hxxps://drive[.]google[.]com[:]download_m2qaVBLi2Lwc_file_OOE33KFemNIJ2rcZSveJ294PhA7gjF7WSM82Tuw40MMQzzzVBAoRxHRh1T5FXtgB9Dz0Kn78lYLrTYVg5ranPBrZb6CEDlsMmDdSoaZo6sfXpSIFGvjomBwDPfxJjRvtpdo@dropbox[.]com/scl/fi/qar4od8qeytglpl9ybg0y/nouveau_curriculum_vitae[.]vbs?vzgBRaDrmt2bBh6jAbTCgDTsIcreIpQU4p8GC02TQATcnBgjW9Q1QPYr4QRL0PWJ28VAZWrvlw2ltNa1TbjKPlba6xQzMvY=4Xib5OSYNWezxtePPoYKXKu5yrdsD11038j7nLbjRzLaIk078PaB1iO2xb15lQDbnvAF9SzhYMGsxN67dPwYONPedajXrBq&rlkey=1pwx8eon3kjlkpos3dkel20un&dl=1&yf7U9EkezHnykHZC9ePlG0q0TXztWuud3oPMpPpFMFMec7OOYCNM8etP8zPViIWLRP5LkmFw8l8=yoCTnJ8ceB6FC6t1XuOqvoMW3D7nMtXp94EtEWg8llb6T7Jwlnp6HdhWJ4RmNtE41G6Htjv8I/#c2RZ7xKmTeZ3ATuAkKJIy9FZWVpP9MaHwYwh3rObuHTQksJAcjBIYsc9B7aI8pTYQSIdPbIMhQ11x4t3UoKgpq8NTRA2gX8kQLWr1J7rOBNarWyOIbGh0HpIIoH2UwjNiUnUWEvR

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com:download_m2qaVBLi2Lwc_file_OOE33KFemNIJ2rcZSveJ294PhA7gjF7WSM82Tuw40MMQzzzVBAoRxHRh1T5FXtgB9Dz0Kn78lYLrTYVg5ranPBrZb6CEDlsMmDdSoaZo6sfXpSIFGvjomBwDPfxJjRvtpdo@dropbox.com/scl/fi/qar4od8qeytglpl9ybg0y/nouveau_curriculum_vitae.vbs?vzgBRaDrmt2bBh6jAbTCgDTsIcreIpQU4p8GC02TQATcnBgjW9Q1QPYr4QRL0PWJ28VAZWrvlw2ltNa1TbjKPlba6xQzMvY=4Xib5OSYNWezxtePPoYKXKu5yrdsD11038j7nLbjRzLaIk078PaB1iO2xb15lQDbnvAF9SzhYMGsxN67dPwYONPedajXrBq&rlkey=1pwx8eon3kjlkpos3dkel20un&dl=1&yf7U9EkezHnykHZC9ePlG0q0TXztWuud3oPMpPpFMFMec7OOYCNM8etP8zPViIWLRP5LkmFw8l8=yoCTnJ8ceB6FC6t1XuOqvoMW3D7nMtXp94EtEWg8llb6T7Jwlnp6HdhWJ4RmNtE41G6Htjv8I/#c2RZ7xKmTeZ3ATuAkKJIy9FZWVpP9MaHwYwh3rObuHTQksJAcjBIYsc9B7aI8pTYQSIdPbIMhQ11x4t3UoKgpq8NTRA2gX8kQLWr1J7rOBNarWyOIbGh0HpIIoH2UwjNiUnUWEvR
Sample260810-xec83avhpd

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
157	dropbox.com
7	dropbox.com
8	dropbox.com
14	dropbox.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe
3608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308611521118161"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{71275E48-76C3-4C27-B53B-F3557074E5C6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4912	chrome.exe
4912	chrome.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
1180	msedge.exe
4912	chrome.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3768	1180	msedge.exe	86
PID 1180 wrote to memory of 3528	1180	msedge.exe	88
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 4716	1180	msedge.exe	90
PID 1180 wrote to memory of 4716	1180	msedge.exe	90
PID 1180 wrote to memory of 1836	1180	msedge.exe	91
PID 1180 wrote to memory of 1836	1180	msedge.exe	91
PID 1180 wrote to memory of 1836	1180	msedge.exe	91
PID 1180 wrote to memory of 3064	1180	msedge.exe	92
PID 1180 wrote to memory of 3064	1180	msedge.exe	92
PID 1180 wrote to memory of 3064	1180	msedge.exe	92
PID 1180 wrote to memory of 3904	1180	msedge.exe	93
PID 1180 wrote to memory of 4628	1180	msedge.exe	94
PID 1180 wrote to memory of 3904	1180	msedge.exe	93
PID 1180 wrote to memory of 3904	1180	msedge.exe	93
PID 1180 wrote to memory of 4628	1180	msedge.exe	94
PID 1180 wrote to memory of 4628	1180	msedge.exe	94
PID 4912 wrote to memory of 1980	4912	chrome.exe	101
PID 4912 wrote to memory of 3608	4912	chrome.exe	103
PID 4912 wrote to memory of 1592	4912	chrome.exe	104
PID 4912 wrote to memory of 1592	4912	chrome.exe	104
PID 4912 wrote to memory of 2108	4912	chrome.exe	105
PID 4912 wrote to memory of 2108	4912	chrome.exe	105
PID 4912 wrote to memory of 4060	4912	chrome.exe	106
PID 4912 wrote to memory of 4060	4912	chrome.exe	106
PID 4912 wrote to memory of 4248	4912	chrome.exe	107
PID 4912 wrote to memory of 4248	4912	chrome.exe	107
PID 4912 wrote to memory of 1716	4912	chrome.exe	108
PID 4912 wrote to memory of 1716	4912	chrome.exe	108
PID 1180 wrote to memory of 4292	1180	msedge.exe	109
PID 1180 wrote to memory of 4900	1180	msedge.exe	110
PID 1180 wrote to memory of 4292	1180	msedge.exe	109
PID 1180 wrote to memory of 4900	1180	msedge.exe	110
PID 1180 wrote to memory of 4900	1180	msedge.exe	110
PID 4912 wrote to memory of 4120	4912	chrome.exe	111
PID 4912 wrote to memory of 4120	4912	chrome.exe	111
PID 1180 wrote to memory of 4544	1180	msedge.exe	112
PID 1180 wrote to memory of 4764	1180	msedge.exe	113
PID 1180 wrote to memory of 4544	1180	msedge.exe	112
PID 1180 wrote to memory of 4764	1180	msedge.exe	113
PID 1180 wrote to memory of 3748	1180	msedge.exe	114
PID 1180 wrote to memory of 5428	1180	msedge.exe	116
PID 1180 wrote to memory of 1564	1180	msedge.exe	121
PID 1180 wrote to memory of 1748	1180	msedge.exe	122
PID 1180 wrote to memory of 1896	1180	msedge.exe	123
PID 1180 wrote to memory of 6084	1180	msedge.exe	124
PID 1180 wrote to memory of 6084	1180	msedge.exe	124
PID 1180 wrote to memory of 6084	1180	msedge.exe	124
PID 1180 wrote to memory of 5768	1180	msedge.exe	125
PID 1180 wrote to memory of 5768	1180	msedge.exe	125
PID 1180 wrote to memory of 5768	1180	msedge.exe	125
PID 1180 wrote to memory of 5872	1180	msedge.exe	126
PID 1180 wrote to memory of 5872	1180	msedge.exe	126
PID 1180 wrote to memory of 5872	1180	msedge.exe	126
PID 1180 wrote to memory of 4848	1180	msedge.exe	128
PID 1180 wrote to memory of 4848	1180	msedge.exe	128
PID 1180 wrote to memory of 4848	1180	msedge.exe	128
PID 1180 wrote to memory of 2084	1180	msedge.exe	129
PID 1180 wrote to memory of 2084	1180	msedge.exe	129
PID 1180 wrote to memory of 4500	1180	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com:download_m2qaVBLi2Lwc_file_OOE33KFemNIJ2rcZSveJ294PhA7gjF7WSM82Tuw40MMQzzzVBAoRxHRh1T5FXtgB9Dz0Kn78lYLrTYVg5ranPBrZb6CEDlsMmDdSoaZo6sfXpSIFGvjomBwDPfxJjRvtpdo@dropbox.com/scl/fi/qar4od8qeytglpl9ybg0y/nouveau_curriculum_vitae.vbs?vzgBRaDrmt2bBh6jAbTCgDTsIcreIpQU4p8GC02TQATcnBgjW9Q1QPYr4QRL0PWJ28VAZWrvlw2ltNa1TbjKPlba6xQzMvY=4Xib5OSYNWezxtePPoYKXKu5yrdsD11038j7nLbjRzLaIk078PaB1iO2xb15lQDbnvAF9SzhYMGsxN67dPwYONPedajXrBq&rlkey=1pwx8eon3kjlkpos3dkel20un&dl=1&yf7U9EkezHnykHZC9ePlG0q0TXztWuud3oPMpPpFMFMec7OOYCNM8etP8zPViIWLRP5LkmFw8l8=yoCTnJ8ceB6FC6t1XuOqvoMW3D7nMtXp94EtEWg8llb6T7Jwlnp6HdhWJ4RmNtE41G6Htjv8I/#c2RZ7xKmTeZ3ATuAkKJIy9FZWVpP9MaHwYwh3rObuHTQksJAcjBIYsc9B7aI8pTYQSIdPbIMhQ11x4t3UoKgpq8NTRA2gX8kQLWr1J7rOBNarWyOIbGh0HpIIoH2UwjNiUnUWEvR
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,18066487614444643877,3206144200226133277,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,1979218819748385157,7389523428179134243,262144 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,7846875777504125787,14104596261177295756,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2692,i,17649375040273215800,3039576360314479539,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,15709985012053271929,16317308703380280599,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,17678133486133092910,399513692205887392,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,9687015435718976629,1874922092953434422,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,11602792675235290348,14544181478833064771,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,8678040842073064843,12309688087456412919,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4857565469352665656,9387786561678565494,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9346252808420006946,10004405294466738776,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6438191597941114350,14661243188548006770,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,13684822914412725658,1215297220849403315,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,13684822914412725658,1215297220849403315,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10870039159381318077,2734852088830096537,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5952267234009512711,1598803359667349336,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,10357697966034810358,13987590787469479291,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4448,i,14099713296564758465,2401929777174843002,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4584,i,1578597544181800253,12791345586460842131,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5060,i,3607619621660317610,9236458290961950745,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3736,i,17546784163457589170,15776082034867445474,2097152 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,12388740062237684335,2894025385527014649,524288 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,17563313644947197655,2339528859412446026,262144 --field-trial-handle=2736,i,15283830099736501946,8980733664592573917,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0x11c,0xf4,0x7ffb74a9c728,0x7ffb74a9c734,0x7ffb74a9c740
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,8184999013461603341,8095651788371917390,524288 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,7847539312621068761,8405362892901016304,262144 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9826466435415163951,3318200333198171429,524288 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8834385100922518965,12302308259941723828,2097152 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,15377516229728410019,16057384617323051037,2097152 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,9923157575871978135,10754872626449423093,2097152 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,12839886357610737654,4057416913077932836,2097152 --field-trial-handle=2052,i,2648341944759051461,4510920961927224974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bb85c2a-671d-4934-b4fd-cd55a7d7f135.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1bb85c2a-671d-4934-b4fd-cd55a7d7f135.tmp
Size 116KB
SHA256 18689a93c4b1f9ca2826018c5facc08bbb618fdd09f84bb64bc75631a72dc2fb
MD5 fab4edeaa253e621e3e294d3946cd388
SHA1 1b9062920dcdbc7b1f19125308a7c3a2bec1cbd3
SHA512 a9cdef4fa3fff7974c29f3384002640bee1bad916a451d79c318328fe3c2f70c0a77d205ba44694374f581be7960bd283ed9d55efb4a87c611a5bc4d58fff43b
SSDEEP 3072:SWFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:vFmUi21rSm8uUVNSlzY6
TLSH
T176C3121079A7F8F2FE99304476EE2A159D680D818281C6415773AE419DEF3C61FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9eced6c8588604d934d147ce5de7491704134c9e3a4a5a0cadf1128951b704bc
MD5 f5f7a59a7cd162ff7e991174aef0ccb0
SHA1 9ac1651b95eb36f4d9e8da0193d97049f270cf9b
SHA512 e5c009e261ce5f8222e02cdd2473ccf7b9aaad34c754cc58f9b0d1c8453f42b96583d8489ba0ee78f85dce21dd515b68bcb4536a5ec82a8aaecd905f12de9b80
TLSH
T1DC3189F793B4997E8A01D2E4EA156F1FCE790524131C78A689D46D2B43F39B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 90c0c7f29f676df82d3f48ca15bd0b32f1f04a13731bbe71566185c4cf572d59
MD5 9c86c334587bc67acfe6989fed9c62d6
SHA1 11be4676be3c57f18181af4add0e427da29554c1
SHA512 3fb17b98c12b5fbb42fd07960801291a2a27f49b00a923fc65245455849930585d056935d79819cc8e676a1e38203e8b06a6681abfa6eb54c328b6e0db15944d
TLSH
T12CF059A796BEB427407985BB1D057C09A5B9B83902C078F8CF7AC26CE0D24F31B02067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ef490dc1b23d84950a8d54a6757396ff1713238a8c13be0ddbade8861548ec56
MD5 ef58238444a67ddbf8c8f90ae5af5d17
SHA1 865aa8e776e18f38de668bdb8e10ac8505a02372
SHA512 e2280ddbe99d6dcd4e4f8530e8656ea7bc2ea3e9103117ecbac4d0a2f5b32b4a7972e686ac9ed2e76d6a19bb3e1860d00265e73395aa78abdedbac593f115848
SSDEEP 192:hR1ZvMv/9TpSecOcTc/v7cpAPRp2qg9BHsb+WNngeZ0Rv5cPyIsnAUge:hR1ZvzewUXlgrwP050e
TLSH
T12732B52EA914697B5CDBD229FA667B93E3F5103624902E84EAFC893C15E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3486d1879e2c433cbdab7cb21dae021b82934eb4622c52a82deca9e17e2be165
MD5 55644c685aeff37fb07637caca7e16e8
SHA1 f800c4d813e26fdd3a904ec42e267f67fd8b228b
SHA512 f17f14b7597b238fe9ab3eedd91e287eacd09f412448c78b1f919cc65c4de3dffbf83dbcd1b144fe89ace7b4d118a5b24aa302abc1202e8c3c5c5daf44f208d2
TLSH
T1D0B0120080016100C44201B81186A8D866149F10D509170183E46D76D8354618418060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c20.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587c20.TMP
Size 96B
SHA256 2c5c980773cb22de215780791329c12fc71a5bc1f03aec629055743c126c9fc2
MD5 ea275972afb2d6442679a35ddaf851db
SHA1 5f48b3224f2cf6cbad5e357bb6199be6ec3385ee
SHA512 e3739ae89cf11300fb49ce8d1c0879d0f9408562394fa59507adc521ee275e2efa269cc539270beb48cacbfc946eb8d9463dc08e17315acab8395af04cc36553
TLSH
T18CB02220C203230AC00303B02282A2C83220EF28C203022282F30F22CC2033000300B2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9fc282081ea223b163c8da8ddac73acdb353c7ac8a8e82a1815d0709030cd301
MD5 54eecaa2536140d3b31be630414fad09
SHA1 92f907760115ec325a9b19065905761f9918aab7
SHA512 d892dd754d6b5140df8c3b6f8a67bd65326013ab1978866afbc194579b480e2fb480affba5d993bf5e54b468dd67064ebcf01890b9122a2127b175d2f5b15d37
SSDEEP 3072:SrFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:2FmUi21rSm8uUVNSlzY/
TLSH
T187C313007AE3E8F2FE5930447BEE2A145D6C4D818291C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f32c5d9efb1ab4f2e9cb6d708b48d04144a1c342b53574c8f51378e2f5200543
MD5 1934dac01a2b87c4a5d01b5f9dee7345
SHA1 8432498beef51f6efaa4ba284d0730ca1d247cde
SHA512 b9726cea0d61e129fb351e2da16880567ce03098a8427f45cd8eefe34db3a75a068fef93bda213b60962fa33e65956c3999468f337fc087334bdf402fe5ce1ed
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 37KB
SHA256 3b2ed8580badeaa0a72cc2435885d89e8e95d14d662a798fdb30daa14f0b39cc
MD5 a3d35c02bc5e98da4319006448bf7a8c
SHA1 0c93016beed5ce6b98a79b6f50d53b6616e3017e
SHA512 6f57027640e34ed172d6f5bad941c7a86ce0015f23e9fae130dc95fb4884bb1980e016871d0ee411cacd87984f2008f3192db0d770a67d65dca543a722bf6243
SSDEEP 768:a0/oxezMrWj8UT7KkM3loDswetvC5XPK1P9ELxPILst7uBvYrXgX/5t:5QxNruDMloDV/CfEjtaBvcEt
TLSH
T1900301F6DC6B045A86377FC030FF82CA6A0F67141A97E080202B899F719DF5657D5A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 16KB
SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
MD5 e6e59b39017f4009a0a3327967431678
SHA1 7c69616071dd68e02e4dd2b6e07281a1b627f706
SHA512 4fd7cdaa93d86fa40ebce2c45f9fca7cfe2293c60c0b2d84ce0cca3cbeebf5fe60aeabaf3568f7d73e1285a088f9e1c0bcd77c2731ee24981e393347e7cffcad
SSDEEP 384:pOibbuO6oghUlywYvxZyNCQvLm0HP5a17dO+:sYbIXJYfvLlHRafO+
TLSH
T1DF72D09752C0858B1C3003AF10ED05C18DAE32265B5B4FC1D08FD6EA96E2EABD52B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1eb925935765ef46aae54c9595a1614b007e204a8dcdbade658af4329f3bad8a
MD5 5c9b381d53d1f764da4ebc5d93eb54cb
SHA1 25f7288c10dae702f52aa11f6b76429c1eb0c81d
SHA512 f1998c1ff2ac4814f5ebe949d7223990dfdc208357f693d3fd6b6e90b084c0db16fd400203720ff593f84ce26e22ec0eebbe1b2d1c0d5574d7f0340f43ea89fa
SSDEEP 96:rX/1CPjzyx2vzoyYqMzQBmeVZa6jktXP9fDExER4Sn6B9sHpTvn+xq0V61yY2gyF:rd6YVZw5jCFrEqQkSxq013RrZ
TLSH
T168D1A7D503D190EDEB385279F7E40C8037649B66658FAE46AE90DCEE3CC67920978D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77be58bae2885c3ddf54d67232bd83ef1c14cc1f641b9d06a79d48030120b745
MD5 18552aed84a6d80030a84183347314ed
SHA1 6958acf9e85f2e93341f1dc7356ce9b6d0f734aa
SHA512 0f698be1ff7f9c766d8c7a05e13f80361d3c7e735f58e5e834cff298d1662441cbabdb205514d515557df10f4dcbc0b9bf079f26b62f821f110fc14b1373f28b
TLSH
T196615F5A03C240FEEB301378D5E00D013571CFBA2ACBBD9452A498FF7D06B634D6956A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b977.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b977.TMP
Size 3KB
SHA256 41a846e0826504691dd7a0db21e6fd02f4668874d743deb8d4af99b6aeddc3de
MD5 db55d339511688a5326e7e1a93554aac
SHA1 a54d5ae050add6f1fad98f9235ae59aa542b227b
SHA512 7dbad56c163a7f8b73dda1b462c167982f30026813168f6ddce8d3317e20c74fa989951ac0a66f7e440f722b941216b357b3f13102ed7edcb01771861abe9138
TLSH
T1F9615F5A03C240FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7D067634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a2fc056952f98afba5694442da19e3a00b1e781e3860e805f05707c8078e616a
MD5 449929aac32a5ee50ed5d959f02a10de
SHA1 4307c33850d9bd9c732fe109f118f8a183269d63
SHA512 d1dbbcf30d3b35cc2acd1682f4b773c853ab188384045403cb38e2549ba4a5874f5d2c05f5dfb997b13c73cf279a0c19b3b3ed7cdf3a1f8de924cd830441e66f
SSDEEP 96:D3O2vNuOuvzBfrjOtHzRmGGWu/ujfpVGOeGwQ:De2vN3u1frjOtTQGGWoUfT7eGT
TLSH
T1CF819DF2C3E5862DD91196F09A146F1FCE6C0566436C3C1A89E4BF4BA3F2471E152B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b203d25ac64a46e03cb5c83ce53eb4533c008eec3fa573f332e978b53e8fdeb1
MD5 e91d041dc1e5ed20caa4ebf31090917b
SHA1 7017549cdc19ac8a8cc2252a5f045863196e6654
SHA512 67d4ff493d704278574de5a62fe226bc7762d23089c573b1cdda9f8211aac4b51054a7b35d32a74f3f1d5b2ce17ca94b767db84bf0bcaa51acafb43a07b301c1
SSDEEP 96:D3O2vNuOuvzBfcGwBjOtHzRmGGWu/ujfpVGO4:De2vN3u1fcGkjOtTQGGWoUfT74
TLSH
T131819DF2C3E5862DD91196F09A146F1FCE6C0566436C3C1A89E4BF4BA3F2471E152B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fda84151bffde9156e2f740a6c4a87ce0af8574613ef4520e4de1ee5a683c6b6
MD5 bd65b4ba6befb5148b810dacf067bc77
SHA1 b529bddec3862ab20ca559cc7119c145c7e89925
SHA512 37631968627b8b0839d5671ec8c8df6febbd2a9463dd4ef1c33b3eb84280ab677329d607095fb19c1e577eeb2e06246221084a2b78b23fde6837c15ce5668bb1
SSDEEP 192:sxZpR1yM/jK1Ml8UQE9h/f1sIR1pbPIdp48fyHW6+WNBImBVz/Yw2S4+mIg50J:sxZp3qih/f1sIR1do+HbXD/0Hm
TLSH
T10B72E70266245D7BDDDBC21DB941BF63E6F80432D6945E94AAFCDA0C04E2AED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2453dce1f13a1f6d3ae0272fc6db06708a79e1db0316eddaed6956a59a92533
MD5 b0ed0edea676a517793af77ee54d5c6d
SHA1 21b6bf000f506b784d3496e0467653ea889ad7ef
SHA512 f52c88431d610fa4f524d7e0b812ccb1899b8364f6abec20039f1b30d63f4b2d65b596724779b260acbe7a5bcdf6939c3f83a80fd96e136db931c24073fed9b1
SSDEEP 192:sxZpR1yM/jK1Ml8M9h/f1sM7QIdpJHW6+WNGYw8R4+mIgrJ:sxZpl1h/f1sM7xJHbGXH9
TLSH
T17F42E9116B34997BCCDBD20DFA55BF53D6F90472A2900E84A9FCDA1C05E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2631b591eb6a6a0af8ae9569abc7f5bf0a600703a772f4777f82cc1ac0fe8ff
MD5 30cdb13e52600fce5ee3bb12a92f2b8b
SHA1 fc8bd175e61dbcf651332d139f4896daa062658e
SHA512 d0a130b788b421a65a5675882ed1bbbfd79bfd171c2392b318b06e3ab05cbf177be1fdd63bca81cf6f247d1f5a238c1a22d86e874ba43ec1dbd4b23514464307
SSDEEP 192:sxZpR1yM/jK1Ml8M9h/f1sIR7pbPIdpmXHW6+WNBIm/YwwN4+mIg50J:sxZp31h/f1sIR7dooHbX/pHm
TLSH
T1CC62F702AA245D7BDDDBD209F9417F63D6F81472D6944E98A9FCDA0C04E2BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bbad0fa3cbc9e9fb9946a15315a0eab51a08dbd5ad026a40ef18ff09311fbb1d
MD5 5aee215de41a5d2440ebb61190499fbb
SHA1 e8e083cb1c7bddfba10d1eea4fbf8a9beda55d17
SHA512 bb989f83a915d06b423178c86d52542eb7ed2545994b54258c6b3678081ad42c18978bd0d180796a1768abda86461abd82512f9319c67d7cc62b2d2ba556fa41
SSDEEP 768:wh4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+djroh2csayP:wh4jeXmWvmKLEu1jacPLZQdQ/I
TLSH
T19AD2093B280CCF7E4F844E5DED26AE976ED801CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 4f09c6c1a4c7687f3b6c5e3a7df7c1059783154ba9d2ab8e577327d50cdf1a01
MD5 f6d471971ca6f257a6fe177870b8e479
SHA1 e1e557040e602f285611e5aabfa6ac60bac549bd
SHA512 7c84f7ba29d7e325af39d651df2511a6d6c42b239b2da9ea63e46ef471fdeda4f35630c18bae45c91b3c924fab7f6356d58f3dd514dbeadc1455b16921878a3a
TLSH
T16031674A8E95ED9FF8544472157774BC7370C9CC8621A3234C6C21356E5635E1A5B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 d1cbcecf9a411aec15d49f928d394c89de71cf6278b8c9ca19ad2af1c0ac9730
MD5 2990b2b8405fde4a36c476365bcb3bdb
SHA1 2f562e5c9a563b38519121c9c9eb3f7928959e0c
SHA512 b0eca9e21ec97d597d7715a2a4e294b730b3c9f0176767542214aff50ec223dd92fde5cbe1db857840291189b6fc21368ef446f5ee7621b89f013b9ad6397253
TLSH
T1FA51F88DCC824A56EDAC11B318FE148077B664DD96885B17AECCB038BCC326E2C6B610
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eb84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe58eb84.TMP
Size 1KB
SHA256 c3316eaa116d0cad2fef46576dfb050eeceadfca0a2b8b8c6ff9607a5099cae2
MD5 d4733d94ed56f09911d5c7bdb270e9fa
SHA1 d4aba63a26e133c7309a5fc59a8cc1bef9a8aae0
SHA512 d2c3ce209a832d910cbbb5c5e5cd782feaf410afa169113f8995896cf67aa8fa5bbdc085562803bc5dc70581cadbaec621712dc92ffbd28e610bf1aa4ff0242f
TLSH
T1FA31664B8A80891AF884507709A6B4B8737698804311B783987C6139BD21BAE1F5E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 b775b3acdb1ad375998f4ed32d70a317812f74fa01625df70e16be4bbf690b20
MD5 127908431f6ecdbd653f624f67dc4f22
SHA1 4ac789f67a387132ccf835fb9c4fc3a8fe1b1da8
SHA512 85ab749897a8aaec73bacb42c5e7cd02f8e807d90a19f7a4705fb0b392b2add1e057024d2395d2fb26b6b5489e7f8c57c57ab2c8f26a913029b8669c4a7a5c84
TLSH
T163A002108B91110EC01711F655631741B341C8902184133781D58058CC605448E4904C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 b74063f5c15c20b08ba5cd62ddded45e5409c8494ea951b1d0c6f10f8ca738e6
MD5 96343eb50e1e2eb9ae58a3f55d12a7cb
SHA1 fc637df407ed8f74cf46287e6b74133abf943ef4
SHA512 5241de3fdde2cc54d49ffd7ee2c62ae1456686dafe18d3a7a846542f77890f238904a75faf8b0c16a4e29c47054e145f68635ec4364c44d593ff7a75b49bde6e
TLSH
T161A0022402993001C46B16B22DE601612F184DD102012365F6A1045CD8D0BD5565D42C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8e9690d5f929a84c0ee99e167dda649098f82a26886cc3bcf19f1e4357c18de8
MD5 7202cc01184edfc03902af4a1104555e
SHA1 ff69bda1c2566dade945a6ae750a073e6009672e
SHA512 5146cc3439fd5422912daf88b2f4975ff8556f953bf877a4b1bd5ef73c1878849cde0b13ab97cb267079bbc20f5c722dcf6e181281042c9172668a55c356f543
TLSH
T197E0D8F63DE73D20ACBF57E628B245A84146B4688955EC8E2416A2E751B12682416C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ae728d511e3c5efbaf31ba44cd226a0c201d830d137159ca6543ea106c7f8cb3
MD5 e1eb3ff74fe12db7e8bd90d6c2e929a3
SHA1 2f6957c3d16f1ee5cf6b24ad6657f58134e4a5df
SHA512 682f0f348c486e4306681a13e05e82b0ef11b4286bab10fd3d4a235d8652859293225185f57c8ba4689cfcbffeeba7cc965b810b8837788f9fb1b55673344c26
TLSH
T1A9A0025ADF6DB08AD11112F0D4A1418D2B5088DD071923218CAC1498889255542E6464
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594116.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594116.TMP
Size 48B
SHA256 e56c0e55b8968d69c2ef4620420140a8db6f78bee1c6a26944db48e856d95f9c
MD5 bf79e4cff51804a5ad2194a320787a17
SHA1 9ec9a89f2caca071cd2d5f495cbe25297703d00d
SHA512 300efb4d2bbfe1dcd94d5855aff58b57722f514e66379e419e4483ff4381d17ebc9d85d4aa78ad27a8761e9b18485302948c7fd5ba75224372caf3c769bfa110
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bf17c89365fadc4f4da3df510cde42f59a96892084cf51aba8142f7d6d1b0c87
MD5 b79ed0aa044fdb7370d3391e2e1bb420
SHA1 a5b90d39ed2352dca42e95e3dd51e65c07919ba7
SHA512 6d7c41ca6b63f68783fdeb7e3f23e98f69b669b1256efd888a3b34a105c079f136208dae56f380c00384863b0469bf7d6eb9dce8e4097323bce779aeb6efb3d9
SSDEEP 48:K8mIfKji0vyWmTKGQ44+GItlInm+KYLA0+suu1FkhSIfKDa4vyp2I/KP6Uh:K8mQKjiWe9eKmwFS0KDaSK2IKP6u
TLSH
T1BAB1010575BB52013CBE3A0D8558C73A5A82B1733529A42B7BAD04B70EA6F508EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e86717dc-b339-4370-97e9-ed3ab3645f6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e86717dc-b339-4370-97e9-ed3ab3645f6b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 20bd148a58affe12c6a9660c387854391093b22cdfe44da8e7eb85b671f1a78c
MD5 597a0154752ab56aacca38952d6f05ae
SHA1 b965dc0c8602d777e58c4307647519f5e1efc1be
SHA512 fe77c69ea4617bdbb23115175fee8d1a8b73bdfd345850c0640fffb031ed83cf1593206d08cdcb5f7225579dd7c5487b9ce9e8dca158641f9f66812467060af2
SSDEEP 384:sZcI5sNiUq/5TcXw3eFP2f+g8GYZX4+2fwFoLM:65T/eXdhmU4lGkM
TLSH
T1E3825C316878AC765DE6A245F48726138EFC90379BC46FD4E5FC6F1D01DA6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 efd28a4ef27809cbec92b34d87f811540b4408cec79f026ef6b30235dd4b00e5
MD5 f82d5cccd3f701e1ebe3bbcccd45f08a
SHA1 84a1f04555d69735d32fa7d606087659d4f2de96
SHA512 6fba96706b273a53bac34a510209cf61b4d09f4d455272eaadd7b7b5136e019f73efd2b9d764625f195b590f1b7a1a9b3020ba91685f104d333a05b390043451
SSDEEP 384:+iFPZcIcvsNH8TUNTUlIlq/5TcXw3YFP2f+g8GYZX4+2fOFoLM:VFHcKwgc/eXfhmU4lYkM
TLSH
T1C5B2F9F258D79836D99E9747A77D2D138EBCC027B5846B90B3AC5A0CCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4c821363e6a2cb5dd2f967d661b8c7480858c10e2f287872bccb4dbe6228e72a
MD5 182383a83408fcbd27ef47d475ac3c2e
SHA1 7dd237b01536b77cf4318bf75877c13251f0629b
SHA512 6edfa19f39179b3fb7c583acd2f49905e03436a86ac63edaa6c9f7fc7e3328aadc58a33e63f0ad6e1bef50ee7bf550bc4223483d857357e82e1cbd27c9f74808
SSDEEP 192:uSksNiUYYQPXnfjXHVZEdWQmiU1G3FB4H/+jVWjzorGYZX4+2f15cFTtqNLU8:MsNiUD2XwIiFuf+g8GYZX4+2fwFoLU8
TLSH
T1784209316868AC765DE2A645F04736139FF8512B9AC57FD4E6FC1B1C00DF6AC230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a019cd164b02523ceb9582fd69f0f1c616c8f9ce257e9bcedea533f8170fc42f
MD5 e503c46069bdf9113f37b48b74a4305f
SHA1 41d06da4f4c7b7a107297be6d0c1651e1d51518b
SHA512 c7e735f8d773cb8b970f5940923133f975a02333283d5518cd41a4cde6201ac1d318b4150357dc2b0714ce5a1cb371342c259e00d1ce5e1c69d3bdf1d468f887
SSDEEP 192:EONl6hZ0QmiUy1lpc/+jVWjzorGYW5wOZflnU6:EONl6ocpu+g8GYV2dnU6
TLSH
T16502FB35A8786C779EE2AE45F48737235FE4112BAE956F84DAEC1F1C00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16110057c5972a7c9d4b1b669a49f9f0a79292eb6f92e9b7bacf9db509c9e10a
MD5 0e307625abece40a5c9e41047086e350
SHA1 f80051aca52d33a05f37e6b01ddeeb3884dd0292
SHA512 c93be7b46a73fd6c1a85dff19dc8e5404772c0bbbcf3ccb9c68830218997825b548a0ccdde22c0cdc2a79812998a6ebfe340766404de2f759bae6b6e0d0e51ee
SSDEEP 192:AONo6hZ5QmiUy6lwc/+jVWjzorGYZX4+2fD5cOqtqNLU6:AONo6T1wu+g8GYZX4+2f+9oLU6
TLSH
T19D120A316468AC675DD2A655F08735235EE9412BEEC5BF94D6FC1F1C00DFAAC234E822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 9cfb9711b07769e19e3a87974498cc46181b756ce820339a0554aeadc2eb6349
MD5 114c2e0cde12053b5307482b2678860c
SHA1 4412db3d2d73ddd05d598c4124f47f083aa2d87e
SHA512 701e620ddb97368b33fd7f60c518f28589cdc89c761cfb2193030da7977018b5630617783d9617a96b343dea7aae118e3c36334af8836752209ce7791b73fef5
SSDEEP 192:uHksNiUYATGPXnfjXHVZEdWQmiU103FP8BH/+jVWjzorGYZX4+2f15cFTtqNLH+:vsNiU9TcXwI0FP2f+g8GYZX4+2fwFoLe
TLSH
T19F5219316878AC775DD6A255F04736139EF8502B9AC46FE4E6FC6F1C01CA6EC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d336705d-2813-44ed-8a2e-8fb662c35880.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d336705d-2813-44ed-8a2e-8fb662c35880.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dbd002cb1170531d433dc6a5439b30b0f484696f8662e8f94777d2f72d19e0fe
MD5 c8112a1612fe17aa18884d2ce27d23c5
SHA1 bb21c2a35e5029e07bd58fd6fd9405f169ecdba2
SHA512 651a4a412712d44f1d8b02c85c32effd0035ee914bf6985b40a90bd00e78eb8ff289f62259c1a8f9c4c9afc31667ff7bcc3cd4676909d686695465ffd9bd3938
TLSH
T17C41F958A6E91108B3B7AF5AABF7A86D447FB8772E16D45D00120D4F0663E00C962B77
MD5 SHA1 SHA512 TLSH

Submit Download