hxxps://drive[.]google[.]com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view

Resubmissions

24-11-2024 04:51

241124-fhcm9svmdv 6

24-11-2024 04:50

241124-fgcxms1lhm 6

24-11-2024 04:47

241124-femn3avldv 6

Analysis

max time kernel
295s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-11-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Microsoft.MSPaint_2024.2405.19017.0_neutral___8wekyb3d8bbwe.AppxBundle:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
5064	msedge.exe
5064	msedge.exe
1556	identity_helper.exe
1556	identity_helper.exe
3348	msedge.exe
3348	msedge.exe
3508	msedge.exe
3508	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2180	AppInstaller.exe
720	MiniSearchHost.exe
2056	AppInstaller.exe
428	AppInstaller.exe
4700	AppInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4060	5064	msedge.exe	79
PID 5064 wrote to memory of 4060	5064	msedge.exe	79
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 2128	5064	msedge.exe	80
PID 5064 wrote to memory of 4500	5064	msedge.exe	81
PID 5064 wrote to memory of 4500	5064	msedge.exe	81
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82
PID 5064 wrote to memory of 3408	5064	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82fa73cb8,0x7ff82fa73cc8,0x7ff82fa73cd8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=876 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,2838827957821084666,14724893486963086368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5016

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3916

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1600

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:3252

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:984

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:428

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
47KB

MD5
9f96d459817e54de2e5c9733a9bbb010

SHA1
afbadc759b65670865c10b31b34ca3c3e000cd31

SHA256
51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609

SHA512
aa2514018ef2e39ebde92125f5cc6fb7f778f2ab3c35d4ec3a075578fda41a76dbd7239fe2ea61533fb3262c04739c6500d1497c006f511aa3142bb2696d2307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
25KB

MD5
e29b448723134a2db688bf1a3bf70b37

SHA1
3c8eba27ac947808101fa09bfe83723f2ab8d6b0

SHA256
349cc041df29f65fd7ffe2944a8872f66b62653bbfbd1f38ce8e6b7947f99a69

SHA512
4ce801111cb1144cfd903a94fb9630354bf91a5d46bbbe46e820c98949f57d96ec243b655f2edeb252a4ec6a80167be106d71a4b56b402be264c13cc208f3e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
020d34a9c1bac4db1d2f32468020d639

SHA1
a07fb32c93ab844593638fc23f46f916f44e91a3

SHA256
e18e7d4880be8b4eb110b175bf343b077e7ff3b103e8f49991e4c05151969759

SHA512
77db05b1f783f6438cf13f4afaddcdb5ef515c595095ccc0df86c6efab581447f10695f93062f6a74756cd2baa4436cc0ed93d2895504d224e2f4b546ece7c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
beb372b4cb6de256c7f701230d00e446

SHA1
c01ecc4ceedefceb7e58e6d9b01bf90c3e547d3c

SHA256
220e0d7eed3069a656ff3339bd8ce973628ce15ae7e8da0a19544806c02dbc42

SHA512
b3801f664075acae87ccfdc3f785b011f1c5458585241eb57e28ea21ca9fb78024d689689ee8b8add42e42e96ebee393f11c81e5a43180c8f5c5c854fbfc4136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
157afc234329bc24a54e653de15d6b54

SHA1
05f59ff4f78d81f93e0b58b48fa626163cab808f

SHA256
78707e76f6bdf74fa4466a5a0663bc28207bc33a894f4daf8269eca69c6f9a64

SHA512
68a5e71590c8ce3746d3f744c009e74091d2b93ad78b9bb00a4eb60408a7a32e178df1e24d73fb79d41a189d0c99972b59823373a6dd4a2b6259fc5b806225b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
76d202dd8ec515a7050dd97002c0a37a

SHA1
8069b8621c4d677fc9124846b3cb9edfcdbc75b3

SHA256
e0d1f771eb9219a47e3edc17e62597d0ca2b51a3f87235f91b0297bf9d19fda2

SHA512
0f6443f0b5e76b8a6af89fe8f8111ef80636a78438b85e5fa92047dc6dc205e3d1e97c824be8605718d92b0af85bc67693e69da9a9ca0c2fdfe09d3fb9fc8ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
a89363edc175a0219a283ea0a551caac

SHA1
6492e3ce0473bfb97f802324777e436fc1e37c24

SHA256
0b6365cf107d384e4d91ceccaafb8688ed76fe9ae1a1fa669e56b8cae00980dd

SHA512
54aaf8620c474cbb92ffc03894cec689ca9842c991fdca8486b139a8e0c255a8aa7c66a502998f70cd5454e1b55dc53cc35eb81ad33229057de72e9bbf814a4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ffc6e558469e737e305890f449539a90

SHA1
774c9c5c7c536b79c70cfc5e6864ace10c662bcd

SHA256
f95183ff0b40e1531196652ba0aa72ec84117689d79dc2287e92295da25426d9

SHA512
6f41236dee4ec46554957d60976b4262876f787119dfe66560690b13f193b9f4dc12dcbfd8f3995dcac50bb561649ae2f537460556db173bfff1eb93e00092b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a909009ddd571c0122aa78261ba17645

SHA1
59a1ab215072e32fc804907d240b1ddc1a8cd29b

SHA256
2558d386278a172cea1f2cc3c159a7d530f9c5a03f622459c0c78536906eea1e

SHA512
39ab941cfdbf22e03fc815392060416f4a0d737154f3dce2371f86e6dcaa98ed65ce042d12a56d1e2fd0575030dfac65f3725f6a4aa6c7efee5d2d49f7b25ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c57ae0b08d468aee6606d7ea5163b12a

SHA1
f6e27b6db20465da3f54cad8fc56093995f48919

SHA256
8965ef62f65611d0e8f3c6f7a397a31cea81b063152c862b8a31b5f275a25478

SHA512
1a63ded0c7bbfea58142285d4a6d54872ac7acaf2c60c29c4bbcf43bfa35b6b24e5837b261b8d4e3074b5242afa4b8012ac395fc4e8da3f4f6b5bee444a44459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9e884435f0055b753dfa392a83c6137f

SHA1
3e0d2eec57aa07aee7a21e4fbb07735534116ec7

SHA256
55339319653702b690aad906dc0d61876cf93e142ecf51f125b1559f0ee2fa02

SHA512
ddbc7b536aa5fba9b46214328bf8009c8eac30ab3b9326cda28c33d58312b9c7159e45112cbce82c7a94a2dd383c7f8218b509b779fb38307860b386c59dbcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db26e7a4a9ec8a798ca9099591f09290

SHA1
9dd8ec3caa28e7b9db3002e87f96774ceb4d7838

SHA256
7b036f01f69a43089dd177d858b5be98dc24a6c3a8d14f9cb1f673cc327e89af

SHA512
bd5e955cb818b66cf4b4ffdcf333a71c055d3653a27d5be080a4e5734d1ece85b5d5cb305ad875e014699bb594752a0e64b8158506e1020d26c7b3527ad76837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
410244086cc20339ceb98c4bacc75ad7

SHA1
8128fd6b0e28fc93536c139ee54f9f91fc5288c8

SHA256
76ab6ece71310ed469c14f8592ec223fc3c7b2a67bb1508f2957f64b4fb07c75

SHA512
a8910e413d76aeca3af4c27368b21010a5bbc4e9fc0c236e3e9f0116e8db1359426d0c7e5de90ae4261b0e39b5058209ac68c4b09ab687cc319e4a42a5d2733a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a33634d09e34cf27253f4f7aae0d335f

SHA1
7f34bd4b2023a1fc3cca9d5c174e0d43fc97e40a

SHA256
be38729f89379653bf61df54be22d7e701603995e0b93a05c08004a1cb77eb40

SHA512
85a936bf4a5f3280ede66e6df092cdcdfc085744bdb6c1ed4e48ee18c33ce819652a8ea37b6d32a4f3b61b96ef75afb91a87f982653844114b255cb0fd0dc29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c43ed0239d6c9e2586a0648a84f62eef

SHA1
d599fd4bb0e9ad52075f3e9c903e71b26efc7b2d

SHA256
b9b76991cccf9af92824b37c04c889c26755bfcb647be1d1185f187d4ac9655b

SHA512
9f1931e31bb0559c9a3fc87a1e87fd7bc5d6577a8b7c7b0b35c4d38e8190870220dfa163a6e6d4dd27be4f27848f756467d1e4897b3eaf9b65d0d40bbca54f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81dd698e7e94ff3cd85f34879babc927

SHA1
26024d14d38a279fc95ed5ee7fd68a53d4ff51f7

SHA256
c9baee6c07f95fea8d51892f74aa8c6294005034b585dc878d433ee7407177b5

SHA512
70de362c7086cc08ac98a136d2ea7342dc5fe9af58f51b6559a8491c465372b31554bd84285e4ba16a5a84066c52f03a001816921b734c580026e5a69bbb4693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\14d68951-9868-4672-98a5-57d6b7c16eea\index-dir\the-real-index

Filesize
72B

MD5
340986b3cf8f7ea7df7443891ad7801f

SHA1
8d8f3840f1482896cd6a635487eb77f8376c17e0

SHA256
f92c24afac3060282a54c659da569f1a4c388fe475e796609f8ccdf4e1614e69

SHA512
261770cf400cc1ecbb6124b154d8fcee8e7b36b989141fb9d3d62348b3ae7acbc7e5a90cf106b46a2b8a1a1f7478e50874318674c85f6660cd317480a845e3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\14d68951-9868-4672-98a5-57d6b7c16eea\index-dir\the-real-index~RFe5aade5.TMP

Filesize
48B

MD5
d3c3eea8f09b8fb62d501bdb80310509

SHA1
7437c5b3c37f1f3f6da1b70483f91b086b6e5e2d

SHA256
863b12c5de319acae3fca356c2604abb8cc22a77d3e6d17bd3af9cdb0f13675b

SHA512
06b31c5ef3ecd07cb75d99974f320c1f4efae9e55e3b97eff1c0bab0bf783f872b7dff1e7b072660917c77f831f7957099bb72c5d03cb6819a0be80470762f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\32f7b0cd-a8bc-4b15-b2d4-2e0ce5bcfbad\index-dir\the-real-index

Filesize
1KB

MD5
e4ff237650a6782e6689fdd39857de79

SHA1
2f4ee4781e06cd1ed2f856f8b96613ab8e0d6d0c

SHA256
f265cd4c698170034b72b4b67d48a404481af8855da626c59e20718e1dc381d7

SHA512
0747bc408ccd1fe528ddf6b8bc5144a47a25fc9d91991788ffc6214e8c6360c36d20c8015fbb5d5551e6c01a3a8549b5f5707568d065cddb6a1b6c90f5c20f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\32f7b0cd-a8bc-4b15-b2d4-2e0ce5bcfbad\index-dir\the-real-index~RFe5ab9ac.TMP

Filesize
48B

MD5
2b6503d24e7fd95639b8b2ab67d65c13

SHA1
cb89b96da4f5e52fe32ebeb9fd0ee6920c704455

SHA256
5c34d61046e876c53513632d207ab6f82748cce4f70d8ecaf4d91175882f2702

SHA512
93c0a1efd483c25d078590c8b430715425c00ac808cdfbaeee2800b203e797086ed4c4eb8f19f69a3eb68da6daf168526666782bb4a21b1377a095affe2ed16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
109B

MD5
fb076607e638f53156f7d6a8caf41588

SHA1
2a0b49932bfd0cf632d66849e319e118cbf3c968

SHA256
07ec20fc4aa26b6f324825a0d1ed8de0d1fde942b300a6363ba3b8818393a2c1

SHA512
61cc6e3afd535752b8e6bfa70ed4a33f4e052bcdb2b290ba76dd253675c2d1bfa09a2d1e652689de5542ee5c3b98aecd10a0c275b343d888ca55e793971e5d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
204B

MD5
ccd33a93585d97ea3d2bf31cdab12988

SHA1
827aafe4ebea4f303dcc5b2b130fbfd235871577

SHA256
a60c117118e5cf7cb5184345898c03bac41e128f283a40c0b56a39a82b6fafc5

SHA512
585f864f6f9b8cdc53e167394fd1c9250a1482da7a873fb862044a68d7d4d792e7eeb10bc3c9cd2367f0e153c73a330e635b39b35aa00aceb3c51aa7dda90abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
201B

MD5
3947996e95424f6e1c40bf1006705631

SHA1
d517cfb10a0e739d4f4146ef1df55fd9410d6185

SHA256
74a775c267d8c6278107d7c15f4cda9b995a461b7d019454b1329c2f9f1e4560

SHA512
4fff3ba0efa176734e0d0e28b5199f54beb247e73899592557b989555ec0902d2cdb642cef657e0c0e22466be041248a0dcc46dd1dd19bf12563eb69fbf5e1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2c97cf916739dd3dd2c1819934ad30ab

SHA1
628f48aad8f2acad8f41b69d44c44c1b6f8115e6

SHA256
b08086852ab4e6447f80f7f10a2f92290cf86f66c0b2a97af334c3f7160c2be9

SHA512
512c08f444ac09b1a5c86bb0442cd99fab4a0ea147513538a66b738a4d752b20dc61cc50ec719d5e3fbf5ce593b6c76795aba9e09ee4ffbbfa0d207036d12b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aadc6.TMP

Filesize
48B

MD5
125b16398245158ea75dda64eba64a69

SHA1
fe948865899fa21395932d6089e10b6a8eae2444

SHA256
2b324952351a27e3291a5447da1d2c2a4df967ac0350e617af6241887af4b4f8

SHA512
401a4944b810cc7f14c00a82535d6f62649f1906978229d42b87823b2a2e6d7b5433bf37f9309f4cb66970596b132d82196e5d1b0b1e1eb9e1ff53cf5471b593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9c36b6793b6d31cf2762941934a1b8f5

SHA1
83b382c64c6d9a84df0a4c9d509c69b77c2f86d4

SHA256
cc2a9e11521c250f94c30dcbd09154c7b9e51d5b244946d9a58a573ebecd90d0

SHA512
b765b869940b1fb1ca21a3ad706612d9c6df48325240be9a93d742f0c6c3155785c1449ef49aaa93de0103d6124903d32af0c5f8a732fd6b44a366a1d8a03e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4fc5216b26288e958e3fec09bd7cd59c

SHA1
2515eb43c95a25c5c2b6c38dbb69949a899a020d

SHA256
710a0656ec7b859966aa592a4f29b7a893e63c45cb95fbca75adeed30e54af79

SHA512
3219aeb4e7671bd2d42eb4bac4b622c977738a2c91ea72751b0bf9328d9cde9d69061677db7f95d008352cab14da6c9de8b57bbc829aafdd425ede3e9a9f022e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a7d6b82015fb2c434aec4315cad1fd91

SHA1
42150806eee3b93233d25bdb14d8231933c76a11

SHA256
9dd235b0acddc7cc548299a4b68117caad6997df31f0ccd13a1f341ffefa916d

SHA512
ec84f343fbd4c730291e5852b5e777bfce960bb25c50b02959235c872df2fbd7ce82679c88059ce4bf9471d3895d1348eadbfd777f72edefbee1501aac220b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f80b7320f39c0de2c5b64f0432bc946b

SHA1
713e37bf69088ddc229494148aecb73693d77734

SHA256
ca339dcfc0c14fe7e09d4688607370cdae54da87a2e3fc910b3d29f164a1bf7a

SHA512
7003a5bbbec3816abd95b16256d833a29c3c945639330826b4ef53fc7a86045edde5f3f958cf446c4999a7dc185626e3e12d844f6dbecd63f11070ad1380bfc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
876b476018a984fef9753250361977e2

SHA1
772c90193444ce1861750f372161372058091f48

SHA256
54164fc0c4e255aa2b96bd71f09f9c77fc53187d81fe09b58a8e33741fb3786b

SHA512
23fab1d0521f3f22d35677fd17548cfc36689c53f0c3a9720ebfc1f0c17f73a065d6c0d17df2d0b3c1af3660779397cb46e2d2b4c3c05db2cb07ae30c43be1e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2c9522bebb1ca9bb4bc13bb25374ef01

SHA1
ed4fd7952a0fa6344f5c9bca8ca11fb27489f3f9

SHA256
5dabe359d6a0aab3024c77d47bc612382528a5f9519e0fddaf1185f84ebbcc0c

SHA512
00f86c3eb779fe24540d548bd8976cd53a87fedeb86cfcab0407ef5855697e9cddc0f6eb88ba885731d4d421cdced067cf9d6745b0107d85619ed94a48220d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d378.TMP

Filesize
1KB

MD5
bc38b718061bb13c56d84b165f4c4efd

SHA1
3c095580fba722a4ffce440ae6bf05242fe86adc

SHA256
216171a95a45c3d24f249a74e0fa877bc72591865c6f6e306e667c9aaa906c80

SHA512
cec33675184cdc03b3f1d378d99d7fe0ad15835f0cde259d328dbf4822e23071e6b0ae693d99a7b0d791d562d056f964b3500a862f6932a873fd8bedb1bec43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
92251c767cb8f0368dac46f53b6ece4a

SHA1
9bd584d028c4a6d02cd9efa4c204ece723d2b3be

SHA256
7e574ddc57b402f327e2af13fe8ee9e65a4c2e2d8de39d0607223306dc859859

SHA512
1e646508b4ae001159ff9d227fc98ba1742033dcf329a5a5e7a7de3a33fbafb925d9c62779aec271e3a620e859d89714e2cfbce706e666c430cd3ebcff2e571d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d042daa2ca2d3477da9c1727474ed6d

SHA1
510c616b8e27c7428164382c1dde9d334347bb93

SHA256
9106dba8dde2ab585fd18c2fae94252430dd54c5b94bc28ee659aba5001aa026

SHA512
44a62ab0fe3f188c6f78b87f1bf1a156e538bacb939ab85b7a669aa3129fc6112ac915db5787d4781f4d8900aa468ecb8ebef35b820e7525c7f3e45c1dd04eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86dad8fdae04fecb305013de99e0db38

SHA1
b9601292ba65e85e33502f9f0497cd9dfc4e61b2

SHA256
699ead41f42d97c11c573bad4488667836c6ebc84f3ce02b38a8aaee6a7ec608

SHA512
e1a40c352fde8c8cf975890d6cfb546ede931ee8b0962f98eba722961d867347855460b3004e227cf577d133907116695ea698804a1bbfc4169865063290a253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f678ab3a5b64fdcce5967b099da0795f

SHA1
acf3d5c872875493da50df7ceb77949b465e75cd

SHA256
13c5cf2dee4dba7e9441545794a191cb63c30dec88c6f38427a6d66528ffa51e

SHA512
465dfd0b632faeb82f6df12aa4b1d9aa94f1aadcf39e4b77d3a21eb1282b3e832ce96ec22f665e05bcdeb23411d5c91a09d01ef982f3c88a64e0da4781c35065

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
917B

MD5
d2092ea2cda3cf834ea0f80754b02fc6

SHA1
a4680516e251d7f0d8e5a06a23bb71a46da3ab61

SHA256
0c481098fc635f929858f7b2c1a5b212710b5f1f9b9fabf3837481e268f06869

SHA512
f3dd6775ab7c0bc9114c6ec82b517505f154ef5efd5fd0e1769c3282cd2d33328d1350505676a0ebdf8bb042b552a460aa7a213a0f2c8ed6594fd7c853399ab8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
917B

MD5
1bd9d031da8d540a8fb6a2a7771647e9

SHA1
77e3e17564ea4ec4a8869d5b80bfd3b1d77b2fa9

SHA256
99296e26e942a7e3b7a9a93338f0dde1eb93d70b0b71fc446bd5cffdec6b9316

SHA512
8381c45e9e6fce2ccb3565990aeaa0c5e0b327041a0adf778b9839150a9919eb8ff44fe412d8273ee5a0e35db976c3ffe99916ffc53a2a7a14cefa660391e57d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
909B

MD5
16c46bdd12425085beebd97775f4f6e0

SHA1
a20f3d8cd3cb2e093cb0c8767eb2127b43b93255

SHA256
46bf6c28ecd45f511feeef84c64cdb4838fae5361bda9a817b810daecf7258de

SHA512
830c80d996c7d73c12e6045ef937abf7a357df576bd60ed122dbfb4a0acd759e94713ba8b474b11c8177557cb03cecd1fea4e0b0e71e525eec92cd71e04f30c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt

Filesize
917B

MD5
fe58e228d16934e9368a56919dba4ef6

SHA1
71ac628208c6d7b8651a951a9c0c58400ac9eb40

SHA256
40561c44f8d6042cc9277caaf164a435a32d2377a65cfd213d741629dd3ac1f3

SHA512
fbc056cf8c8f1b4720a4dfe65fccdda5322fdbf527ca3fc6d13d411d7b0dac44ec330b1550cd0a0c998220a14ac4d2837bd5043688988e22ed388ba5bd490d34

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\b61c8834-8707-4b32-8752-f880bff8fb45.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\Microsoft.MSPaint_2024.2405.19017.0_neutral___8wekyb3d8bbwe.AppxBundle:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit