hxxps://drive[.]google[.]com/drive/folders/1irmn0ksdigrwLEb7Mx_0d6OvapOWR2g6

Analysis

user interaction
yes
max time kernel
356s
max time network
358s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1irmn0ksdigrwLEb7Mx_0d6OvapOWR2g6
Sample260730-seaeysbc94

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
248	drive.google.com
7	drive.google.com
13	drive.google.com
30	drive.google.com
31	drive.google.com
32	drive.google.com
66	drive.google.com
249	drive.google.com
8	drive.google.com
41	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298973658547218"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{CB446F87-3BD8-4C61-A862-FE44D4A706FA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{569CB233-6B74-417E-9647-B057F325DB67}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3116	4160	msedge.exe	85
PID 4160 wrote to memory of 3080	4160	msedge.exe	86
PID 4160 wrote to memory of 4900	4160	msedge.exe	87
PID 4160 wrote to memory of 4900	4160	msedge.exe	87
PID 4160 wrote to memory of 4900	4160	msedge.exe	87
PID 4160 wrote to memory of 1472	4160	msedge.exe	88
PID 4160 wrote to memory of 1472	4160	msedge.exe	88
PID 4160 wrote to memory of 2760	4160	msedge.exe	89
PID 4160 wrote to memory of 2760	4160	msedge.exe	89
PID 4160 wrote to memory of 2760	4160	msedge.exe	89
PID 4160 wrote to memory of 1900	4160	msedge.exe	90
PID 4160 wrote to memory of 1900	4160	msedge.exe	90
PID 4160 wrote to memory of 1900	4160	msedge.exe	90
PID 4160 wrote to memory of 3820	4160	msedge.exe	92
PID 4160 wrote to memory of 3308	4160	msedge.exe	93
PID 4160 wrote to memory of 3820	4160	msedge.exe	92
PID 4160 wrote to memory of 3820	4160	msedge.exe	92
PID 4160 wrote to memory of 3308	4160	msedge.exe	93
PID 4160 wrote to memory of 3308	4160	msedge.exe	93
PID 4160 wrote to memory of 2832	4160	msedge.exe	96
PID 4160 wrote to memory of 2832	4160	msedge.exe	96
PID 4160 wrote to memory of 2832	4160	msedge.exe	96
PID 4160 wrote to memory of 4044	4160	msedge.exe	99
PID 4160 wrote to memory of 4044	4160	msedge.exe	99
PID 4160 wrote to memory of 4116	4160	msedge.exe	98
PID 4160 wrote to memory of 4116	4160	msedge.exe	98
PID 4160 wrote to memory of 4872	4160	msedge.exe	101
PID 4160 wrote to memory of 4448	4160	msedge.exe	108
PID 4160 wrote to memory of 5056	4160	msedge.exe	109
PID 4160 wrote to memory of 1304	4160	msedge.exe	110
PID 4160 wrote to memory of 2676	4160	msedge.exe	112
PID 4160 wrote to memory of 2676	4160	msedge.exe	112
PID 4160 wrote to memory of 3780	4160	msedge.exe	120
PID 4160 wrote to memory of 3780	4160	msedge.exe	120
PID 4160 wrote to memory of 3780	4160	msedge.exe	120
PID 4160 wrote to memory of 2548	4160	msedge.exe	121
PID 4160 wrote to memory of 3364	4160	msedge.exe	122
PID 4160 wrote to memory of 4636	4160	msedge.exe	123
PID 4160 wrote to memory of 3364	4160	msedge.exe	122
PID 4160 wrote to memory of 4636	4160	msedge.exe	123
PID 4160 wrote to memory of 4636	4160	msedge.exe	123
PID 4160 wrote to memory of 1664	4160	msedge.exe	124
PID 4160 wrote to memory of 1588	4160	msedge.exe	125
PID 4160 wrote to memory of 1588	4160	msedge.exe	125
PID 4160 wrote to memory of 1588	4160	msedge.exe	125
PID 4160 wrote to memory of 2760	4160	msedge.exe	126
PID 4160 wrote to memory of 2760	4160	msedge.exe	126
PID 4160 wrote to memory of 2760	4160	msedge.exe	126
PID 4160 wrote to memory of 5100	4160	msedge.exe	127
PID 4160 wrote to memory of 5100	4160	msedge.exe	127
PID 4160 wrote to memory of 5100	4160	msedge.exe	127
PID 4160 wrote to memory of 2104	4160	msedge.exe	128
PID 4160 wrote to memory of 2104	4160	msedge.exe	128
PID 4160 wrote to memory of 2104	4160	msedge.exe	128
PID 4160 wrote to memory of 1672	4160	msedge.exe	130
PID 4160 wrote to memory of 4308	4160	msedge.exe	129
PID 4160 wrote to memory of 1672	4160	msedge.exe	130
PID 4160 wrote to memory of 208	4160	msedge.exe	131
PID 4160 wrote to memory of 208	4160	msedge.exe	131
PID 4160 wrote to memory of 5048	4160	msedge.exe	132
PID 4160 wrote to memory of 5048	4160	msedge.exe	132
PID 4160 wrote to memory of 3308	4160	msedge.exe	134
PID 4160 wrote to memory of 3308	4160	msedge.exe	134
PID 4160 wrote to memory of 1688	4160	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1irmn0ksdigrwLEb7Mx_0d6OvapOWR2g6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe0958c188,0x7ffe0958c194,0x7ffe0958c1a0
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,9062273640047948665,12892161174551876549,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,3285325881175979486,7884126349671185804,262144 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,2825080479380885259,5354318930451178333,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14968392447815939705,5539972297607177589,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,10088394684318926952,8350027300910824451,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11426218964697392755,8560636156601621612,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,5056092104783714121,7727878839713574805,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,14820467086108800128,18369314550075339948,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,3931774180117869470,563406413748760174,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9796957543679536376,6198189137799428125,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16080265390981770726,15839335909363182615,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16080265390981770726,15839335909363182615,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,18067517644472715209,350463238112487990,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,8691846110364128187,8585406492119240550,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,17250762808125134303,16007210227020711953,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3024,i,12953785590555933713,17437907321057547068,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6116,i,1786449460872295413,8933414537435765714,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,239871913930375771,17150231714667127250,262144 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,17365193623191093353,15673347136103368542,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5168,i,15207908828145154332,16562403672240424220,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1222492322617144514,3220244634323543947,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6836,i,2311723732631434315,13488657879423432779,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6948,i,15882493554344020211,6389754897648078101,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5564,i,17264523727391548681,7449952257687428282,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6728,i,670674922399363285,8554209233029969578,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,13614172895799265028,14421873809844247376,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,10519088047363677165,3032350736559697500,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6695329798098540471,11049575249867065442,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,13818312240083150785,9101444155253888654,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,2520993718359259250,7773486004463162440,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5488,i,13419141528529033295,1323928994714059624,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,5368647364592829904,8595652229424655189,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,3833697774967106299,14942670699928190251,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6976,i,11843852195088308959,14589958439455094415,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7084,i,8224575648594476406,13263110913834117445,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,5715732034151173188,7213420992566504376,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6548,i,4481585721783283267,13150105938908519931,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5112,i,17964713000150416170,12919515469945851200,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7568,i,16131848711761626146,5990236416487870215,2097152 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,14338127509727140692,4936315310699351176,524288 --field-trial-handle=2352,i,2049767720194487015,11536709081441938968,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:8
  2⤵
  PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 31ffc33373afdbdef9d6f92b0cc6f19c5a0edd121a2e4c320c470f43c277cb56
MD5 822bd53d3d7c93c0f5249e2d6f08523d
SHA1 eea71b022f822ef7cdf9b2867c0c4b544fbc7204
SHA512 cd35c6147b55829f9e2abae610ebfa927452812e018b0641c10efdb9cadf13de1b2ebc04ee5edc4a3d5dca7d60ee4e268435a3526d124f5c70f094ffeaf75898
TLSH
T124E0809549D9C35DF10C64C78374534DC190360AD6C86D4527058CD5F1479586F9EED0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b62e650a7b2cc5e5aad28d6167de7637e6cbed33a23bcbffb9f70fd2570395d1
MD5 9a58911c01fd996e4e3b66296ceee8c3
SHA1 8d69636cdc5cfbadeacc208cd7b4457c003a2b6a
SHA512 9f019411dcb87d1189726e271a32d00590701b2982bc15150ea0b99f42e86e6f9e230f08c799668436ca94e28ed5f6b3425b94d9d846fd5ee261f80ad1492244
TLSH
T110E0809547CDC39FD30D6CC7455C57CC9191370A9ACC6D4A3B04845CF5415547F915D8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 374KB
SHA256 23b340a11bd1821fac4148c224bb12afbcea4b48348b1534dd0d69d30a5c7705
MD5 f44ef0a9b382a3299e4c4353f1b261f8
SHA1 5e5ecb492697bb375ba91be041c200b31b3deb34
SHA512 1c21196ec9a61a8ddff3cca342607278bd8ee2972f33aba965a776f96aff2530eac038e608b6cc9c49b79c24636736c2c3cd9ecc4e693250b80a9c510e061a30
SSDEEP 6144:qmQ3bmFaLIjYIMxAFHR43MTjXRAoncNuxOjaEUs69DTigfBuljduIeCzbRMy7hIn:M3PLzI5Ri3MTjBtxOglZf0l5uILZ7hIn
TLSH
T15084238F1021C002779EE306BD016DBDF81B97B085BA1EB634909D57BB72E0A2DE7567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 23KB
SHA256 2c97f0f0c182b0c3c337320f1de9c13017d05b72186256bb7eb7a96a163491c5
MD5 46137217cb194d93ab10b4209eff1f66
SHA1 819d6538baf87f6be1102bac185bb399e1a7cddf
SHA512 ec9879ae34ab271dd1e7be3bea1a3f2fadea7785085195c3f6f279a32e61623a57c4733adafc6f5721c487d378a167ecd7d6e19d69db221fa2f4c117471b45a2
SSDEEP 384:vNNDeA4Bnd4KKAO86llzvqNH1gwUGccoMZtv1GeiTWGJJSMBJ2Jt5fjo5ptd01u3:vNRUnd4zA9KzGVgwUGcBgrkaQG3E7qu3
TLSH
T12CB2F140EDA17B455EE35A6C58AF91009E8EE9044F704BC311AB96037D3C9F2119FAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 56KB
SHA256 6bb3eaaf89b581bfc357bb3b7a265519adf2fef016ee7885c6ac98fc9d059075
MD5 4b056da9a552fe32cb006b4e259a9f5a
SHA1 48dbc5c2a16931fbe52e14beea06f194a0c903d4
SHA512 e0818715ca1cc2c9e82662d55228f96c925826d3a72eb85d643b7f1a4e2dbd10495b4df15bf560a95f9d6b5f3c48a09b556914485b14bc3655cc025d91eb72b5
SSDEEP 1536:8jqxL7wpWuOgobvdwYnWzr0NK+g4BSvXsYjDPIoCoPR:fxfgWuItUND48vXhDPjCoR
TLSH
T19043F163DEE36160C5C6F680B8835994F5FA2ECF1DA77A50440DF8BA07246689B3C9F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9bcb48ac5b5e957e3da41cc0f3fbc92351f7c8b82b06255a03093f8bfde0313d
MD5 fe3f90da93be4ff2f7f5fbee0e14b3cb
SHA1 c7983ec587a418f0385e3bb522cda50305d7bb21
SHA512 9a8538c5b2be4432f54657609123e7d89880342c03a1f2247e8ffb1d2fbeb120affc40116212a2e2458bb085628069a13b247a3ae6ec7da8ee83e02e524025e1
SSDEEP 96:ZfLs99Vq+elD01GzA7wcMOwHEF+xUtFMqPvhh92Of4WxCTB7DeUcSK2Rrb:ZfLE37wbeocvhRvWCNArb
TLSH
T134A16FE295062851EB9001F19DE221883132F49E35E7CE9341CBD2B6FB0E7ECA4D1E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0ea591df211bb4c5059765d94a61a5551e3a0f536fd432cb257665f6d620aa3d
MD5 21e4b96c1e9ebdeb086ee3958776fc0a
SHA1 a6fa3ea83fba648cdee0e3b1e7e20f53cd78a4f5
SHA512 9cc60ec2ba9207497175b500b841b2c5340999fafa299c0aaa2e6c26c550fc3d0ce2d2932111f6a0a480571ee954e34ea164e801b8473e43396341c2ecf95674
SSDEEP 96:KfLs99Vq+elD01GQA7FcMOwHEF3xU3FMqBvEh92Of4WxCTB7DeUcSK2vrO:KfLEa7Fben6vERvWCNurO
TLSH
T164B172E295422851E75001F19DE221883071F4DE36E7CE9741DBD2BAFB0E7ECA4D1A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9b45d2c8241bebff16a8531a4eecd5b81aa7fdcf0b359d9a3971cd082e60edf3
MD5 fb7cade4c82d8f7d157a7f16715be3b6
SHA1 b712b9653920ab2b6add5e2f982e8520095030eb
SHA512 aa2ae84a3de1d866c2db7c9970592d64eced4c6b99a8438e46c32e1e8143c252d4303330ba607b447f8f42db72a6bee5ef599915e18b8d6007b21f946a79645a
SSDEEP 96:SfLs99Vq+elD01G0A7FcMOwHEF3xU3FMqBvGh92Of4WxCTB7DeUcSK2vrP:SfLEy7Fben6vGRvWCNurP
TLSH
T1A5B193D295422851E79001F19DE221883032F4DE36E7CE9741DBD2BAFB0E7ECA0D1A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ff6c49aacd0029655c76c4bcb04e3a66144ed73d04bc1a561860780a66a71651
MD5 a7cfc4adc238c078f3894de33e577360
SHA1 0275c7722311b3d32a13a22316bc05776260de16
SHA512 852b08ae3497b67f4385f8fc06403bf81d8d5320e473275e39fd80233a113251ac5d1ea44193cf870694151af634659326aa312b8adf7db6256d9d04a78f04c9
SSDEEP 96:xfLs99Vq+elD01kuA7wcMOwHEF+xXjFMqFvhh92gf4WxCTB7DeUcSK2RrJ:xfLEW7wbex6vh/vWCNArJ
TLSH
T1FCA160E295462851E79101F19DE221883072F4DE35E7CE93459BD2B6FB0E7ECA4D1E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 4873417d5e642b97bf1d86c8f2ec1bef90e08093b7c1ba39c333cb7ec372c79b
MD5 f5aa8befab0ad54e015802f108786873
SHA1 090e679006a7f43a84aa5e648f90e9a768d5e503
SHA512 64c74c6ce5ffb2eb3c10722ceae7da81d43023359086dd8ac8375d233ca99e7e83ad173a877dcb185f2f747547aec15817860c780eb5dbbc7a90f723697b2f95
SSDEEP 96:3fLs99Vq+elD01G0K7FcMOwHEF3xUJFMqBv9h92Of4WxCTB7DeUcSK2drSz:3fLE47FbeZ6v9RvWCNwrSz
TLSH
T136B182D295462851EB9001F1ADE221883171F4DE36E7DE5741DBC2BAFB0E3ECA4D1A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f61cfd6855390b3857c3f9804c47154ecd5a39d566f4e06e4e42e68805904a63
MD5 3ec22ee8cc2b2e2e66e6df0684017010
SHA1 cf1f442c32f1aafb615246a445968cd767353fec
SHA512 b9ed8e427276e1a795256a56798aed9c88ccd8af13d67ffee4a4b7d8e7cb6eb50aba3cacda814e6b5f07730ea5cc228a6aeb8fde6967fa47790927f8a817413b
SSDEEP 96:AfLs99Vq+elD01GVA7FcMOwHEFjxUtFMqPvoh92Of4WxCTB7DeUcSK2RrS:AfLEZ7FbelcvoRvWCNArS
TLSH
T131A170E295022851E79001F1ADE221883032F4DE35E7DE9341CBD2B6FB0E7ECA5D1A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594462.TMP
Size 3KB
SHA256 0e809148c41d8868e7223bf14fd9c3a61e5d9e58f49de2afdba548a45ad93e9e
MD5 86f9d21994cf126d91fe922db00af785
SHA1 8cb6c18c2f5b697602afdb138ae66367b5689488
SHA512 a71910b70cd011b1024d844dbb043c7559594c7d3bff4d9fa52d890cc9a5415c5d588d96f9aac6054e7c11a6eb9485c161967b44c5f110ff01b1b05ef6c4d337
TLSH
T1E4613BE502420861E3A512F2ADD232593571F09E3AE75E5780E2C6B7FF0E7E095E6E0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c69f3656e41eaea094c94575254ad5ed9a5f8ef1d042111c85e745d71b65370a
MD5 b20c3bba424d8c8b5a0d80b88e37d4d7
SHA1 413865c4b0668b6691ae1095ca5b32805bc40143
SHA512 4754b8af1a6ca34dfb46abdeaef76d419720b0f7044cc76423f35c82b27bfe18675b0e045b4da64a3a435ab26318a75d95a6b3d4e46b01bfe3fc290b748e9bb4
SSDEEP 192:DdF4zNJ7vDrhZozPJq0GaVOpmIXrZkbEnSTL9N2aFpR:DdF4zNJ7vDrhZozPJq0GaVOpmIXrZkbd
TLSH
T119126AF7D3D9811DC95156F8D715AF1FCE2D0A1843283C26C8D8BE6B93E2831E21A65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 979a0d40872263375cb53c261ea1ccd40a37c51816b9f183b06f431229bfd144
MD5 3707d01d480f416788474e76755b72f2
SHA1 04a8377330428896a11e98c5c9483403b1ca83b9
SHA512 0d351bd089c2fb6633e43cf3c9e595325db8cd98e4cdaf2fb6756ac73a978f6fb114d2c26d19af1dab2352b3fa2bb1df0c4e156942afd71f175dcd98db1d2740
SSDEEP 384:DdF4zNJ7vDrhZoePJq0RBljNO6bWLaV8msoj2Rupl3T6VNBrGZUXu4s+HaW+5D3:i
TLSH
T11F427DF7C3D9822DC95156F89B15AF1FCE2D0A18431C3C2688D9BE5B93E2831E21665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f6872f5b09a5eb48ea1876d165df9ebbe8e992ab2fd3ba9a5821e1bf0580682f
MD5 bc1ca3224b8dcea911b0f13c9e7135fd
SHA1 a48839b2773666e35343256e969697046593f9f2
SHA512 f3d5397c3a63acc9568ed631290963b070df3dfb9d3db9bb16daa8a38003afb8ee1c83b4c0a7b9b85f65f351450ccf4144e38d161076c5f2a5c29eb30e6ee16a
SSDEEP 192:DdF4zNJ7vDrhZozPJq0RWaV8mer9j2RfVN/CpElTekGp8W/R:DdF4zNJ7vDrhZozPJq0RWaV8mer9j2RC
TLSH
T1BB1269F7C3D9822DC95156F89715AF1FCE2D061843283C2688D9BE6B93E2431E21A65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a725b40f71d23c910356c85161dc597017a8b2739c97720f3ccb392391f8f155
MD5 b788c25c3b5f4f805d2969096184d9e6
SHA1 ff9b4031ab1091173421e80d8e719678249ca566
SHA512 de2e9ec399b50a7be662609c2e2f7a832933375dce2b3d9ae73cb8a936e257a4c28b19028e4dedd241e92a0ec8f2f756fa9621f59973b55318fcb6264b7c7a8d
SSDEEP 192:sxZU/ywFaKOMl8Mka/fW3sK86sIup7/lHW6+WNy/ED3/Y9I2F8tVIgrJ:sxZUFMa/fEsK8RZHbJ/t9
TLSH
T1E242C7166B34997BCCCBD209FA55BB53D6F5457292944E48EAFCCA0C05E6AEC230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0d2db3e5377781a2e8fa936e4e1ef5033a9efb33accf1456c4781e228f6b5184
MD5 167d18590f46baa7db9c7aa062f90543
SHA1 d027a1a1d4dacf0b857705f84cf206aa13198b10
SHA512 b37d2b4e1bdce5bfb911de340874519ad7214f45b9ee590fd2689202668c4f9d11f52a35487c7b902b829e789582627d7a82653348c9bef714390fd241af8a7b
SSDEEP 192:sxZk/ywFaKOMl8UQ09a/fW3sx26sIupV/z/lHW6+WNyVKnY9IXntVIg5vJ:sxZkXqya/fEsx2RHHbpn73
TLSH
T18D52E8566A245977DCCBD21DFA41BB53E6F54422D2944E84EAFC8A1C01E6BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9bef54e6e25bcd51df1301a55dccae333d6b558dc82e98c75be76d1f01d411ac
MD5 608f1b23d9ef4dffe5204f1ef79d9fb6
SHA1 a84d076e201cbb61e70ccecaf4fdd39fb021cd75
SHA512 370ccd4d9688ae4da5bb16631b0d8b5f2a8fedc0e30b416b3dd36f68fd4ed513ac06ba45147ca7d823bad1d1a21788f09cc4fa726b60a30f03667a0f9568224f
SSDEEP 192:sxZh/ywFaKOMl8UQ09a/fW3sx26sIupV/z/lHW6+WNyPFXY9INntVIg5vJ:sxZhXqya/fEsx2RHHb8XZ3
TLSH
T1E352E8566A24597BDCCBD21DFA457B93E6F51422D2944E84EAFCCA1C01E6BEC230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 c2b25a9bc71c4b10b438c0a536763091cc25d57de0bd44a1f1d6b696a011ab5d
MD5 1c65739b170cfddd84219d27d6202249
SHA1 111f19cac56f46575943bb4be70cc0e1faa9e279
SHA512 abbb2f717345dbe8bf6941022963a818c73d4ba3214ceaa656f661cc9c5ef3b9201a68020c0ef86152fe74004d4d7b79efa16fc830a5231b35b5a1134fc8f483
SSDEEP 384:sxZ9Xqya/fEsxG66s8qMpRiYnazAW8pZS15posJWeT+9RkHbkd+3:sF6ya/fpG4Mnc7WeT+9iHbcC
TLSH
T18DD20806A924C8779FC39D19A43D7E33E9EC405252C5CEDA5AECCA1C019D5FCAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6fffaf242ea04b5336ab6528d91ce2349661d0d5afb9b24d475e997f38afdd5e
MD5 4ac1aa388bb0428054ad17d8a939a52e
SHA1 de568171b9986e16505cc0093d534a4a069f8f84
SHA512 2a15fb87f0ce41a02a0bddbc5df10bb3b251b292c0f6613f354c3ab9e6a85e95e48a0a979f7d2794e8f426aeae379b2d54254df602d80d81f16339dd1d9b5ac8
SSDEEP 192:sxZs/ywFaKOMl8Mka/fW3sx26sIup3h/lHW6+WNymIxdY9IpotVIg5vJ:sxZsXMa/fEsx2RnHb2dI3
TLSH
T10652D7166B245977CCCBD219FA45BB53E6F5056292944E88EAFCCA0C05E6BEC330381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f7be1711c8907efb237af6ef94f2f1d8d9138051ca76d41aefa8317cb23908e1
MD5 198c42ec58850dd1eca41ba842fcc089
SHA1 481ad91a9f1fe89985e4bd2bd5b71066eebeab18
SHA512 ed03a49b02deb560e7529033eb5de4d25e67ca665e9714b7152e1534ac889be31f13fce32078a0c6867df71bedf94560baafb71a5120e72140d01d4a9e7d43f1
SSDEEP 768:F2cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFLlwmWNcro6gfr:F2cv21wWvu+Z+u1jahFLeRNH6q
TLSH
T1BED20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e26c41-d32c-4749-ab53-74e50cd5544c\index-dir\the-real-index
Size 1KB
SHA256 0bb38df9585d9d24faaa0b8187f278de95b89f4e0098a70a303bc51e8a135312
MD5 7665cf94f9451d94b746cad5baf39ac0
SHA1 f9bce0dde65a8a85545bce7a27b348b10f8655ed
SHA512 30665ca62ca536db7fdba9a34d7fe6a2f83b37fe7a388d2f1ce03959952f901860a01f232a663ed2a08d75c0034454a4b0ddb858c5e59708c9d028c6c22d165c
TLSH
T1C93130998E91CD6BF46041B615B6A4E8737088CD0B24A323887C23392E7335E2A8B4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d4df4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e26c41-d32c-4749-ab53-74e50cd5544c\index-dir\the-real-index~RFe5d4df4.TMP
Size 1KB
SHA256 e8adec2246e9b6f25dbcd8b48e8759c731126febf05f977b8545317423bf62d7
MD5 c9f53f0c80fe4bf02441255d02c75001
SHA1 3ddf7e882d0e681af636271425746f840e029719
SHA512 e10e67944c15dfa97820d4568e0d648d81e76e5b3d21a7a867afb32a9971740aae5f6ca0b2845573e17ecce26cd02ccc03c43737db5c4dcfe17051ac7e335a04
TLSH
T1AA31328A8A918E0FF8D4517B0E63F8B8733598404321B393A87C62399D65BCD2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 188fa5cdc2282779697b5f39b35caba9fd44ac561768f7da90e92db25d99ddd6
MD5 e4351d971e4932c08c9ae08ace737e13
SHA1 3ea9f4cdee49a718f9374ffd542612e2d3dff70e
SHA512 bb64715f354db4670ad8a6b8659cf5c266e8c100cb0e0ef7f207db3afa158b2698e852034d71b5f72f93b67799b56e89f2694c90ad9921c2ffba754c991e4805
TLSH
T1ACE0C0FE1EFB2C00DEAFC3D2083240A441573C44C940FC0F102A91836070711340EC11
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2217f2fb8318581913720a12cd15e641b8a52589e7f5f5c759f1544bb3fcf8a
MD5 8e53f7b17e7a5090a46fbf266d8a27f6
SHA1 e925e70dc2ad7c8853cd6b1f4ad89c62e27ad5db
SHA512 cef9333daf9f331ce35ae3cd060358b67abfc24402173131cbec4a8e2ed29d65c42950e71b320836647e84188d1b4d318316756a706c9e2f1f77724c749b0951
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDOHuKw4OWvqKwcDz:mTVlpu
TLSH
T1D2910E07713A0256393D684DA7A69B364F523163B418B4BF7BB804A24A67E221DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 90B
SHA256 e9cf04bb9efe08c5d949188f7d07c1003209bd4decd95895fd60fdec80b356b5
MD5 ad4845e49f7c87b0d1900f13ff8fe80b
SHA1 dddcb82be4e688ee54f666114ead955e23f3cbca
SHA512 74169b9c4255bc514d834b2c3f4f1ac453c8bd89466718a8682b35cebdcea4b6617b34ba96db7d887657875efbc231f896ff2d90eace7367fc7f4777b6b8f469
TLSH
T1B7B002FB650C405A8A2599F50040341ED552414C0CD48AFC8830516651AC77600465A1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 174B
SHA256 eb87e0e65c749f76ad641e8a0bc606693e1f20448104424698661d9a8047f688
MD5 ae69aea073f1e8d23ca2b898f6a4732f
SHA1 4dfbb062462e5712101101bc9545b3566f09659b
SHA512 5fd2bccfb418fc2b1b08eae333b4816a9477bfca2cb136b7fed5dfb1657cadc6d0b1eb74af97b280fc0e506e6bde270e56e8f4bb481b2ef049eeb2d0593b0289
TLSH
T1BBC08CFFB23C819A4728D9F00040381ED6725E480CC89AFC8820B1B2B0BC362804A672
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b6703.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5b6703.TMP
Size 174B
SHA256 bba731d1f1e5a448036224a72ac5af31c2ea4176ddf8ae74f1a8f0680509ec53
MD5 e3ccb62478cf90c20099536dd9a3a8ad
SHA1 a40855391da035c5e6feff8cc00e019b5b304ab2
SHA512 e3115a2a9822a660c62ce6e7f32c4c6e4cba25554ae9b8835dec3e317ba80c962e2bc991ee876c1f1817c51f00f98fc104a56889b9e6198d4ab89bbe1f1ee5aa
TLSH
T11AC080F7F32940159725D5F55440341F82219E5D0CC545FC4460709160FC3A250069A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\000003.log
Size 28KB
SHA256 e8cab6502e9e90752befc7cb5a9b546bcd86d5e503861aadc4c1f60c62674903
MD5 6a1810496c05def945abc3b400e92d49
SHA1 255630cc67a995ff4a28622ec85432e8e785f00e
SHA512 c50f599ab64740aeb98c4dbd7256cb9aee47d41b200d85ecce40287175a2d0a0a28b9dd9e6d3067725a9159b9b781974f95acb5f4e9c4cd75926de9af8453aff
SSDEEP 384:4K1mxfwTVEIvGs+J0mUfFMdQ6QqMSYSnvpMGc:4KQxYF+tHUKdQ6QqMSYSD
TLSH
T1ADD2A73666221862E4370273C7E24F86C733CEC9AB104627F471B55C6FBB7485AA627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\LOG
Size 369B
SHA256 05d1ef8b9ea496e546acf30c0b7defa6db9d32f5e6dc02a28f2a2c85de77b398
MD5 a31952b2404b925d7a66039498528c1b
SHA1 3a8a6ec3f536c2e474312077cda3cde2abd1084b
SHA512 e03b94f1d9e2a39e1c3edf2e9436d575475f5f8a115cae5028f74c2529aaa6a7e1b30d9f677e9d7efe7c6d4284b2921df90f461b832029b928f2a43f68b9abc4
TLSH
T1EFE09258858AC25FA61C249B812C77CAB2B7750ABAC82D026B09E4B4F48244DB6A91D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\LOG.old
Size 329B
SHA256 ad19eea17eb01e9a1a58b9693e547d4c0fe11104ca20cae3b9ecfa3da78c1137
MD5 5f512008bceeaff0df1ac7b716ec75d4
SHA1 4911f52c3aecfca5647727a91df7c4bd496fcca5
SHA512 9efe9003b4e6c7790f20c72c7e6a6cc552b673f431df08352739db815cc1c9c4532a39e16e8c2d688ddfc6865bb8f4eaf46c14c6e0b042e78b8e2688346822b5
TLSH
T170E02018C9D7C22F661C64D69524774DB6B3250BDBC43D091F04D474F48784CD66D1D6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599d5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599d5f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a9a93529b93e461c1223e48c8fd1bfa81c1640041180d0fd3174797c210c5e05
MD5 53a2bca3e11054ab204ae665dbb17010
SHA1 9855828d9337c42fc24d5618af96f1aecbcfa249
SHA512 461285d24ad9a2ac57dcf2633f6ca4cddcbf606ff2614bbc7ee749bd56deed06c7d7a511753bf3bebe6d29793245e918829878163c09217cf6796668f29ae180
SSDEEP 384:+ZcIhsNZ8H8zi5FB4e+CnDO85cS+5IOObjI9G6w75G:8h6SBLfDOQvOI29MU
TLSH
T1CF928D32AD384C76AAE6A555F88739174EF89137D3CC2F84E5ECAF0D059B5AC1306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4d729502530d1d76453a5578c81ba84ad1dae6812e84c8719e3c74d7f81149c
MD5 8c7af337a6fc1f5cba9aa79260f53e9a
SHA1 1137a1f9cb16c37a28ed54be1fed19f303584a88
SHA512 58383db8632144219c52c5069cea501c4daecca0a749bcbc6bfd12a6ba756ec49f5c1e8e4b6177f115778e8f8642daae030d11670261865a34fe7567dab46a2f
SSDEEP 384:Q67FiZcIEzsN78TUNTUlIl9H8zi5/B4e+CnDO85cS+EIOObjI9G6w75G:FFQ4Kwg8cBLfDOQvZI29MU
TLSH
T1DCD23AF259E74876EAAE5747B77E2D124EBCC067F1846A80B3D89A0CCD560BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f6bf6753d5c5621d15a57d9923d4af5043cd2185c69936e4f453c1c3eb782d0
MD5 35558b651fcde476a7e9a5962db200d2
SHA1 d102751e9eb1862285e96be7bdd13326cd0bcd71
SHA512 3caefca1f0eb645dd511c1e640ef7971252b4e0655a5f6a71390e883100f6870394089833b8dfc52cf6c452e98edc68058dfb4fb0edfad42f0690f614b4a8118
SSDEEP 192:JONBB6v+YLNQmiUygOZh+CGEDO89e/usaWvU6:JONBB6vz/YZh+CnDO8mnU6
TLSH
T11202D835BD381CBB9FB2AE49F5873A175FA8113BE6952F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c7627add8e8be0a60517aa475adbb81e525210bf5148484f25dc9ac59ad0e66d
MD5 b8bdbe06af3cba35f09a171a7883d099
SHA1 54aac2f8220d923fc9a43e82180e43641b05ebdb
SHA512 97a704c6737cd94fad02d7cbf9be6a4b67d189534a61f83d6df0fb4e894a09cede34cacb0f4e68ee775ace18d3b79edf89eccbdc4507d0b2dc62f4beb47e1f82
SSDEEP 192:CON06v+YLjQmiUybO+h+CGEDO89emYFS+cCHnqLU6:CON06vz5Z+h+CnDO85cS+VIU6
TLSH
T1A4122A36B9385C775EE2A585F88735139EA94127EA897F80D5DC2F0C06DF69C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8ecfb32dfdbae02b4eb75c6e1690253510f7f258fe59c6548262a1aa9d8e8a4d
MD5 839841ff789ac6ceca10dbe2f6a31167
SHA1 dc87a8edd0bb79de0f94977b46ea727898ce9b63
SHA512 9ff2117e0482892cfa421360c1280a060cf11f39212a267a9cc5df0a94d7485a91f6bcb7a7985d8794a7bbddf34551539bbadb834c73efbcf08fc56272e1de7f
SSDEEP 384:7ZcIhsNZ9H8zi5FB4e+CnDO85cS+5IOObjI9G6w75G:jhNSBLfDOQvOI29MU
TLSH
T10F928D32AD384C76AAE6A555F88739175EF89037D3CC2F84E5ECAF0D059B5AC1306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3c02964986d7e2821794785495e2a7afa98f73e2e60d67f4041b97e9d0f828a4
MD5 abfe269587e61e7dfa88557880dfae78
SHA1 313d136ab9418d0e0f5e8643daae4a6189b00225
SHA512 56baadb5f8e0cce99c583caec7bb1fc28d6fb3e7b0cf6ef48e8fa28ea626b31f572e93ff71a2b9e5c658591f31ac2b792f95b0b13a73817029aaf1ca8b024631
SSDEEP 384:Q67FeZcIEGsNl8TUNTUlIRRY8ziMeBEe+CnDO85cS+nIOObjI9G6w75G:FFcZcwgtgBPfDOQvsI29MU
TLSH
T132D23AF259E74876E9AE5747B77E2D024EBCC067F1846A80B3D85A0CCD960BFD306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3d7351442b661a8b2e44cbf8b1649c1c1adfced4f6f56dc5baa2ecc225dce689
MD5 2b1871b088658ad95869b3d0e1b458f7
SHA1 b135fcb96c62c2e63c1b0f70f11a1a51964fc93b
SHA512 d173b501e8a3c6e692067c16dcb1a6cc77e9c25c5acff8cdb71dc0d28add8d30d2eb5acf42af4e19fb7229c3a7a04ab4a415d5ca401544a900c249a804091495
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 07a689ef27a58a035844af2aa12f5add1c8a2c8a3d43a6da666d626618642d04
MD5 c3b8be0848c57455bc6d1237c5d4e3e6
SHA1 9e3eeaff2409d122d1284a7faa498d9715e25e81
SHA512 7f8c6a836d4a6bb34ff4e3d13bba29bad4df27da40c3060b0dfffa2e9a244a4962f686e9c2f58098c9a67c7288b1e2813eddcf7a0e09c8d42f909db4ba5c902d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5b50dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b50dc.TMP
Size 392B
SHA256 92b83cffe193c71ad1cc286d85286aa9dffdd9c8307c92823b251ff9222dd3fe
MD5 41a72f36a10ff6edec63da0de3616200
SHA1 bc50474fd100c8eb341b910cc923049cb049541f
SHA512 7cffb5cbc92c975b55828ba3d1cc92443192f0ddd8d8c7f105aca9ce07d5b06e426b2ce49525b98774e172f95c1a0a052276dcd5e11084829e0caa538c210548
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5fbcdeaeb1a88c2bb46a0f93bdd8a1a89ce88f82775a91595e67452b11d2022d
MD5 87624afe8ff1057208c192e91b748336
SHA1 f68f5d209091675dd0c592437164bb0a36757e9f
SHA512 9823689603c9b7fd7b3574491d6dabd8ffc889dd003599f85ee5f4afce125bfa92378d9e2e5ca591eb23d7550262ba82f171490817684471ad2c1d4261d5f241
TLSH
T1E241F858A7EE1148B3B77E5A5BF6A82E487FBD772E06C15D10110E4F0A62B44C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

DRAFT-DEM-493.xhtml.crdownload

Path C:\Users\Admin\Downloads\DRAFT-DEM-493.xhtml.crdownload
Size 1.2MB
SHA256 b8985b4a767820a5838ff03381db71295764189cec14a9dc41eade951805442a
MD5 408a1b830beb13f80cec425d3de3d29c
SHA1 6759500e9062f2446e4d2fb6a6436b5fe0b4047b
SHA512 ddfe9323284576aa4ae2e1785035abee85a6fc35f661d13e46546e423e9ced433c626334c2bd96781aeb10fd6b07ff29dc2b778f91a973a69020a68d021fc1f0
SSDEEP 24576:KvR1uPTHObSFII+wunJcR3xjgjlm3YVkvKZMSM7iylCrOOJklDuT:s6PTHmSFIIHi
TLSH
T17945C0B832082CDA261A516BDD97E8F60FFA2A23DDDB50C980757AC30C63275FF55819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cierre_Igac-6c5f3_2320473.xhtml.crdownload

Path C:\Users\Admin\Downloads\cierre_Igac-6c5f3_2320473.xhtml.crdownload
Size 1.6MB
SHA256 7972bc0eba6794dacd62b5ce6e7326c808f19acdb3c56ba8096e16acd6cccf3a
MD5 b549467a6ed77cdc8fda412b6bc6eb9b
SHA1 5cdfbb42da4a8202a916f0a7598275ae207fd79b
SHA512 0b769002dd7e771e88b90e034205de5ac4013b937933a4957785c55793430701eb574dc21ed04908a08bc1c544022515d0091a17c47d422dd37e3838e62404ea
SSDEEP 24576:SLkC7mYgAU7WvdLuaCkuGrkcW3n90Oujmq3vPRG4ddF5DWbK6aARwRBz:SLkyUAbwnm
TLSH
T17B75E1B8B5583DEE23EC556BE6599D9D1FE0136389CBB1CA00E4BB8319973B2DE07404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download