hxxps://appdoze[.]net/davinci-resolve-studio/

Analysis

user interaction
yes
max time kernel
80s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://appdoze.net/davinci-resolve-studio/
Sample260701-vae6rab18z

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
223	api.gofile.io
224	api.gofile.io
228	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273980365170350"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E29931CC-705A-4B53-A793-B66113C977C3}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1368	5040	msedge.exe	87
PID 5040 wrote to memory of 4812	5040	msedge.exe	88
PID 5040 wrote to memory of 3636	5040	msedge.exe	89
PID 5040 wrote to memory of 3636	5040	msedge.exe	89
PID 5040 wrote to memory of 3636	5040	msedge.exe	89
PID 5040 wrote to memory of 1340	5040	msedge.exe	90
PID 5040 wrote to memory of 1340	5040	msedge.exe	90
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 2932	5040	msedge.exe	92
PID 5040 wrote to memory of 2932	5040	msedge.exe	92
PID 5040 wrote to memory of 2932	5040	msedge.exe	92
PID 5040 wrote to memory of 860	5040	msedge.exe	93
PID 5040 wrote to memory of 860	5040	msedge.exe	93
PID 5040 wrote to memory of 860	5040	msedge.exe	93
PID 5040 wrote to memory of 1968	5040	msedge.exe	94
PID 5040 wrote to memory of 1968	5040	msedge.exe	94
PID 5040 wrote to memory of 1968	5040	msedge.exe	94
PID 5040 wrote to memory of 4116	5040	msedge.exe	99
PID 5040 wrote to memory of 4116	5040	msedge.exe	99
PID 5040 wrote to memory of 4116	5040	msedge.exe	99
PID 5040 wrote to memory of 5024	5040	msedge.exe	100
PID 5040 wrote to memory of 5024	5040	msedge.exe	100
PID 5040 wrote to memory of 3512	5040	msedge.exe	101
PID 5040 wrote to memory of 3512	5040	msedge.exe	101
PID 5040 wrote to memory of 2576	5040	msedge.exe	102
PID 5040 wrote to memory of 2576	5040	msedge.exe	102
PID 5040 wrote to memory of 2576	5040	msedge.exe	102
PID 5040 wrote to memory of 3880	5040	msedge.exe	103
PID 5040 wrote to memory of 3880	5040	msedge.exe	103
PID 5040 wrote to memory of 3880	5040	msedge.exe	103
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 2032	5040	msedge.exe	104
PID 5040 wrote to memory of 1732	5040	msedge.exe	105
PID 5040 wrote to memory of 1732	5040	msedge.exe	105
PID 5040 wrote to memory of 1732	5040	msedge.exe	105
PID 5040 wrote to memory of 2720	5040	msedge.exe	106
PID 5040 wrote to memory of 2720	5040	msedge.exe	106
PID 5040 wrote to memory of 2720	5040	msedge.exe	106
PID 5040 wrote to memory of 4956	5040	msedge.exe	107
PID 5040 wrote to memory of 4956	5040	msedge.exe	107
PID 5040 wrote to memory of 4956	5040	msedge.exe	107
PID 5040 wrote to memory of 2612	5040	msedge.exe	109
PID 5040 wrote to memory of 4188	5040	msedge.exe	110
PID 5040 wrote to memory of 4188	5040	msedge.exe	110
PID 5040 wrote to memory of 4188	5040	msedge.exe	110
PID 5040 wrote to memory of 3804	5040	msedge.exe	117
PID 5040 wrote to memory of 3804	5040	msedge.exe	117
PID 5040 wrote to memory of 3804	5040	msedge.exe	117
PID 5040 wrote to memory of 2452	5040	msedge.exe	118
PID 5040 wrote to memory of 2452	5040	msedge.exe	118
PID 5040 wrote to memory of 2452	5040	msedge.exe	118
PID 5040 wrote to memory of 4652	5040	msedge.exe	119
PID 5040 wrote to memory of 3428	5040	msedge.exe	120
PID 5040 wrote to memory of 4536	5040	msedge.exe	121
PID 5040 wrote to memory of 4012	5040	msedge.exe	122
PID 5040 wrote to memory of 4012	5040	msedge.exe	122
PID 5040 wrote to memory of 4012	5040	msedge.exe	122
PID 5040 wrote to memory of 5088	5040	msedge.exe	123
PID 5040 wrote to memory of 5088	5040	msedge.exe	123
PID 5040 wrote to memory of 5088	5040	msedge.exe	123
PID 5040 wrote to memory of 4260	5040	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://appdoze.net/davinci-resolve-studio/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffd51a5c188,0x7ffd51a5c194,0x7ffd51a5c1a0
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1168761925378523285,14499179762721891384,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15039150082918494557,14522476600199746195,262144 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,282922223852682828,15456523393345657066,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3288,i,17616530757449829691,1449724834120913019,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,12558635729792457678,1063765215508457269,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,2037464926443377780,4913880252230925061,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,15137649001013956799,15372978585989289375,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4984,i,3718566838713791824,1931449998629959603,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,7714654669971357237,4105807082515662064,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,14089213141278869488,9256875640546549571,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5656,i,9319352270943149317,17132423959275578433,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5840,i,9682963586965887287,9978796553105390655,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5656,i,7374790736946820667,16517399492267577405,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6260,i,234809829585768644,16574033271465763301,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6488,i,1722224840455802883,12557427470466888538,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6732,i,18222880130918033452,10988111646727462364,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,9551379455061489608,2990523750650524122,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,9551379455061489608,2990523750650524122,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3496,i,3293350150181916201,500434250002198572,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6784,i,98123812957515621,1062578510675710593,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6420,i,11670728099188547200,3697413372280746565,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,14488391140354845406,8847646377758331419,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,5269084841319477062,10035349053735286398,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,13551928563820032898,914065615466818887,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5108,i,1308566390938071220,2441471088842767273,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4956,i,15666972670071229041,15741503624754255801,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=120,i,12448501205466683983,8074456249110631419,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5724,i,2223785568528113685,10908072072653551174,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5056,i,12840685042354428013,12051754314565589808,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4772,i,4762407931845089020,14991398978850709223,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,4215705501621424615,8744732618647235050,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,11531343089874289097,7444038534039301080,524288 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7700,i,16734112860139207980,15859056982965208160,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5660,i,6513131819929652568,17882484796734241444,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5332,i,17727361201077640619,2106230777018994437,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5420,i,10316128156983425278,8409236534687255401,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7044,i,12022061031845349141,15355211527869652033,262144 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7436,i,16564938620634275860,14596928887628105737,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4992,i,3975552955855323891,10892888824736002267,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5448,i,14262665812325517636,6097826699785695105,2097152 --field-trial-handle=2440,i,13357471993272330338,15882960025170748005,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 21KB
SHA256 d0a0efc36ab4b88d766febe951f5cb33727708cf8abb1ac5f1f85ad9372477e1
MD5 d8e125f827ee7a9565310c254da956f3
SHA1 fd6f564fa15707612da3eda0d096bbc2a979a40e
SHA512 81dcc8ffa175c378ab986ed00f515a3bc2b8f34920e3088ef942d5cd18e1d49dc7ede241e37c8a9260a21e2f3bb63c0886f0db62ae3e51ca902413b52e690335
SSDEEP 384:1xNW9InFtzWaWOBPuamhs3IqJ9s8z6SWUcctLFeycZQyx813e8QIsdbhIZnQrUWW:Lg9IFtzWaXuamA9cUcI5eycJ8V3lKl0
TLSH
T102A2D174AA7A6A402BB5CC9D3A6C7B4B18C3574F698750A45AC800CB7ACB2934E05F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 41KB
SHA256 ea873f38b4f60013c167547931ccbdf06ee84e54e9df621d5739c0ab93772182
MD5 1ade95f90c8445801f4e262e06fa4254
SHA1 9ff077077853386f8f8624c14559a6dcab61a5d4
SHA512 5617c53e9eb469c6978687ad252bad92ccb34edaf95a9043626ab8e0560b6bf92852a11151d0ed6dcce97c2563b9eef5b32155d044fb9be5dc16ebdb830dc1fd
SSDEEP 768:BE3slrz25obzpfud199N1W6rtq0F+u4yls70H2cfUO8LBFx6h+EA:BWs5z2abVKv9N1WoA+s70RUHB6h+f
TLSH
T12213F1C389FE54633C6C82D74EBC351D7AF430454A2BE3E7ADD160220F255657A8B8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 54c47be5b94ae1e50e6ec8ab254c54ac55a41c929151da82853931c89b652f03
MD5 20b80ecb6d6bd334bd20f3f8dade5388
SHA1 71a6f8b5dba510551865d783800166038baeed82
SHA512 dc798927f790ff095a62ab3e64d3ec468ab26e21ad7d2e4721c5398a521f4ab185fad4e0c64b5e4f4d58d3553a8324162202bcd95991a054269667b1d5f32fd5
SSDEEP 48:+v90slxKCXH0wyAxLGOCPa7gb3Gm7JjXZNoWc0HRW4WUn4caytfMqtcQBXPSWjNF:axKi0TAxLG9Pa7gKGNoWcKmU/XtvFl9
TLSH
T1B9913D35028E00C8E75DA2B9FFD20600BB3996EBFF97AD7AC492A93C990375D4549845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0dce15c93bba473f5cf821be141f851c1703345280a54c14b576d3e8d1a5b896
MD5 02cf6e2bbb76b031db240b0166419a61
SHA1 2df820b6ef93816a5b4efd2f8b8e6dda3d3c5fcb
SHA512 f68e17f0c2d97afc6b1b4fd34399d51d114d4c1c8ba482d287a360650db5196897fee8acc99987d88b97aeaa0f1f67be8c9f79ee69829874a8c1d60084651c24
SSDEEP 96:KpvisqsfLGm39fg6GNhAjWcaN8Yqt1FUSIP:KpvrLL3JgOsCXg
TLSH
T1C2B13FBD028A00E8F75D72B5FFE14A14BB3D92EAFF479D3E8452B53CA50376844058A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5655904e2f88fb20038685bf14b49893cf0b2eee324bcb99f7abd094208fb46b
MD5 e0a7d1a9637813b91b831de27c03e6ca
SHA1 611a1db6ff391a312601fc21c1f78d3b40f0f2dd
SHA512 376a131fffb908cbbb05f5d55e26b0322b27f930dba2f4d0440692b9c72f822c6d39b1a143962ea5188588106ceacf00961be04ab508d830e5b0af1bc1f0c3e1
SSDEEP 96:ApvisqsfLGm39fg6GNhAjWcaN8YogJt1FUSIg:ApvrLL3JgOsoiXv
TLSH
T1E9B12EBD038A00E8F75D72B5FFE14A14BB3D92EAFF479D2E8452B57CA40376844058A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586c23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586c23.TMP
Size 3KB
SHA256 b2a4bfff97fd94d1c4fb5e93bda83d92c435ee8d195a4fe39df82824e835b9c0
MD5 150853e58677c023a0093b132fed738a
SHA1 52d4cc7a3402e202ac585d07a3efda205d6d9528
SHA512 8223e9e55ad3a93972faf93221c26afd7df32bbede853b4ab13a09576d56dab093d56bbd16e6446d850ec9c6c80e2229889490010c117a40736719a3e0c3a784
TLSH
T17B812F35028E0091C75DA1B9FFD10300F772A2EBFF97AD76C492997C980375C890AC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 d4e66939e5ef08e750e0dae4ec98e6ff8a8c93142316f74d0e95ed88a83eed8c
MD5 95da805d4482b4492f7e04b2050ef591
SHA1 2ca3280b4c527922561689ed98de72d03ff88267
SHA512 c56c663931a02975ef3dcac6078898c3234e3014792c6c363be38928f1c9356bc3044f84928406b8b635bf6e94c742454b0e95cc854fc1b497167dd49e96a670
SSDEEP 384:DtVlPkJhmiuYX5hMIF3JJJCKYR31xYVYaRRqG0Yq1/cJW1CMD2Jb80wbpyLdISPy:XC3wx0qwUl
TLSH
T13842BDF3C7E8862DD82252F46A147E2BCE5D0925433C3D6A8AD69F0B93E2571E10578E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 eb0f54339b10aae5d4d842552c33fc348f54ce7b29df96168deb422479707c08
MD5 f1944a97a1fda3094a5511b640760ef8
SHA1 ccc096ab21deaf52647320315fae631b4ea9f891
SHA512 a1bdedef352192a38b3ef8d0eb69df33ece6c5db028b6f88195d380dd7ccc3cce8845587ea91882f034cbaf05d610ea79a72e9cc38fb126f101a768b18a44862
SSDEEP 192:DtVlhJkJhmimJYX5hMIF3JJJhkMGxYVYaRRqG0Yq1/cOqW1CSXD2Jb80PodBpPKS:DtVlPkJhmiuYX5hMIF3JJJhTGxYVYaRI
TLSH
T1F522BDF3C7E4852DC81252F86A14BE2FCD5D182543383D69CADA9F0B93E2571E20579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6f4f0fa813cb3a031399c43d147751d98875d7c8589d023dc54d62b4c15d272a
MD5 f4a14b6de0ad45445c9d579a3db6248a
SHA1 8deb18fddbf5449e4fca0874fb413952885a1999
SHA512 66d2e23436833dffa24846f0e515429bd10ec58f9f1a7b8085e84099d7c811b62a09f14df48e57079013cdf70c855648e2dc72af977f6a580491e4a5423a3ec7
SSDEEP 192:sxZVNXRI9yM/jK1Ml8MkYs/f42siuUdHVqDCIdpJVkOV5HW6+WNUVHVDp4/Yz1HZ:sxZbGMH/fns72A0AHbW4/O9
TLSH
T1C952D752AA3459BBCCDBD209FA45BF53D6F5547292940E44AAFC8A0C05E7BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 735eaa997c6e1c19acd72b4e05d6d3c10215687af823bc89b139097b56ee8200
MD5 65d387f37b9b9361e891dfcbfebddbee
SHA1 f7171b36166a0387038ef4556ab186826b339300
SHA512 995131564ce1e9dea685d78bab96da0cd14885c85d074511527fab8e4c784e75eb134b032cf21fead9aeb33842ea9e915745de2115904e59902759f702e15fe5
SSDEEP 192:sxZVNXRI9yM/jK1Ml8UQYuXYs/f42sYwcKUdL7VKDCIdp3VKV3VLOVRlVPHW6+Wm:sxZbGqDH/fnsVywS2HbG4jt1Qf
TLSH
T10B62A752A5345AB7CCDBD219F941FF57D6F5646292900E44AAFCCA0C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e4e76eae70cdb9e15f1571806dd21749d66ba9ccab7fe7953537ebe3d73cb010
MD5 3b3c1a0ef0cc8da073d43c22e2158aff
SHA1 30675c9c77154649423e7e62d0d921951f95906d
SHA512 4ae380235827ee7c043c790c7f34bcf7fdae97733e92135a784642217d75dd857296a16e6690e9f47e1e075121512791f24c246621303c89eb9fdffd07d15f33
SSDEEP 192:sxZVNXRI9yM/jK1Ml8M9Ys/f42sYwcKUdL7VwDCIdpJVLOVRlVPHW6+WNUVNMVO5:sxZbG1H/fnsVyub2HbORdRf
TLSH
T1A152C8526A3459B7CCDBD20DFA45BF53DAF5546292900E44AAFCDA0C02E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 45ca045d35e873acdfe326ed0c074f1c644e8a15664395857a591707c752ce18
MD5 2c0ea87d31f43df905bd27a8929abafb
SHA1 ba7043c6c2bd80f43854b5dc686492ba1093257a
SHA512 69c3d9ad21388c6dec69e110d5b4eb72c29c6c5dde766dcffebfdd166288c17ca509ac105c714652ea553aa8aced05349852167052b666061f060194406ae71d
SSDEEP 192:sxZVNXRI9yM/jK1Ml8UQYu9Ys/f42sYwcKUdL7VKDCIdp3VKV3VLOVRlVPHW6+W6:sxZbGqJH/fnsVywS2HbG4j81ff
TLSH
T17C62B752A6345AB7CCDBD219F941FF57D6F5646292900E44AAFCCA0C02E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9f412daac7b57302e047a49981163f130442325b9830372b42b3c51c15e8635b
MD5 5e5fe24321eec4c238fd8d5ddbb9b297
SHA1 bfb35683471c927fce821e3a7ebb670c3aa7fcce
SHA512 707e9611c740dfd04cc94c28eb81ecbc7659a4e05b107dd9efd72f31f98f952dd03ea78ba851083aa4611bb9c5c7967c2bd64c901da443dea48231e2ba43a0b5
SSDEEP 768:DeW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjgroIyinYAj:DeW7kf0Wvqidau1jaa5LA3jr1Aj
TLSH
T194D2FA3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e84d7109888def10c1713b3c1fc49b521aa656ed6dd1663594c23c3fa9374441
MD5 fa9a1fc69e6f83928d60906f98924ce6
SHA1 0c9b970d8e5930514fe57f5c2ff1a72f0512fa1e
SHA512 dd2d661bdebc80a684b8eff3f8550a26d53c4c83a0cebd6d0ef7d44eaadac22a44c505d6959cbeccfc65051711821394a2e488e76e971d0dd2053bfedfdb10ea
SSDEEP 96:KIbCKcba0K/qmOVGKmc2v4dZvtNhW528gBhK4Igvhc3I:sELBtv4dZvtNs529BLIgvO3I
TLSH
T11B913006743F4612387D2848A66696668E8271A33569A4FF7BB800721F37E114DFFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d10c9bc487c5001ba442d3983683d316d1c51a59e8de111e423b8a1b436f0d8a
MD5 327e6c3f7ebb0da259700d509ad89ff4
SHA1 352b2cf9c42106a07343c64292d805ef223fe293
SHA512 b41370f1628d0ead9d0538f9ee5ff370433384dc41d4f103b7ad1ce2d277b44c5d099516de0b5be95095d446508c27035eb162122480a048778976d20ad3ed46
SSDEEP 384:RtNn/s3n9SfsNIH6HqbWQdl3dMjCEJrw/X0IidKzv2xRw:Rj+9UdLt6hw/78KzaK
TLSH
T1E8928D366C7A5D7B4DE29184F04B3F179FF88273A3852E54E1DCAB0C02DA7AC231650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b5b96d71f857b583905fdb2fdc882b0f90cf6402abd973e8983fdc995dbd9bc1
MD5 fe93258235a305158e33308d126820d3
SHA1 264682e08fc26cba4f1b6abd274630f6d2953988
SHA512 1cb93e51946af874a14ca9f32410b214fb1624454cc4532f67d20e01f00977a8318563d796ad4b30fa6efce7277099712cd935167af2757aa654660d30174870
SSDEEP 384:TtNn/s3n9SfsNI46HqbWQdl3dMjCEJrw/X0IidKzv2xRw:Tj+9UALt6hw/78KzaK
TLSH
T185928D366C7A5D7B4DE29184F1473B179FF88277A3852E54E1DCAB0C02DA7AC230651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d0323e17ce8c513b10dd07909975d4fedd45288d35588a4c1b7e8941e6506990
MD5 1174b8ea89a49886f5059ddc487fb67d
SHA1 713fbb69eb25e9abbc42391f27e08d3538cc2408
SHA512 5b4fa8636ad9c6e2a8cf207bd116634e9ced1512dd2cb3cc55314310dbfa3df5695eea8319a57248dd4748459cd617d08b34e25e28f55a145e189e94bcfb8dda
SSDEEP 384:uHiFKtNn/s3n9Sa+sN48TUNTUlIlM6Hqb6QB53dMjCEJrc/X0IidKzv2xRw:tFKj+9gxwgyjh6hc/78KzaK
TLSH
T140C22AF258D7497AD99E4747E73E2E039EBCC163B2816A50B3C85A0CCD962BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1bf16527929ee9234bfd3ed5fac8c0daffd62f765653d8aa70e892f204da3840
MD5 7c55a73c5cf79f125fb556ecdd78474c
SHA1 43ff5cab97f4ec7a79b71678f633fe40c355c95c
SHA512 671e3b0cf6eead1caef55c6a414f3b090a4e788298cdb727a6fe71aa33b3960f02e3ce2ac8d27cb4c76efc1e50157eebbcbd151410918fd4d7513b2769ac1057
SSDEEP 384:uHiFjtNn/s3n9Sa1sN48TUNTUlIlM6HqbWQKO23dMjCEJrz/X0IidKzv2xRw:tFjj+93xwgyIOk6hz/78KzaK
TLSH
T1EBC22AF258D7497AD99E4747E73E2E039EBCC163B2816A50B3C85A0CCD962BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b219fbabd1c2b0025e79795f0b9ed9356f99954b24757ba297060e76f79063a
MD5 8c77bc36e5b687b8a61975656de3fe77
SHA1 ef77d5f0bf1f9c72d28629940a50d86cee9eb931
SHA512 5c4cd23c03e8e5dcbd4ca9c18bc74687f25f6d1017a336d6740565ea3464e4ea5a9e12828b613b5e4862cd0e30f31e665dc9acf9f9550e72e89a5f394a79f2e7
SSDEEP 192:MONt64BAQmiUyVkq1VBW5GBPKnn+FdGN9Q1aDilT8U6:MONt6eA1q1WMdMRo8U6
TLSH
T1EF02F935AC792C7B9EB2AE45F48677176FD8103BE6945B44E6E82B0C01D765C230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f61ea6db34156ea322f194fec5152ae43192612073dac46752c3d9e788cc751e
MD5 ad798e5bb695eb0d08c5fde32f0bc52a
SHA1 6996d61346f7bc8840b6a5d5dd77c4f7d4f00302
SHA512 61291681e0534c205a007b7e7a7b5adf2f1192a7c1bc494dc3848b87b653f47a45a66800bb539f384b3e29e01b5925799006917a5b57fa35a8853103de7be9c7
SSDEEP 192:fMONrt64BEAQmiUyVkqVBfP5GBPKnn+FdGN9Q8XFC1SJreWwiyqUU6:EONx6ed1CXMdMjCEJrc/U6
TLSH
T153121A36AC795C7B5DA2A541F48736035EE44137EBC96F90F6DC6B0C02EB76C230A85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 060ba3e0b562e0c4070d79e8c88d9c71901117dad5ec8794b3c145b4504924c7
MD5 f10991b2e3a3a5470d27f4894ab8d51d
SHA1 db5e2e22a5b83b3700dae1fc6f41896397e29657
SHA512 7cb7b4b291eb6a6bca2a5824fb361d601d9ea2f915860522ced3fc55497c3d4134611ec1ffc0a7d893612a23b548aaf33159280367d4ee232488b75a8294fc83
SSDEEP 384:uHiFEtNn/s3n9SaFsNL8TUNTUlIlM6Hqb3QB53dMjCEJrL/X0IidKzv2xRw:tFEj+9/wwgy6h6hL/78KzaK
TLSH
T152C22AF258D7497AD99E4747E73E2E039EBCC163B2816A50B3C85A0CCD962BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce502030c0e9312c53816b39cc659666e6b655c967569085ac76f56c0c5b4eb9
MD5 a6067085073f9be4a399b3828c9339db
SHA1 ec36f94e07c3304c36e6b94d1f96fc3c4bacbfcc
SHA512 a49a65879d0a75f8423589e308347e762217abaf45b6be94e614c133bc972ef887acb30a71ef936e1f791667cdd9ec28a82a7b565128d08bb90086d0c45b1905
TLSH
T163E004007140107FD35C4330044317301DD1C1C001F30105453111545D137441531FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7f253f9d9bba8692b6a505614671863e83a22d50e6f434fedf361b0385cc3605
MD5 e1646bade8424767212c47ad99c1d3cc
SHA1 581ac4d9f3d3de0cde4fb6da69db9dd5970203d3
SHA512 acdab790961bdbc192dee84b10dfb156f887d62303977e88524e69a9f68cafad4a6a1903c0ac6254e8a16657ace4b11c02ae7188bc168b6d7e93bfba988a31a8
TLSH
T151E00203E24010A6D25C833014432F101DD281D001B201054B36115C6E337443921B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d529d9336fc2c61772716d22378301b817bb49ca853636016cde881a81113c8a
MD5 269615012f54f1209ac91770447679e3
SHA1 05c7b99e1847ad03d63e8363c31e624b40b67ad3
SHA512 943648ae69485c3bea1ff22efc4f83a84d5f420150681414cc740d7f33e8e8db11a1083095facd9fa652c7439c59c69c47c6b43048fbc3167525f33f2acb49a5
TLSH
T116E00103A34110AAD27C873014832F202AE285A002B202164B3612686E637442E21BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bbd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bbd9.TMP
Size 392B
SHA256 d993b5e38448b92e53d30b5791a69f2549f498d2e76d5e5f8e1a285836ee3f24
MD5 621a67999519a5468694705493211d44
SHA1 b8b2d475b8353585340ded984fd66e8b700ad3d5
SHA512 1be861e08cc02eeba1bb0b463f00a7f4d417653530cb3607194fd94d03f6691f8700d986904865b636f2604eb0d4d654391affa2c5048fa4b8077c9bc9cfd5e2
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4eae0d13715b7b3a5e1a3e55f759d4bbfe5d839b59fb0a64ee9c70c9da85784f
MD5 71dd7cdbad35037d4b15e1b2f4c0bf92
SHA1 96a055032cb59c011c94c19088432292de53c5c9
SHA512 cd2a6187552029e5cfd7b4996d9826da63c66d3e94b36011bb63a84352abd9a360446becac8c0b05657e5fc4bfef3d397c9d9b6f4724a5c930df50bf6872a9ab
TLSH
T1DF410798BAFA1148B3B76F5A9BF6A86E447EB9772F17D45D00010D4F0623A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads