hxxps://www[.]dropbox[.]com/scl/fo/owmv78e2d85hq9vf7835n/AJQ2eHGdkDp5F8Bm-mYvXKQ?rlkey=ti7vso4sji4pl5ijoegefx3ke&st=m5089ns7&dl=0

Resubmissions

09/08/2026, 03:25

260809-dyre9azakd7

09/08/2026, 03:20

260809-dv7ytsszew3

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fo/owmv78e2d85hq9vf7835n/AJQ2eHGdkDp5F8Bm-mYvXKQ?rlkey=ti7vso4sji4pl5ijoegefx3ke&st=m5089ns7&dl=0
Sample260809-dv7ytsszew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1664	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307192714417051"	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\DefaultIcon	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\shell	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\URL Protocol	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Velostrap\\Velostrap.exe"	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{FE8C1FEA-254B-486B-B235-55553EC174F7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\shell\open\command	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\shell	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Velostrap\\Velostrap.exe\" -player \"%1\""	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\shell\open\command	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\ = "URL: Roblox Protocol"	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Velostrap\\Velostrap.exe\" -player \"%1\""	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\DefaultIcon	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox-player\shell\open	Velostrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\shell\open	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\URL Protocol	Velostrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Velostrap\\Velostrap.exe"	Velostrap.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2616	Velostrap.exe
2616	Velostrap.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	Velostrap.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
2616	Velostrap.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3360	3852	msedge.exe	85
PID 3852 wrote to memory of 1436	3852	msedge.exe	86
PID 3852 wrote to memory of 1664	3852	msedge.exe	87
PID 3852 wrote to memory of 1436	3852	msedge.exe	86
PID 3852 wrote to memory of 1436	3852	msedge.exe	86
PID 3852 wrote to memory of 4412	3852	msedge.exe	88
PID 3852 wrote to memory of 4412	3852	msedge.exe	88
PID 3852 wrote to memory of 1788	3852	msedge.exe	90
PID 3852 wrote to memory of 1788	3852	msedge.exe	90
PID 3852 wrote to memory of 1788	3852	msedge.exe	90
PID 3852 wrote to memory of 2244	3852	msedge.exe	91
PID 3852 wrote to memory of 2244	3852	msedge.exe	91
PID 3852 wrote to memory of 2244	3852	msedge.exe	91
PID 3852 wrote to memory of 3228	3852	msedge.exe	92
PID 3852 wrote to memory of 1916	3852	msedge.exe	93
PID 3852 wrote to memory of 3228	3852	msedge.exe	92
PID 3852 wrote to memory of 3228	3852	msedge.exe	92
PID 3852 wrote to memory of 1916	3852	msedge.exe	93
PID 3852 wrote to memory of 1916	3852	msedge.exe	93
PID 3852 wrote to memory of 4616	3852	msedge.exe	96
PID 3852 wrote to memory of 4616	3852	msedge.exe	96
PID 3852 wrote to memory of 4616	3852	msedge.exe	96
PID 3852 wrote to memory of 4488	3852	msedge.exe	98
PID 3852 wrote to memory of 4416	3852	msedge.exe	99
PID 3852 wrote to memory of 4488	3852	msedge.exe	98
PID 3852 wrote to memory of 4416	3852	msedge.exe	99
PID 3852 wrote to memory of 2788	3852	msedge.exe	101
PID 3852 wrote to memory of 3548	3852	msedge.exe	103
PID 3852 wrote to memory of 3548	3852	msedge.exe	103
PID 3852 wrote to memory of 3548	3852	msedge.exe	103
PID 3852 wrote to memory of 440	3852	msedge.exe	104
PID 3852 wrote to memory of 440	3852	msedge.exe	104
PID 3852 wrote to memory of 440	3852	msedge.exe	104
PID 3852 wrote to memory of 4732	3852	msedge.exe	105
PID 3852 wrote to memory of 4732	3852	msedge.exe	105
PID 3852 wrote to memory of 4732	3852	msedge.exe	105
PID 3852 wrote to memory of 1548	3852	msedge.exe	106
PID 3852 wrote to memory of 1548	3852	msedge.exe	106
PID 3852 wrote to memory of 1548	3852	msedge.exe	106
PID 3852 wrote to memory of 4120	3852	msedge.exe	107
PID 3852 wrote to memory of 3912	3852	msedge.exe	108
PID 3852 wrote to memory of 4120	3852	msedge.exe	107
PID 3852 wrote to memory of 3912	3852	msedge.exe	108
PID 3852 wrote to memory of 3912	3852	msedge.exe	108
PID 3852 wrote to memory of 3324	3852	msedge.exe	109
PID 3852 wrote to memory of 3896	3852	msedge.exe	112
PID 3852 wrote to memory of 4768	3852	msedge.exe	113
PID 3852 wrote to memory of 3608	3852	msedge.exe	114
PID 3852 wrote to memory of 4700	3852	msedge.exe	125
PID 3852 wrote to memory of 4700	3852	msedge.exe	125
PID 3852 wrote to memory of 4712	3852	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fo/owmv78e2d85hq9vf7835n/AJQ2eHGdkDp5F8Bm-mYvXKQ?rlkey=ti7vso4sji4pl5ijoegefx3ke&st=m5089ns7&dl=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,12353941198568130449,4522450814474121646,262144 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,5665984156398926420,14941953126616901443,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,16971006745650123236,3444642785538529995,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,17020346771831837805,12427327592227008010,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,8873871459801382146,2320246629621081479,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13926262191041199616,7339527332114851648,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11814150284338311146,2712220730604722628,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,11949297905208832036,11844133163820603084,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11301971445755239885,10891514364533689546,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,400409766740926129,15611182895535414098,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,270306109859967966,5321684741347299440,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,270306109859967966,5321684741347299440,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,323981003068905846,14547655292089207979,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6548,i,11506791564982019704,2300288052328444153,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3700,i,12849133119487680546,360748242302538240,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3712,i,3176831647653081638,8315658056931992066,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,17827540922256628877,325206556289016665,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6832,i,14585446657357508782,8469425476190353889,2097152 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,10277070698292612010,3387899235213972768,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,10519266397917143907,17424264734534148076,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,7407926336867282655,6461746477171866346,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6122784156138357993,9158672251506936367,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,2918189058653894799,9326273513386603630,524288 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,11822354633870116193,16235891429029371820,262144 --field-trial-handle=2084,i,7944991191760264020,14553827492379220028,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4336

C:\Users\Admin\Downloads\FOR NEW VIDEO\Velostrap.exe
"C:\Users\Admin\Downloads\FOR NEW VIDEO\Velostrap.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 910f7fd39f7b36aebb9f3f7cc79afb3cf818f52665495894bbd041744941437a
MD5 b66c4fef2e169f4c693fc05e62f5e662
SHA1 eefd49a31f3d937e1c3e482641f272fd93e5ce40
SHA512 8a0b8351e0aa696828b0b2a87f79ba2da60e8fef88a6f950972c191ee7e7b42a050467ce8458020e93aec9d25a7ed7970e7a8164168ce3cb845bdc1352ff8758
SSDEEP 96:XyUrrHmsql0l8IPpWMNHqSiIc4WKlKC+5RJ:9rrdqlNIPWKl/+nJ
TLSH
T1C5B1A59BCCB1BC09EB542334D2D23B84B1BD0893072E4E8E99649E7FA41A7F15D2DD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58dfdc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dfdc.TMP
Size 3KB
SHA256 afc9313e0f0129b2173ba2311e04071920e179a04bea8df7ff00f588f33fa6b1
MD5 d305c44fc93b491c226bf4c2d5485d20
SHA1 8a35ed4935b695ffb9e25a73274862aa0562b067
SHA512 23b74ab486cd2652e8c344636ce04af24165fb257dfaefc6b355c9a75d183a5704f3a0c64355962c4922ef51dcbfd21ee54b9fc813310d3aa41434e0055c08f6
TLSH
T105712BDB0D324981E7912730D0C1374471FC89A70B1F9E4D8A689BBFA5167F28E26D18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log
Size 831KB
SHA256 8bf73b3d35ab03c0c339804365c6776f506b9b11e01cafe215b87cd926f73486
MD5 1b29a8642d7661d4eb280e065499ecc1
SHA1 60742b1897c67662fd705901f49afcf1297749fd
SHA512 76a3e05170e71b68a5b74038822023fd88e7b1fb19261f50beda3ea91abe83d1e6ce6b35a354a8c176422a83be104daca6e466bb77864d905df547849ddd8e57
SSDEEP 3072:rLoyMjUdbifx3VfT6zqB5Sp8Xo1u5FsPRMp5ZAfpO4v8YieQy9yxrKkjbIAaa5cQ:nh+UdbiXzv3oIt3Lt
TLSH
T1BB05BAE1B5E96569F3B73A35693C1B985D3FBCC99C40A11F15E8EA4C0436F40AAE0363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 fd6a2b9550580959ee9a19f284d47ed3385172fde34a454cbcc96740abbce723
MD5 9716b5dba319389027b3305d3590ccd8
SHA1 d68c8e22b97f071735b84f52b8994d798be60b1a
SHA512 43ae3b3365d6d3042ef7c1b9d8c1ed91f7dfb7448acaa187f212215ef0589614c3f87922343a2db20c4e38bb450dc7fd5d1e380b129127a5a911734f7fade66c
TLSH
T142E0D86C85C9C11F711455BB55387B09E6D32A1F9B8CAD961F44D844B58604CA4AE3A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 58ccc4e926c578b9472a411bf9369c4f543a4157e122776745417d3285eee76d
MD5 e3097799166a003c70f9bd82e948a84d
SHA1 5c0acfe763a2d692c1933b9c401fa1090ade8c96
SHA512 22d4059054542a27397cc9aa2507cb6d6e132eb40e48791cd4e483caee33c49fde50602925c7ae48bac8c817e34dc33de5dd0b23c87ba99a9a8dc511a27fba9b
TLSH
T1118189F3C3E4822ED82166F55A14AE1FCD6D1A2553283C2AC9D9BE1F93F2436E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 022d5b8a496c4d16049a28e2b9130b09061b4b8ae9a2dc72567b5578898cde76
MD5 7637118bcca8b272b0a2c4b3155d5561
SHA1 d8f7ff943cf413f8415eed98cdfc44d5458fd6c0
SHA512 473dbd582113cfd9833aeca6aca0e4c58479feadd3296706b83f834e06236fc4e4c30ddcfdde8eb80624b89cd8d83ef76c9e1de01dad41c1f9170582f2f83816
SSDEEP 192:sxZ8RtJyM/jK1Ml8Mkq/frs1EaIYrT1pWbHW6+WN8G8/YLoy0dEIgrJ:sxZ8RMq/frs1E47AHbS/Hi9
TLSH
T19352E9116A34A977CCDBD209FA55BB53D6F50432A2900E54AAFCDA1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ed2b331a9862953c62d6f6243dfee1b1ea0a817617c73f461bdf6fe907dcbe6d
MD5 f502b4eb17190606e7f177ba4ea7d455
SHA1 18a03119f92ab6d6736bd37ff2dc82286ee98a13
SHA512 afa15b6fab12f46b1059db87ae4950d67c335718698f0d2f26c5cd9f03988f969f398348461ee7192597776487234a3fc4f095be68e047d24249aad9bc47a920
SSDEEP 192:sxZ8RtJyM/jK1Ml8UQD9q/frsotaIYrT1pYbHW6+WN8wHXYLjHGXEIg54J:sxZ8Rqxq/frsot47OHb3XIfO
TLSH
T1E152E711AA346977CCDBD20DF945BB53E6F5047292900E94AAFCDA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f164b6fc3c8aa4bf3f893f6fc9c584eec5d72c126b05282fab88d7922f4efa0
MD5 42956533f54d47f6420d25c3a57b702d
SHA1 e7357d0fbfba2b72cc95a4480ffbd1760ab59320
SHA512 df3ed5c553e35e3ad771feb8672147d4aa0ebb611a097dfd9899209934bb8ee1458690fa16476833c32cb75714063e5425f4abfc53317005da30fe3a66eaa289
SSDEEP 192:sxZ8RtJyM/jK1Ml8M9q/frsotaIYrT1pWbHW6+WN8wHXYLuVdEIg54J:sxZ8R1q/frsot47AHb3XYO
TLSH
T1FC52E811AA346977CCDFD209FA55BB53E6F5043292900E54AAFCDA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 47e8ea5369479e07d2cebe5ebf48b1fbe77c11dc956da26c44eefb5692ae1855
MD5 135068f35762a04e841f61bb0c421fd4
SHA1 e58a0cd1d176d6f0e627e63ded09d59cd4f54568
SHA512 92b160178f6863b427f7645c2b5dd521427460599b80b51a81303061978f3ee44a449ebc97ec9f4bd3df2b3d20b1fc93a8c03bdae8a75562812c3f7671b08067
SSDEEP 768:H3s6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN4rodO:H3s6pD1WvxzUju1jahILIsNDdO
TLSH
T16AE2FA3B680CCB7E4F841E5CAC2AAF977DD801CBAB94895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7d352ca39a5a42fe5ece171d394f7a6b7858db63ef718b621db9b441c977788e
MD5 797fc57e761058262356b343f51f8cf5
SHA1 9295a7222985209481fb18070f925f9a9ff86533
SHA512 55600ebad75fb094932baa2fd8cb168bbdfac83e15cd637c1410fb6560908b7a9bad710b27b52e06447f453222264ad8d77771f68372e8e77262cb77eccddeef
SSDEEP 96:KUAAKteP6OYKTCEK4K3qmq0gK9KOF2K+e:iivGr3Ee
TLSH
T126C1FF1271BF16023D7E690DA2548727AB427163301DA42B7BE910B11EABE385DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5929f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5929f4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5cb67d11906c1558c178c17a9b8bb3afe0c79535194c1408616cd5c3260bb0ef
MD5 d338a66e6b33c98b16381a388a7adb88
SHA1 a2d97c4b528947367f6bafeaf461552679755888
SHA512 8740b18424238d961e2724f2045356e94bb1ec714b4dc06197aabf61b82ba8e8cc12278fe31c47eb567d1bbe638064cc56e85bdb96f8019bb9356caf5a2a7961
SSDEEP 384:3YZcIhsN5nYS567a95OVnuzJr0TnTKwBODNZOCEKD6:3mhXejOJ2h0TnewBKZOfh
TLSH
T1ED927D71683C6C775EF6E145F94732078EB88173E9D52A64D5EEBF1C00EA698230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 23ce79c85b7da4c9b7753170a913d03d6b1b2c2d31a0d15f63a03d5c32c12bdb
MD5 d6a48113c3de76a9cec797f30b79cf23
SHA1 e5ee13e999b1442b5ea5d3eac998c8e19c45c6e1
SHA512 3904f6e72cbdd514ea3de599666af410b55057cf0b0907ccf6947c5682c172b338f4fdb2eb5c5e63e3a0f875b53e9dbdd5c82be8887adebc7199ff803adb4e2f
SSDEEP 384:w+iFAZcIlfsNb8TUNTUlIlGYSnB7a95OVnuzJrRTnTKwBODNZOCEKD6:wVF+JOwgMejOJ2hRTnewBKZOfh
TLSH
T1C7D229F248EB5836D9AE9747AB7E2D038EBCC063F4841950B7D96A0CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d76c90773695e0412e70c1d5afa69c8d3a7bd4c71479f15370e0cb9a63247605
MD5 3ee4486dbb53ab802efa52f709834b20
SHA1 b00ae2a9dabb5909d8232976a06cf22352c12710
SHA512 9e5165a10196b4dc01a543e8637e752fe095dacb0426839b34d41a310901d67aed9b877d905c88f36f8eb608f693c8513db9915753dd4ab8b1eae86330514bd9
SSDEEP 192:qONi6O7+3hQmiUyc4Gttb0gO2KDgG32qdU6:qONi61wGt95OVHvdU6
TLSH
T16F02E8397C286CB78EF2AD45FA8737179FA5117BE9952F40D9E85E0C00DB69C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fc08729c8ca3decf7a3f842f547e3044dafa57fd69952996082cb1eff58fffc8
MD5 505b604b16b4c2db9aaad9b34dc9a28a
SHA1 7b6f236fd59e01e1732585e7cda7f1b256d9f1d8
SHA512 b494d5078ce4e90fb45b4ff44e74ef570cdce2e71c2af5841ee10db1b97e19672e35c718b385760fa9a2f37a40447732b934c6c63c748326db66b37222b5525a
SSDEEP 384:IaZcIdsN5GYSn67a95OVnuzJr0TnTKwBODNZOCEKD6:IYdKejOJ2h0TnewBKZOfh
TLSH
T184927C7168386C775DF6A145F94732078EB88073E5D52EA4D6EEBF1C00DB698230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87278e93073a9d6339e44128fb9cff7a100d1cd527b97b5c6f273136a31e2306
MD5 403c0abf5beaf48808dbccdde60bfccb
SHA1 b5d66462ae5a2ceda50ea087e29721c18209e378
SHA512 6bede2603b225f916b00a94811cde04dd0c0ef325790afb76b15cffca2bbb4fbfa220e6471ff40bc3fc471eee0e0fd121e567ce1bdabb193f41aceb73c778509
SSDEEP 192:WONM6O7+3uQmiUyu4Zttb0gO2KnyF0SJr9cN3zq8FU6:WONM64IZt95OVnuzJraTU6
TLSH
T109121A35B8686C775EF2A445F98736139EA5417BDD862F80D5DC2E0C01DF6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d595d39-c537-41f0-921c-653098aa6f07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d595d39-c537-41f0-921c-653098aa6f07.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a2c58ea3e6f34b5f10fa4e86f68edd7263dee97b4097e2601a07a280b4e4de1
MD5 cd6c62f46175508eeb55fa2444502e82
SHA1 8f7a11592a6996405d56a279d14d6345b0732acb
SHA512 9c11972cc955cf9a7e90f5bc53013dbfdc48b9c43f05f58b0116042cae6cf93dbeacbe6417c0ac870e78be77b2aea0f5653b0034ad4726a30a9a57428af91e56
TLSH
T1814129A9B6FA1148B3B76E5A9BF6786D587B7D772E0AD05E10010E4F0A23A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

FOR NEW VIDEO.zip

Path C:\Users\Admin\Downloads\FOR NEW VIDEO.zip
Size 13.3MB
SHA256 87a8e5b134d54074e4166e0f7dc7b4b453ea9532be83d9aab410fb77dec008ea
MD5 0bac0ac369ff307860b50495ecb232d7
SHA1 547bf35de772ec708df87159d82f606c411af891
SHA512 ac5bf79216785a3cd2d37bb43ace193a27f04d397bc9ec15d4b7b85483938205eafac90e37fa4adfb8b05b36c11c41b1ae7f29822883d193ef02b4ba15781174
SSDEEP 98304:ZxayTscasdKQjsk+ZmD3QoOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlk:ZdsRsdKisk+ZYObAbN0J
TLSH
T117E67D8523FC2635E3FB4B35A970621E4976BC1AA812D78E1B84B61D1A72740CCF1B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download