5fb6a1a5b06db289316329ce11720cf875a15abe8612203d3357902bd54f4d61

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44d5565946ace0b44bf5fcd699b2a3b6.html
Size 38KB
Sample260916-2aa1csfa36
SHA256 5fb6a1a5b06db289316329ce11720cf875a15abe8612203d3357902bd54f4d61
MD5 ef43ba71546f864bc442376f14064c39
SHA1 709fc6cff4f1e755d127daa0c036851e595c2d5f
SHA512 3f9832dd293a0bfaff72cb3623ac15dc321728367c018bf951f5968fddb95abe4fc9cce60acc757f01e4b55e9b7887f1d2ad77233a69c50ede29eba0bb31ba76
SSDEEP 384:t2/m9OXpjq8rqzQOAq9blwiAi+i/Mw5LTVsnrhEUTS81N93FRRMGEy:tkm9/FQTq/NdP3TVwpOGb
TLSH
T16403E86758F220212113C0E5AE75B74EBA61800BC757C585B5EC4698EFCFEE68C176CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340709448253227"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{D0405D78-C7F8-4D34-9C0B-0082606E6B3C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2340	OpenWith.exe
3288	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	4904	7zG.exe
Token: 35	4904	7zG.exe
Token: SeSecurityPrivilege	4904	7zG.exe
Token: SeRestorePrivilege	968	7zG.exe
Token: 35	968	7zG.exe
Token: SeSecurityPrivilege	968	7zG.exe
Token: SeSecurityPrivilege	968	7zG.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
4904	7zG.exe
968	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5036	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
2340	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe
3288	OpenWith.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4252	3276	msedge.exe	87
PID 3276 wrote to memory of 4740	3276	msedge.exe	88
PID 3276 wrote to memory of 4748	3276	msedge.exe	89
PID 3276 wrote to memory of 4748	3276	msedge.exe	89
PID 3276 wrote to memory of 4748	3276	msedge.exe	89
PID 3276 wrote to memory of 3184	3276	msedge.exe	90
PID 3276 wrote to memory of 3184	3276	msedge.exe	90
PID 3276 wrote to memory of 4964	3276	msedge.exe	92
PID 3276 wrote to memory of 4964	3276	msedge.exe	92
PID 3276 wrote to memory of 2672	3276	msedge.exe	93
PID 3276 wrote to memory of 4964	3276	msedge.exe	92
PID 3276 wrote to memory of 2672	3276	msedge.exe	93
PID 3276 wrote to memory of 2672	3276	msedge.exe	93
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 4320	3276	msedge.exe	99
PID 3276 wrote to memory of 2052	3276	msedge.exe	100
PID 3276 wrote to memory of 4320	3276	msedge.exe	99
PID 3276 wrote to memory of 2052	3276	msedge.exe	100
PID 3276 wrote to memory of 4352	3276	msedge.exe	102
PID 3276 wrote to memory of 2852	3276	msedge.exe	107
PID 3276 wrote to memory of 2852	3276	msedge.exe	107
PID 3276 wrote to memory of 2820	3276	msedge.exe	108
PID 3276 wrote to memory of 2820	3276	msedge.exe	108
PID 3276 wrote to memory of 2820	3276	msedge.exe	108
PID 3276 wrote to memory of 4272	3276	msedge.exe	111
PID 3276 wrote to memory of 1816	3276	msedge.exe	112
PID 3276 wrote to memory of 4600	3276	msedge.exe	113
PID 3276 wrote to memory of 3944	3276	msedge.exe	114
PID 3276 wrote to memory of 3944	3276	msedge.exe	114
PID 3276 wrote to memory of 3944	3276	msedge.exe	114
PID 3276 wrote to memory of 4600	3276	msedge.exe	115
PID 3276 wrote to memory of 4600	3276	msedge.exe	115
PID 3276 wrote to memory of 4600	3276	msedge.exe	115
PID 3276 wrote to memory of 1728	3276	msedge.exe	116
PID 3276 wrote to memory of 1728	3276	msedge.exe	116
PID 3276 wrote to memory of 1728	3276	msedge.exe	116
PID 3276 wrote to memory of 4436	3276	msedge.exe	117
PID 3276 wrote to memory of 4312	3276	msedge.exe	118
PID 3276 wrote to memory of 4436	3276	msedge.exe	117
PID 3276 wrote to memory of 4312	3276	msedge.exe	118
PID 3276 wrote to memory of 4312	3276	msedge.exe	118
PID 3276 wrote to memory of 4008	3276	msedge.exe	119
PID 3276 wrote to memory of 4592	3276	msedge.exe	120
PID 3276 wrote to memory of 4592	3276	msedge.exe	120
PID 3276 wrote to memory of 1028	3276	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\44d5565946ace0b44bf5fcd699b2a3b6.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffc8a49c188,0x7ffc8a49c194,0x7ffc8a49c1a0
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3133472699151481492,8996307037825865361,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2390976990886617017,6611052300592507771,262144 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14785625641776624203,10143238884571341882,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3898635519165126234,17345880754339327320,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14052100944616210742,14759663716076959917,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,7185683348905139041,14510590064563906398,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,4584594508866294933,15416388725813820811,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5275732519527630296,4527832338313316394,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,5679740492604699094,8276359368585268644,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14451350586887954783,9049322055542857877,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14451350586887954783,9049322055542857877,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,7010455667442404039,12261165984764237912,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6228,i,16722712438413693793,5822515455978557951,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,17815203794331566862,2239620045888238930,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,9770033883245743099,3194470722550802846,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,5578598636578989470,721923873007964260,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2988,i,5730345869356871075,8614643782068278725,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5156,i,15688538454608219373,15341977019010441504,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4560,i,12907794335162601333,5214289949098820847,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,12570675853735555678,5709888954811858950,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3724,i,12426388064526335177,12930083828277312624,2097152 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,2887917750294298528,17707760300120523791,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,2134481464061027068,745178990913561866,524288 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2136,i,611901750531812838,2090813563330370721,262144 --field-trial-handle=2212,i,11658307019544544275,17849900488931439300,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3288

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RVE_RSMB6.6.1OFX_DownloadPirate.com\" -ad -an -ai#7zMap10633:132:7zEvent27132
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4904

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap4398:132:7zEvent31214
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:968

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\REVision Effects - ReelSmart Motion Blur v6.6.1 OFX for Win\Instructions.txt
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 20KB
SHA256 424d260168157db0c77420a316eaf7269b082885671ff48262e2e3c0e2e3f7ad
MD5 e7f2d3ff9587c7e61006fb0044c2fc69
SHA1 bbeaf4a1b0c3ad89ea2561c20524a9227d29880c
SHA512 a60dca9cc3a055279fd8b08fa2971c2a601765a4394061a8a6298f493a0e7739aee40be03fe45560472aa1d60b23bd785fa08aaeb3916c272462136e2dcf638c
SSDEEP 384:CBxiLuCSvcjl729xW8tA6TruVyQMFrSVBb/1:CWLuCSvM29EeUIdSV1/1
TLSH
T15292E1C56CC8B8717C9693942C174B476843DACF02E06ABF7694349A781ACA7A35DC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9adfc03bca28228580b7bfe3e66fcc4773a5aed229066bbd5b4fcdfa67ff3b18
MD5 c85d3a5e9d150d7a19fd996ff596fd22
SHA1 74bc47449dde0a7435f794b41f06eeade73c8827
SHA512 ba9bd55b7c1dbf91fea224bf90962516cb8ed8946372c15cf9f95c3e773b25b061ada7e79d2ee06b9663d69e4ea57e163795a6366ec5f0ce02c2d5d540fb7475
SSDEEP 96:3GuHTnn5mQaXQ+1+NT/ANc6MD4bgiIcDuZWP:3lzn54g+1+1/ANxbecDuZA
TLSH
T173B1B7414088C850FF6CF4B590E54B873F31698D4D839EC769AEECFE176E3CA806242A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b905.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b905.TMP
Size 3KB
SHA256 3bcc299ac7ff91930fa421299dc73d9dc7017ec417014d80b848ef8795c2a541
MD5 717f20a02bbfd4736a00984f1dde881c
SHA1 126025aa8a76c80e367ab3ee2a7cdc487310deba
SHA512 abc227e01e4c46d3d82e5d6219634a1ab736e1f0d0693c3cd1636c329a86772aedb327408b45af2ad70b701964300dcc8afbc45dc92a355972c445a46f2c82bf
TLSH
T1A361A4865580CC60FF6CC8F591F91F8B3A72668059932EC165ACFCFA68A63C6C07203C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 6087e8f1850f9761a0d523849bc58f8b069b6be9533284827dc93ae339c9be29
MD5 32288293c7318812e7342e81328e88d0
SHA1 f36a517c4d32326250ffbfb60820bbd41991338b
SHA512 049a934fd70b7c299b4a0fb1beb50b15064b6e0e10aecb6ed787456355627ee710886194e21724156d47b901ef886b5251a2f0405c081236e619e63b1abe8871
SSDEEP 192:DshoNexJ7PzPR3esJ9PhPyE2Qc+cj1ehj6pbfnaxaxHA10L3qWD/OqBeaIHQcocC:DshoNef7PzPR3eI9PhPyE2Qz41ehj65v
TLSH
T1D6228EFAC3D8872EDC1151F1AB642D16CE5E091996283C1B98F5FF8B63E20B1E24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 9fc63caa10029fcd823f2e548c44d43cb3315ab99003f32c97547f5bccdb82d6
MD5 bb14de14c09bebcde26f89d7cdf159ff
SHA1 df2335ee7738af6600a3ddb768b448ed34b300bd
SHA512 dbb9262ffe624cbf79a663c1c2b3a7ee4ef2ceaa7514eda05b54da66346dd595b8c1a4d7766e428502269f6e4de00ae9f792828c141b3d5047f901b06e2cda27
SSDEEP 192:DshoNexJ7PzPR3esJ9PhPyE2Qc+cdct1ehipbfnaxaxHWL3qWD/OLeaIHQcochcB:DshoNef7PzPR3eI9PhPyE2QzmI1ehi5D
TLSH
T15B328DFBC3D8872EDC1151F1AB642D16CE5E091996283C1B88F5FF8B63E20B1E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d5502404e58e7523cc145c4da352e1383d436efe1b1e10cf866ce105cc0e9e30
MD5 1994bebe08c234b259caef9a16f03974
SHA1 086e1a8fe4ff822ab4bc8d46be84f6b12ef27f3a
SHA512 a93a02c380674da8a187ad7b77317cb9ef8e6caaff19d36ac1efa8920db1e29039c80bf211f13e4c594e5741b86550eb0ce39b7751b6b5acc9b35c7f0bac89ed
SSDEEP 192:sxZHR+W5/f+sbzIdpdXHW6+WNGY36av+fIgrJ:sxZHr5/f+sbsJHbGXOq9
TLSH
T1C712B7126E28A57B8CC7D20DBB25BF53D6FA503261D51E58EAFC861C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 898bae8a0c36274344becb8bafdee78f9e67fc87e601ad10c8f9f1e5f9bc6856
MD5 82d24d554aeeb88d1fe4d77eea768d20
SHA1 f0c34d4247a21d6da2eb9c242e6d2de636ab6866
SHA512 e9b689c9f322625897d4510fae76b36560ecad242dba89cb878a1cc9c014d8b75d92b9712f76a17e420ff31ac84877af5d4f3e366f140c1d67f87d20c1eb41df
SSDEEP 192:sxZHR+W5/f+sLwIdpdHUHW6+WNGY36av+fIg5rJ:sxZHr5/f+sLRuHbGXOqn
TLSH
T18C22B7166E38A57B8CCBD21DBB15BF13D6FA103251D51E58AAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3b96286a345ab54fb5094d3972eb4d237ab0240a81ff915fa14dedb51e4a1d25
MD5 a8a48880ad57bdbcd86caa1f247c54f6
SHA1 db8f4c1c95ef0863fb9d399fcea6a4d3133babef
SHA512 58f676c967b1000e9df341c599a38ae2159c94272d65a473e54336120da99b11556b540c8477302cb833fe482b6efd9d3132432c50ec45c7439a7aebaac49fda
SSDEEP 192:sxZHR+n5/f+sS3IdpdQliVHW6+WNYt7/Y36iv+fIg5JJ:sxZH+5/f+sSY5HbO/XGqZ
TLSH
T1EC22C7567E38A97B8CCBD209BB15BF13E6F9503251D11E58A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 297aa0b2f00f68b1d27db8c1e659bd2884585351f0fb241c0ba2faecb0f1bae8
MD5 26fb334fada7589346281d1b774ba502
SHA1 707a60a3e9c8349babd122e8eed69ed206e643c2
SHA512 c715fb63beaa894340405726135a66331c4949ec3e533e413c3b57d19396357e7183c890bc2730887114612ea373c19ebc7aaa8fcae1bcf987fa534dd37b249f
SSDEEP 192:sxZHR+n5/f+sS3IdpHQliVHW6+WNYX4JY36Wv+fIg5JJ:sxZH+5/f+sSY/HbZJXiqZ
TLSH
T1BC32C7567E28A97B8CC7E209BB15BF53E6F9103291D11E58A7FC8A1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 11e0dc36d3ff345d5d910e61cb95fc9cd16462e2aa29c57e9e784b82854e8ea5
MD5 81d80ef4e15185c5e9d70425cf4bf486
SHA1 f5a4bf038096e487391f582b96609e5f16f9e80e
SHA512 e819a5309fd1c579d10c1689e6dc05cd6aaeb62519e6f7c8fb0f9185e6ec03aba7a728cf315dd466b7a8f5d85f4a30530f3265eaa91cb03c2c37b09181ccac4e
SSDEEP 192:sxZHR+W5/f+sS+IdpdHVHW6+WNYmW/Y36pv+fIg5JJ:sxZHr5/f+sSvrHbw/XFqZ
TLSH
T19122D7567E28A97B8CCBD209BB15BF13E6FA103251D11E58AAFC8A1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5c45a88cbeb38b6d73529a015ff3eb843faa054e561630e479d5db69bb5b9678
MD5 1c5168479ef39d5fc95661ae6285c4fa
SHA1 982ddf62f31cc0c1a281e19e9c4ccad115aceb45
SHA512 e5bdcd7032fe71a4cb283cc61f49449e152659019b2ed5dbd0b5aaab81f21cca6889c33d49d781d6c46b4e436be48fddf93ad0e622d49d3e2d7a6d733628332d
SSDEEP 768:IKKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/vroFd:IKKlm7QWvUYe0u1ja8/L/E/8Fd
TLSH
T113C2FA3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f2cfee66eb66a53f99701e4acf7f2d66bb6c8cd24053967394a45232af57faa
MD5 ca700027d73f936485a366d176362c43
SHA1 61cc5c2c7f434e391b9cced23dc0d2e917ab296f
SHA512 457527def8fec45b064300b3207246456efb0989725108e40596780adc2810e2c9c0d2c2f8034052125d577122e7e0b3e1a8faa1d05c8085c2bd3921b3502865
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyLMb6G02aDbqpyIS+DK9a/dI1KGowPyW:KsIoKxiGGr+Kw/dWKGoC+PiKoUc
TLSH
T17D910910B6BB02007A7E254886659F2F4692F1673414EA7BBF6C44A19E3EE444DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5989a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5989a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c9f061da2051df19f45ff18b21ce56a081a95441d41a385b446a9c1609e28abc
MD5 ba3facb5dd75a76caca38fef1430cedf
SHA1 e45ae938b58cf329b9affd6be786310bd4ee3501
SHA512 61d04edeb7b559d266cd479072d2066f53a1e6f47281ea5ec507af187755f8e40f5433351da102ce4da5c576be97d232354b3b6a1ed7f0d7077fa760bf9967d8
SSDEEP 192:uVksNwjUFQ9wPGUUbOUQmiU1lSMV4h//afV6aoy/SU8:VsNQUF+bHmMKh//afVk1U8
TLSH
T16E42F7357878EC779DA3A184B1473A23DEB4006B9A852F98D6EC5B1C06DA1AC6307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8308b715b1bfdc268f602abcd19fbb3d60e4f2dbc15e08cedd93787f234a7643
MD5 a002bed438c75c835af2d5ab465a2bb5
SHA1 7d447687ca8decde29fd885432e623807ebfbd38
SHA512 cc6d50f275b1fcad071871548fbfcf9717712fd56ef41b9e1ac556e984f343a47eb0fef89e06058d92de632b40b2e51720fdd14f562bb5c49d2060805e7d74f6
SSDEEP 192:uVksNwjUFQ9wPGUUbODQmiU1lSMV4h//afV6aoy/SU8:VsNQUF+bqmMKh//afVk1U8
TLSH
T1C742F7357878EC779D93A184B1473A23DEB4006B9A852F98D6EC5B1C06DA1AC6307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 99cd78ca167db0156bdca7f8f607aee7b36d7534944e25ef4d2ec5b1814b004a
MD5 8bc30526798f4a2feb4e680a8a1ddf35
SHA1 039a95ec0f5734c8e41d65c1f52e57a2c7010ffb
SHA512 8a243b53aa1764f39b7cb486a4c88a7267a7a9e7f804d96769c082c6024b2b561437e880debff502dd7f81d0d9e4a417deea537fee665647d18d57c915a25cb9
SSDEEP 96:KqONknQsjpfbUmjH5ih/cIPURHl8h4otop5BaDxBKP4v+Y1xf//ojdOx5YEqso02:BONr6JUm0QmiUy6Hso//aOBC+aU6
TLSH
T19C02D839BC68BCBB8EE3AE45F1473B239FA4106B96915F84DAD82F1D01D715C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4add1f3774e5ba9451e8b40a42dff68512baa99a7437f05c046ab18f5fbcd5a0
MD5 5713ced60e18986e207399d4b8b3406a
SHA1 b0ebce64fa21d559fd422bb421aef7441af5bbfc
SHA512 ce607846d1d695506d818d0fd866b3e1a5326eaa97fa34030cef0f80db8d0fa94af3088f5edcd72f8b27b980584799c54740cf608b28079108495b743b7bda2b
SSDEEP 384:yZcIWsNQUR+bHmMKh//afVk1sa+VY8GTo1:AWct/CNk1hghc2
TLSH
T1D9826B763C64ACBB9CA7E281F5473A139EB480A793C85E54D6ECAB1D05D91A81303D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f4de20e62e040576fb887d4f52bf5b9eeafda29a91b118db6b562e15d81338d1
MD5 ed9c0139fa7f4b0dafc6394bfe5341fb
SHA1 7fa1de43dd0d424aceefbc7b6b070ece3bd612cd
SHA512 1fd770e81f1b9b3b9fe55c1c2e21fa720853c2bd57fd3df092f01d1f0535b1bf68985ba8435683cd9d9e710f732e1cfcbe4c6038013dd18bcafd55cde9188b86
SSDEEP 384:9iFCZcIeosNx8TUNTUlIld+bM3ML2h//afVh1sa+VY8GTo1:0FwBAwgP8G/CNh1hghc2
TLSH
T1DEC218F218D7987AD8AE9743B73E2E138EBCC0A7B5845954B3D85A0DCC850BFD302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2034e7076f70d4138199ba5948a8b48e20cb1680f8cf31fca1347fb91c8f094f
MD5 50ed4ec2097f7e6cb12558bcfb8cea5d
SHA1 8bcf02b715ef80ce4430b9b6bb1d8b5a036e7dff
SHA512 6c9ecf3c77ea67df78e54daf4448f5aa10a379b7fbdd273c9893d21a7bb9d6748134e0429ef8b487cc9431b11912139c1814f497dac1ea80a61a3db5dd99b753
SSDEEP 384:9iF9ZcIeqsNx8TUNTUlIld+ba3ML2h//afVcR1sa+VY8GTo1:0FlXAwgR8G/CN41hghc2
TLSH
T1A2C218F218D7987AD8AE9743B73E2E138EBCC0A7B5845954B3D85A0DCD851BFD302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82b68a0dc7e2c67014d834cf56e9999cca2812fb213ea7679a5bce258d97e0f0
MD5 bd906759cb50c75e64477719cf8d08c5
SHA1 16c5285db0aaacdb3bfc08736cda4016616bf6f1
SHA512 9447325a98afd21bddb2da30cee99b2ee8af89ee7bf8b04a1e67ce73d9eec5166e6a63cabc3f613b1a920785f2c4ea34f12f256639eb3eaadb0275775772910a
SSDEEP 96:KqONk7yQsjpfbUIH5ih/cIPURHl8h4otop5BQDxBMsP4v+Y1xf//ojdOx5YEqsoc:BONcV6JU3QmiUyEHMWo//afVUNxy/SU6
TLSH
T1471208397868FC7B5DD3A584F04736239E64406BDB856F94D6DC2B2C06DA1AC6307C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0914e6037c56f68d3ed33f7c6bb1cd03f77d8c999a7f5f6568fd1c01603b8a22
MD5 4af9d164ff1d203cc27851fd0b9e3d0d
SHA1 a721043ba042f17e8d4b62acfd6cb5ce187616d6
SHA512 0c49e979b1e4da4c6ad33719c758ef6d53bec1f183485994ab3a29626ba157f627e25cc1daa0eb97d4bfe9f2c503693f1d1fd200d9784b527d6086f524d05c43
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c8e0c9d25ff5e6a3dfc30b84f907e038a7d2e3eb37b494e28678ef8f499afda6
MD5 03fb4f57190c63f5a70d5e3c6947902f
SHA1 4255ab9d0021d85b183b50fc972077a77047152b
SHA512 54943eefdf0dd28b3cf0e1ba82695f65a6e230c85af4f3679a8c95e97ab77f5363bff7779b6061660e86ce48de8c2e746e10aa805b06309276ca924135aa2ce3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59286e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59286e.TMP
Size 392B
SHA256 099fde2a9b36024770145e89b9fa9d1ed31fb3dc1c6ce1b5eaedee8f0e2db3bd
MD5 f432d03a29208f464197501d5c301b6f
SHA1 e79efe560d374090dc9f85fe17f63d6dffc7f082
SHA512 75c7a82ea6da763dd0268961d4b78e378b33f6eaaad9ceefd2d3682f032532b426ce71f03169cb330d61983d0534c74500afdb00d528a38a005852f3c9ccfe27
MD5 SHA1 SHA512

Submit Download

5115d198-4668-4336-ac47-7d3289c25eda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5115d198-4668-4336-ac47-7d3289c25eda.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dc96c5884b54b22ae15dd830a9a4f8b5a2fada59608d780a27fdf488ea6988a3
MD5 2d760f4ec1bb465fec3261376616e969
SHA1 bf1cfda4e0fd5317f06f940ba13a794c8358c1f1
SHA512 522ad2356e06cf283bcfe6234a2255b8dedf3b8566e64986784fc66efeadb1da33059a282e492a03287a0128f70895cb79d7e330dff13aed72a2c9edeff2a47f
TLSH
T16F410758B6E91148B3B76E5A9BF7A86D447FB8732E07D49E50110E4F0A27B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Instructions.txt

Path C:\Users\Admin\Downloads\REVision Effects - ReelSmart Motion Blur v6.6.1 OFX for Win\Instructions.txt
Size 111B
SHA256 932f430a32bd284f23c78fa79b0ff258584f80b3e3de21be56f2bd3a677ad033
MD5 2c3479b6242cf8a3994422276fa4e407
SHA1 cf461b648c8d3edec70a89e39806adbc9b38a916
SHA512 ee33ca10c748d7c55d72d0132d237f7b3aa092084dafa941e9a00197150189ca1488a57fb60bf72b048da9ba36ca3e6d80275ee463f20b507806f1a6852672f6
TLSH
T129B09293A812C54234686055A705A962B28D9B094285D1C1AABCA60EA9A88A9406A1AE
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist

Path C:\Users\Admin\Downloads\REVision Effects - ReelSmart Motion Blur v6.6.1 OFX for Win\RSMB6OFX\rsmbvectors.ofx.bundle\Contents\Info.plist
Size 1KB
SHA256 e695d2bc24a03e6d111a54f071fd8aacc3aec107b37a0a4bd0e05018d08be660
MD5 e2e3bb48106d828bca85d6646e0fac44
SHA1 99632a2d36ed610f6c01b7698228cf0507e4e7ac
SHA512 d1fe9de740e345870a33efb1e0522efcbceb32e42379e61fbf956ac7f899585b58c383febc19db9246bb64f664d51ed385dba0a03ab7f74df0792391cdb6b701
TLSH
T15D21D6F51A1835992CC213660AD2514E01ED62CD5C3332FEFEC6A66CEE0E846A275BE5
MD5 SHA1 SHA512 TLSH

Submit Download

REVision Effects.png

Path C:\Users\Admin\Downloads\REVision Effects - ReelSmart Motion Blur v6.6.1 OFX for Win\RSMB6OFX\rsmbvectors.ofx.bundle\Contents\Resources\REVision Effects.png
Size 3KB
SHA256 8acaa4825752d535bfcdbad228de9dc4bdea04313e2c7cdd2fdaaf440e83fe6f
MD5 06dcc7da83283025c5ed1ccb462a3e4e
SHA1 ae34bd962d357133e72a097c15a7a0607e324fdd
SHA512 c59309853796868fd05f61848267e5dec8411b52e98a1968eaded1a373971197348dd17b982d77e671b874a856e599823d056a95560bd48a42204153edcaed80
TLSH
T1F2816D812FC66009D380173FDEB4502F7A95D3819EC95D8CC1666BE429C23035DCA799
MD5 SHA1 SHA512 TLSH

Submit Download

com.revisionfx.RSMB_Vectors.png

Path C:\Users\Admin\Downloads\REVision Effects - ReelSmart Motion Blur v6.6.1 OFX for Win\RSMB6OFX\rsmbvectors.ofx.bundle\Contents\Resources\com.revisionfx.RSMB_Vectors.png
Size 9KB
SHA256 f9242582d369544092c336a6140b3799f31eca67527b19619d56c078369526a1
MD5 a14cb684ae1906177cf7eba3d640bcd3
SHA1 77ae957fcdb0c3361ad90393f36fd6b891e930c6
SHA512 b5ac7c4bc46cc49f698dd090dc77c0ec8f2da3e1370af44c2af169476f16161c8f873948e64cc29ae08980461d4b6bfff9df2ab161467dae7128f3145434d581
SSDEEP 192:nSDS0tKg9E05TRCvF3RMNKqUBz6qSp6XJ+gP17/3NHBBs+JO4D2L4ED/B+JGu:SJXE05MvhRMMqQz6Jp65z7/3NTs+JOAR
TLSH
T13622C06912307086315FB6272E5E03CFA37166F9A0B72FB9C6DA90CD1005B4267758EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RVE_RSMB6.6.1OFX_DownloadPirate.com.rar

Path C:\Users\Admin\Downloads\RVE_RSMB6.6.1OFX_DownloadPirate.com.rar
Size 3.1MB
SHA256 75195cde7cf504b13d09abaccc8002e91db6a49add42cd698a47dd8859f0913e
MD5 bb9d457b609b2640af2b88cd75c08878
SHA1 d27e94f6a8a858b00f1b426fadab0f68b60d9320
SHA512 de5755cef3ee8352a5b075b7ba454cb16e28f33971b47419d5639908d21b41f577ac4233b9c82c8fa2abad995ae237d025669b38faca7d5de919b422d6e6fe8e
SSDEEP 98304:aGj+yZPN0qsbxgYFFojxmIVhokJqCQLig6RYb+6t:aGqyZMx7FyjpVh0CQLig6RYaw
TLSH
T104E5336126F0B5CCD2F196354FAA3B66670F983F9A0421C7EE4D610A03EF3E2BD45619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download