUNTUlIlhSP+3b2i0OdWGim10POOPrXLpe8C/sy1:xFQuSwg/SSpvoGiS0POi9PLy1
TLSH
T182D23AF248E7597AE9AE6B43E77D2E024EBCC123F5816644B3D8960CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6efe46641b92f6e1fc80017c12165f3c0f5627a11f423fe314b0b993b8e18800
MD5 303855259d4f633c0f78f22138b534ed
SHA1 3bcdc0974f4b2595e38d1b5b460c33aa255d6d7c
SHA512 856ef6e10d4411cd43f38e4907db81243f9a0598192fd31d19390e519ed271bb3467b1920268375e715a364e81b9ed432e9ed5c20585a89e9a8afd6f31fcae6d
SSDEEP 192:MON364BAQmiUyT1uW5GBPKmx+FdG+Po5Z4aD0MZ6U6:MON36eAcEWldWF0i6U6
TLSH
T19602D735AC796C7B9EB2AE45F48637175FD8113BE6852B44EAE85B0C01D775C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 00b71b04125728d329ae7daa5113bc53cda10d3c85a55586c5bde9f737e5a76d
MD5 21e0013e1126ea70d479cad4e3f30ee9
SHA1 88eff7d8f09db2403555b3faaf9bad86a0e65c2c
SHA512 b699513f85862782ef581c6937fc93e3418c509fa6c1e6ff2c92e1801e10532fa6a21a0fdc6fa915fc90d6b1fd8a229fa0d3337b404c59d225998ae46a667f6a
SSDEEP 192:uKLsNJVQnbyEJBbavQmiU1E/r4aGBPKmx+FdG+Po5Z7pEimMHdN0Srq/U8:FsNJV+3b2I0OdWGimK0PU8
TLSH
T1A232F9756C78AC6B5EA27645F44636035FA8112BDA893F44E7EC9A1C05EA3AC231780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2b7d5bf580eec09d9665141718bf41f18069c5d71a480afca55e8728eb3152c
MD5 3e863adb00a58b38e06103c845462756
SHA1 38d30bd32b88af7e5b35ee729f37b1e5dd2f8fd2
SHA512 5249b873d50f17fc4cb35f1b6e08bcda7285ee6821d4edde440666e9d8adeb7e7f7c45f51c883764393c5c8dc1ff878587a2fa33c278595106ca2f41caef8ed5
SSDEEP 192:rON064BTQmiUyVuU5GBPKmx+FdG+Po5Z7pEimM2Ww0Srq/U6:rON06eFZUldWGimX0PU6
TLSH
T1E1120A316878BC6B5EA27541F48636435FA8422BEB857F40E7EC6B1C01EF7AC2317406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d282b3c0c82243a0d4709aa6cab1c78f3a0ba59bfffcb11f7bee27eec846c46
MD5 f64a0ceb58e145d28bf428d49e8b7b56
SHA1 74fa1b26467dc5e67d85d7cd9eeef6f4960210c3
SHA512 210c269d5f42559f5cecfa7540576be6bc488d583d27efa5d8c2220e7051c13a92f5aa18a064f3eb35f4d79c54169ea0e754cda6f8121757a6bdcc8f031f2c1a
TLSH
T14A412998B6FA2148B3777E5AABF6686E487FB9372F0AD45D00010D4E0623A41D8B1733
MD5 SHA1 SHA512 TLSH

Submit Download