hxxps://drive[.]google[.]com/file/d/1dx1VXF10k2UUS64FKJ7Rt6ToJKEk0Sw/view

Analysis

max time kernel
1049s
max time network
1049s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2025 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1dx1VXF10k2UUS64FKJ7Rt6ToJKEk0Sw/view

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
168	3068	Process not Found
210	4168	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
249	raw.githubusercontent.com
3	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4692	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
3236	msedge.exe
3236	msedge.exe
2032	identity_helper.exe
2032	identity_helper.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
968	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	1936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1936	AUDIODG.EXE
Token: SeDebugPrivilege	968	taskmgr.exe
Token: SeSystemProfilePrivilege	968	taskmgr.exe
Token: SeCreateGlobalPrivilege	968	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe
968	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2204	3236	msedge.exe	87
PID 3236 wrote to memory of 2204	3236	msedge.exe	87
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 1524	3236	msedge.exe	88
PID 3236 wrote to memory of 4168	3236	msedge.exe	89
PID 3236 wrote to memory of 4168	3236	msedge.exe	89
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90
PID 3236 wrote to memory of 3924	3236	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1dx1VXF10k2UUS64FKJ7Rt6ToJKEk0Sw/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff885c246f8,0x7ff885c24708,0x7ff885c24718
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16944984177694150731,11626418318466218646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDBGMjYyRjEtMkNBRC00MzIzLUE3QzAtNkY0MzMyRkFGQzY2fSIgdXNlcmlkPSJ7Q0U5NDIwNUUtNzc0NS00Qjk5LUEyQzgtMUY4MjkxRjM5NjIyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEE2QTczNTgtRjI4NC00NzBELThBREYtQzZERjlDM0M4N0FCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDk4MDE1MjkyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4692

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x3d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:180

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a230789a90c3150dde7ed452a9b35a08

SHA1
e934d8dce045c99a5d4ce22d6e470f787ca2e027

SHA256
b754b918a9236857008c518409ee816120e5f55430218c03a7c9b2af56cdece3

SHA512
f258391b4cfa5f4b7537d15af1af661dc58926a63fbf8238fe564e9e80525fc3b4b04719611d1619e036f56808c460363205ae06c835570b77f97b31009371a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91aff9098a47bb8e012e47e54f6bceaa

SHA1
7993f5174f54489cac8b04c1356b7b47da944202

SHA256
cc46d5631b8526010ae5e52980fe9fd9b38c4cb27f56cd524b321ab091685cbb

SHA512
184defaee159dc93c128c5a7a2ce15e9cbf99bac58ea2372642c30bf6f1f52e178a110e0e86204ba65d82b7a7fd5514cbe7092daacceecb1aab6cc6a208e850b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d1a657b-3769-4060-a54a-defad82040d0.tmp

Filesize
5KB

MD5
9c1bf29a27849886376d864ba179d248

SHA1
23a6135c89b49589a751454393b1d06c2534292c

SHA256
d05d47c131c828e2e4becc69324aa2115f2d4cc4b590211225a4cbec664702ca

SHA512
192fe56d1afb9718eb81a5411e697d546e42d71d17ade2159c80f1a22d30b8bd50d4df1a4584e1652a9cfced16313ddc30f595d9a3d6d84e8d277732beaca715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
128KB

MD5
e01655fda6e0d43026d4a2ef3a498bd0

SHA1
c56f14cca3b7bf97230a6ca3f3863aba63835566

SHA256
71a24229475cc72e0ff8e06c904f11bb496f850e30fa0d337fdfa42c2e480c6b

SHA512
678d519723a0e0700f64a471b35c70c667a32ce935d4f084cbee099eee3498a1a974015cfb4752fff5ff9809f76bda93b767118098400b029d5f6173b0d667c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
1.8MB

MD5
7cac0b73f69a9338e71e25e3872ca537

SHA1
29dfcb4360fa717e5244801361b7c22aeca6fd00

SHA256
a8427399415f72b6032d90c3a8d5b8f6cb21d72337f3d59c9f53ed2caf35ff56

SHA512
5cd099faa9b1d473aa36777cc252a7a34e1ec23b7c7da135c713e72930ae486745dafa0b8d185394bf23370e9640799bc92d359b6f3da6822adeed4b29820603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
623ab5531ba64246e973acfa31670ed3

SHA1
b06ea063a7e653dcb5f7625ca4843ea581498fcf

SHA256
02541e8fd0a0c2ac5d6971b5639a5e065428ec045ffbb1a2c083a00c532ee6b5

SHA512
ae2a44e9f9f74ce3421ce6462e6b46661bb4af14994d3f3946d61b2994253b2b6528517c93b4ca668369d71a96752e6d85ae965d29d65edd9746288b6ce513c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
291533c771cf80096a5166483a631692

SHA1
61a4292ab86f30f229a9c658c70804fb61ded376

SHA256
98304aeaa6e6bdda45ad11f2070bae2a0480fefcb33c9f0716ece5a34998c4d1

SHA512
76cdf88fd9253b30d08af9de24b4c1d2b04b3c360a73dd7674898bc86cd725a68315cf4a7c54818f736f6896f76f578a9c19d79f028e353b480ad92ba065f928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
96824c0292993e6bcad28de2ed479344

SHA1
dfafad5640c8f5512132bd77f55ebcb20cc64989

SHA256
79ddf6eb871dc44fa41ee23424e98eb0b8236f55a9b75ca15a282e90277ddacb

SHA512
e5d87bf15808e72eaf501ed0e05bf2d7da3a0378d54cc41a07ce613d80bce25cd20d32d2682d7b38a136e7e0e10fce604fa5c638b3808e6ba241b42a0426ee92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
17c81739182197d197908a754e3f52bb

SHA1
91b5c4b17bfabfdeda703c3e9777b67a8d4ec37e

SHA256
cb4eade1e686c653faec09c3d9ac1488230172a83d4ea1e06d0c741ca0188a34

SHA512
0d34db6e29217901bed376774d76a3530d762544247872e2b931779ceb1f52f218e6cd76fbf03666f1eb5b90b4add751b1df80e30888ac72bf47cfa14eec16ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_app.apponfly.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
06544fd662f6c2de317dc539f2d679df

SHA1
ec6c664fc573090dde1f1e05ca30b7c476ca3294

SHA256
050c3e3ff51f8ea2f4ad3bb65a9986c9c08578d2b2e5ebda511b1fef883379be

SHA512
df1ad6bb83cc03b3f0c0f7e809e8659d4088dd62b82aa4f5301aec51ef0066a3769a78130471ecf5df9339a8cdd6a31e59294b4a3c24a72361fd590f960f011b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa227f39d18bc64773d0e3aaa6ab759c

SHA1
ae0eb3f1f20f4185e3f17ee1b78b5f5c270399d6

SHA256
92368464f5cab06e018da290afd0efa85e310d1505715e7da56d3d032845f7dd

SHA512
048bd0a61428230d732dee2bcc1838442f30e730ebafed5630ad3611280be1a2488fc2e5213b73be26ffa781c74109f06dcc09f482204313951533c22b150372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e24e938c1bf3d3d88737de07ec007bbc

SHA1
cd2c63f14cddf18f425ea15a6d4fb70741699171

SHA256
7dbcbcbc449edc97cfb28a92256a0afdd84c95adb4ffd9d4d6c78ef1c3333bd4

SHA512
b28b498caec3bbddd56ab796290ad04f56f2b92b48c35cb19ca6af350715eb906331f9dafce2891473716bb9ce505270c491c06cc02efd9812dce4ef32cabb19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e5d6c3dc98ec80a57a86b31b1856d9e2

SHA1
992358c5e6c70aafa334b88b7743f3121c03f170

SHA256
ac1a224e889b0cdbb5055257699ae9fb0a15eb7772da2f2293b4072eb3b27888

SHA512
d18adc3804eb22883f9f77339f1e26324ca9edb9a06ed3f6d0e76eb35053a63ffa315a9c8929c90c77b0938109d263db98a044d5eaee716c50b2ee560796acb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fe622d4ed054df7edfc27802e608a53d

SHA1
2259293ede4381ddca32af8f7e3fa9704fc250ce

SHA256
321a2b108c129912d49f87ead99b3b3695206fd1e55e5823742be08d05c10999

SHA512
0ab77e392fb11cb13888c78fd998d67fcd50f9951ec28bf965fa80daced2c811d002eac570b07dfc60cdfcf8286d48ea6d21ab6be9f5c24e77a10aac5003a2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1d0410deefe38a279021df2af05884cb

SHA1
853a4919af1fa217e66c7c82df28bfbd6c8d5017

SHA256
0e1b967bd7a688e34d6ff5cc4614b8ba0f619c7c2a48a28c79212b9085a72aa4

SHA512
54870963572aa5aead507857f094c9154afa1065fcbe58b7cbacf08bcb3d933c83d0926387fd08d1c4c0108c713679eb94fd9abe7c76d43747d45a60d1f8e495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
681d53a380bf64af124fb2b7baf433b1

SHA1
544c448d687fb78e74ff2b7f4c2961526484d836

SHA256
a07f5c72c1790173ad0c07a1a1ecb290ee42b5eb7066ccc7298c5fc854491da3

SHA512
468261c2bd84fe8f139f4171d7b099cb1a9f94c25935b7a1e800027cc223eb4bf613e516ec8574bce36c49567ecfca5d0f6bfa2ee0c0f755394833740dc01835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e705ee89feca47a67d118b2064901d01

SHA1
0c3cd8992832405f0901bed2f7a6493395c3e4d5

SHA256
1d87001c6ef287587782cc4598daba14892280b17faf1b9d26e0d0e61622f2c0

SHA512
2f9006aa7a4a1eb3475c5754c91d714e37610deebe34a7eec9a4ba42f5ec800c6a19870c1ae222b4b5e6de2ddde12fb0e9a6e11e112bf39b203f3c88556f6bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb33cff3e4eba679d9470bc768760cd3

SHA1
dc663558f60b0b91fd6df4b1309a91f808b03fdc

SHA256
b78c60925dfb220e4d00681e3437a0b8e32986a4e88979fae9960e04137b7462

SHA512
cedf2b98317c38af65c4d0776d4e1b64dd053310cbfef3694ad088ecdf13133e3a754d971085cc388410283d58e54859296e6b7c49933bcf8cd35a8f9dcfa2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9e8d0562e1f25b246ab040cc7e91c52

SHA1
74d5850ec9be17aab74daa4729e469a5a94fdaaf

SHA256
80b8c8235ceb63efaff66e0e3a1f9e45fa438078122cdc554b885cf3b1530230

SHA512
711467d0013e60f9de05cbfbe2371f0dde9b7d34f7484c5fdd85dbb4ab27b3c8b4b918f956319318779ffaa666d5e7caba6321cc81fa361eb6861c101eaf6591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
73ee0dd6c0a71022546de696e1dc98bb

SHA1
4f43b3928beb7e217a6021b1c3a2e43d44ac0a10

SHA256
c65ffca3de650fb4656eb325479891895b2e96c44b48645347bf570e4db6a56d

SHA512
e96b4af2c26900a6d1ba209cc5c983e3791ccb480fc0d5c564c295550be68b27683628569eacd0fc11e1f9bcc0d48328ed5f2233b133c145b615ba9d61f1df2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582a38.TMP

Filesize
48B

MD5
c834e383ea43976c6e79cde7440828ee

SHA1
d633b1de15d269159f1eb44862b13b9eb83f92c4

SHA256
103347ad5c13ea649b33df8040ea5307fe17b256f00ed115f3ff76fac78dcd41

SHA512
e5fd29a1eb4713714b3e8da1bb33592a4b7d81703b99f488af1f6a1ad9b33ea5ab493255e5614467f6bf815e69b24ed630cdfff1b5488e51255c262388347278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
07e276b8310c8e51424ce71d3343b35b

SHA1
f9e0dbbb4f0286621d6ce6d2dca62ec901b33723

SHA256
dbabdc8e9ef13c8775609038c7743d353f3cb96f93ce8115e7d640bcf0451900

SHA512
e6599ac2ba29e1aa4d844b25cc549cf278e34648af78cb2eb584cabd176fa0f74a87351786a4ef06bcf663328f1db61b0d215ebabb5bb9e1a57a07a40698256b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1adc25a37f9928222679d06c0db9b8b0

SHA1
83de92e0712d11b7624260603617d3c1ceaa298d

SHA256
6ac135ba6dfdb6718ecbcf0968953e91584a9877a43b574c0188d11114211721

SHA512
84be26f4bc83342828a077d16dcd98e42877875ea400b200be9f690a31c64f991e35634b610783ee880500135e2b35e80c14171957dd63520d31346e0b9d6794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a7e858dcddb2f0c5057466ae53b6d30

SHA1
246ba2809dcfd412e13751548bc6f5dfa4e6f7d3

SHA256
d401f0e9a60b1a599257aaf51943c1bf5d3d29b4194ed08a5fdbd53e5c17f2ea

SHA512
3efdf687f2906fc3e463c04159644b8932820f6737cfbe43232629924f973214e605487fad25635544df97f8800cfc1258588a229d587be398e18203be08f4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5a0b1a5e0a24274e717624d327839c1d

SHA1
f530925bc6edd9af6411c02c602b91356de8e1fd

SHA256
3c4e4e79a31ad0d9de7418171ae31b6f9db7f0ef97842c6bd34180b7d1e17a88

SHA512
15eb8b514f43e1e9ec2569588dc79ccc16d696f4372bbae8b8d672b402ed1f5d25e3c50edd40a775bffb50910945fd343bb8d3128f7a13b466c0dc59b0cfb044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b390406748ec7b5a68bd5bca3b3e10fa

SHA1
a1c7a5cb9c84581abee83ed95be67ff74ba3a6d2

SHA256
0bf110d7fafa4cf20d6689725dfc008a04b14b47979f8cf74ddbdfa11cc6f27d

SHA512
ad87ba3901e21c69fd3c3463b92499c52689ee82fe9a319ee7f33e7880e39a479ed3a4873e4ad4521862c44e7fb69f09e5ed357d47acd2da5579147a91c0ce53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b77bd96b4842cdcf5473e02649e534e7

SHA1
ac0de8613420b368b869416eed0ca7c9aa68ff4d

SHA256
adea9f9f2ff1c903f1ed0b26b3a126c31a8e4f2522071b2a44c449426cc028ee

SHA512
d7e7112cec0a11541ec632b8161d5914714c4458fadc0b26d563f57cee5502d62357a83e0aadf77e773a046b7e9f0222097c98725dbe1510e4732609f4ae37ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8baa8093d09a50f1a7be4b76d2de24a5

SHA1
4e224043e964d514c6d55e1c9f9d450e181458a2

SHA256
d61b4547c6f1450b247d3ba6f61f456b9e1ffebd9b33fb88dfc3f4815d4e92cc

SHA512
5372f84dac661df8f1096c2240a0e77ca580b0b212a241f4f6285bc54bc93e4742be4ce460d609ecd90ba04dab3309cf190c87ff6c94340cf66ddf82e2281a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e16e35af627ec0c42be77dd0e506b532

SHA1
54d03f801de62a2b55eff62baf120f26b0c37690

SHA256
49067aebf08c18d8030d8b20c09f87c859a4d4191de299304f8c97e15c68aaa0

SHA512
7b0459db7c3aa97410b3949bf1f27dc4d7e5d633e8830694fd77d31bc1bea881b0646f2b84d90098839a6970b7cef5b9f3be268bbced6538b018d59c80cd45d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f3fc7a32394b8403f4da4590e2298960

SHA1
c4330f969d22b0c08d37562dca9ae96e073685e7

SHA256
073011d70a350dad866e616b10cbc124ea5d07ceb1de383bef0c998b53250956

SHA512
91fb25b431e524491979c09d0db498eafd2da6e88e25ced49fc7e956f5e259d23c5cf2dc4c9299013ba309749e2d954f4c183d924c2b0f1e7b891214a94aa578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e7a1.TMP

Filesize
204B

MD5
c8470a635cbe58e876a959da8d43ce4c

SHA1
d6b148298434577726c0d44b7cb684c2537f4ef6

SHA256
40dd8918d85ffacdd03067f44d06720f729ef7f0f6395d34a616dcf5a6f2b4e1

SHA512
e4fad2134c5d959329e370d10a5421e0a4047f388d3547dd405917d8d33d824dd279c32204fbada0a14f3dbaf936a134d7c5b9ac2a82f2eb7940ef8d27995d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbd9fa8c-9a6e-47c0-b9e8-a00d16081195.tmp

Filesize
5KB

MD5
d8a2d4c8449f7acc89f114ee693efff7

SHA1
44e0fb7b87cf9260ba15a8b61d070cdd00b92446

SHA256
027b338ea8c817d908d767dede15289383d916551c752d83f70bdb38fa84bff6

SHA512
b13f5229f49efa3a9f0fe7816a8321efcec077cba91136f4e68a45153981a929a181254b3571188242e5931ff4550cac460d45dcbed3243bd124a63e228e1576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
510f9597ae462bf5267065d91cad1c28

SHA1
b9cc6efdb20bd00fb3418a70288494288be1266a

SHA256
3eabe3f5585fb47700c01751c97d8db13a1477299deacfafc924d7e2f3b2519e

SHA512
676974236f3ebf3a751b66df893d28ff9a5fc54f80cf9fd8bb5a6cb364a202685a7f68fdae0302d07981a30b4baa002d05150c299a1ed7fa636393f7c91d240d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73c18dfecf787ff2708e0975e3115965

SHA1
f1592e2d976376c807a368337efb812596ffa43f

SHA256
777c6eef1f4e790c57d4348c0c6173e8671d7a9cb895fd0611897bf00656ebc3

SHA512
5e4c56d39b57f039b615e7b0fc30040e7197b56327f9d1bdaf73d610820c669a722a3cc56857b401e4a2f1b3b4be7bb362f04ea28640b8e05db5d2136a58df37

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
3f6e1ae7481f367c68f223217ecf5627

SHA1
b1f99c012fb9b953accd26cd194023b05e3d29d7

SHA256
162d6ffb1754641492e9998055a69fdcad6c4631a4b5bfb220cdbb168967af45

SHA512
76c2ad6538ed9a4345054654419d963a16c206dbb173c73922352d0c1fc8042f9779a8ac4c10e0e7c05e232e6a373fb189865c44214f847be02e5c34bd72a3a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
afa029f858bd0b932934892509705148

SHA1
44eab7f84102e2c38e796f9c2a639f5d4609cf95

SHA256
43beb260e5fcab16762eb9a601ee2858ee87e6c24aa0ed76e2a1a05d6bdf13a9

SHA512
68692c644ce552e90bafd17412c0a4e34c127ccecdcfa658bcc52e1a4a625a7c6b25da9297ff024cb82c1be0a7ea2ab94d28e6ddde6a2d786c53171651403502

Download Submit
memory/968-1211-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1218-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1215-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1217-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1219-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1220-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1221-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1216-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1210-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download
memory/968-1209-0x0000020004730000-0x0000020004731000-memory.dmp

Filesize
4KB

Download