Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://drive.google...

windows11-21h2-x64

8

Analysis

  • max time kernel
    789s
  • max time network
    809s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/04/2025, 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://drive.google.com/file/d/16jNm2I6YcMOBbvs_FiqxukRQKbCZ4Inp/view?usp=sharing

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Windows directory 30 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/16jNm2I6YcMOBbvs_FiqxukRQKbCZ4Inp/view?usp=sharing
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ff9094ff208,0x7ff9094ff214,0x7ff9094ff220
      2⤵
        PID:4628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:128
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1844,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
          2⤵
            PID:4464
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2404,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
            2⤵
              PID:1324
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
              2⤵
                PID:3336
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
                2⤵
                  PID:2340
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4076,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
                  2⤵
                    PID:5080
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4116,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
                    2⤵
                      PID:3696
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4208,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
                      2⤵
                        PID:3188
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4260,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
                        2⤵
                          PID:3052
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1848,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                          2⤵
                            PID:3316
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3844,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
                            2⤵
                              PID:3800
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4488,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
                              2⤵
                                PID:3492
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4400,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                                2⤵
                                  PID:3508
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
                                  2⤵
                                    PID:4680
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1108
                                      3⤵
                                        PID:3432
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
                                      2⤵
                                        PID:3724
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
                                        2⤵
                                          PID:1876
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                          2⤵
                                            PID:4684
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
                                            2⤵
                                              PID:236
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6328,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                              2⤵
                                                PID:5044
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6424,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
                                                2⤵
                                                  PID:4128
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6752,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
                                                  2⤵
                                                    PID:3860
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
                                                    2⤵
                                                      PID:800
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7080,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
                                                      2⤵
                                                        PID:4480
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6912,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
                                                        2⤵
                                                          PID:5020
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4664,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
                                                          2⤵
                                                            PID:4700
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4652,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                                            2⤵
                                                              PID:3636
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
                                                              2⤵
                                                                PID:3884
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5072,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
                                                                2⤵
                                                                  PID:1504
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
                                                                  2⤵
                                                                    PID:3556
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
                                                                    2⤵
                                                                      PID:4620
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4472,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
                                                                      2⤵
                                                                        PID:3508
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
                                                                        2⤵
                                                                          PID:1400
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5220,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:10
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:2596
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                                                                          2⤵
                                                                            PID:2324
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
                                                                            2⤵
                                                                              PID:1200
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6056,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
                                                                              2⤵
                                                                                PID:4988
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3972,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:14
                                                                                2⤵
                                                                                  PID:2532
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
                                                                                  2⤵
                                                                                    PID:1036
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=748,i,15000428215529587493,10551243047117579326,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
                                                                                    2⤵
                                                                                      PID:404
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:3512
                                                                                    • C:\Windows\system32\sihost.exe
                                                                                      sihost.exe
                                                                                      1⤵
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:1196
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe /LOADSAVEDWINDOWS
                                                                                        2⤵
                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                        • Enumerates connected drives
                                                                                        • Checks SCSI registry key(s)
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:3676
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:860
                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                      1⤵
                                                                                      • Enumerates system info in registry
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5052

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                      Filesize

                                                                                      105KB

                                                                                      MD5

                                                                                      d3c7a91ce6bb120bc472d385e1c3b9a2

                                                                                      SHA1

                                                                                      f5fcb8211302e2506cf2c238b1e8e2d8b29bdccd

                                                                                      SHA256

                                                                                      bdd406bfbc081a963756e854eb7a9ee4b487b0e2bf8c11344a2a35bc135b9d2c

                                                                                      SHA512

                                                                                      ec12df5e66bdd436d4c71b94d3df73d64ca756c05f979c1ef3ab49cca0f351781c1bd8cb01d3924fc2ea099bb2da812e5d30d0084e567f9dd13dffb913c6b207

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      f9fd82b572ef4ce41a3d1075acc52d22

                                                                                      SHA1

                                                                                      fdded5eef95391be440cc15f84ded0480c0141e3

                                                                                      SHA256

                                                                                      5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

                                                                                      SHA512

                                                                                      17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      Filesize

                                                                                      280B

                                                                                      MD5

                                                                                      9bd0ac5b007ad73dc64fc096c2ad7c12

                                                                                      SHA1

                                                                                      2e81931337b2e69341a3f31946cb8b463d60d5c8

                                                                                      SHA256

                                                                                      57275605c03afcbaa07c202b492035c33d8d464990545e3f145ca58d73d9ba01

                                                                                      SHA512

                                                                                      6eb273c5d4e831b16dd00979151e4fafa17f896668ab6dbdd54aa5930ab9ef92f57fc7cb0b4bda34f40969bd8e7e1816fe511c429d281e54e3c17b43b7e4af1b

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      Filesize

                                                                                      280B

                                                                                      MD5

                                                                                      d3339f3c7c06719b57f1fb5cd95ef414

                                                                                      SHA1

                                                                                      ec9d4328ef42a3ff1e667a021640f4d8cc7b36e3

                                                                                      SHA256

                                                                                      f1bc9ab87cbb0c609e6d15aff5267bd69c17065060230a7696832c461dafecea

                                                                                      SHA512

                                                                                      79c4b4f6256e588b3af9fa4808f9a298ccb78432debc24b8ecbbd43176aba93b71454ec8c57cca32c34e907ff399dce667240588c1ddbd2a6c319f4c7b1a68f1

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      fffdfa5697857546b3ce35b6992418fe

                                                                                      SHA1

                                                                                      c6be2a2b37f249216ca15779f5c80066518e116d

                                                                                      SHA256

                                                                                      cbfeca8891ad777f93a67308ad4a2edf15168d917cdd11c4fbb70ae898b9cbd3

                                                                                      SHA512

                                                                                      601b769ccc2ad69a24e8c756db178c3f5464ad3268675707e3ff18e4e8a32631a662f417417b569ad903a20a14db62d16aa954767018794006612cee9d8072e3

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      ffd646f490117f16d7e6e316ce2bf0db

                                                                                      SHA1

                                                                                      e7d66cff34ce47e3ee56d2973f4c3b00c6d9065d

                                                                                      SHA256

                                                                                      84ed4a401aaf9c2107cb69ba50a3b30a256cd64b6fd7938eb90eb24da4e69b21

                                                                                      SHA512

                                                                                      2e9801436a38c5adb1ab9965df23e2dda07d7d5367f5f8d61780586172f4bca874c8aa0a4fa9e729b423d8a3218b6407db7a9f35a926a11f323e0f41ed8be33f

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579d0b.TMP
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      202ee8a7f3704b6c4fa4c3f16ccaaf00

                                                                                      SHA1

                                                                                      2bcfdd418cfb3b6d1ca1de3999eb3049ca08cfc2

                                                                                      SHA256

                                                                                      3854e3e351559c0db6df13ee6752bce13392ff94fe573eb7813dd8b665d91d3d

                                                                                      SHA512

                                                                                      d68c474ab6f019f25fb6066d10117024a99866ca987f0b3a2a402f63f77338a93e3720380bf6b5fac9506227e91817bdc214823731b6d52502d6139cf9874a5f

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                      SHA1

                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                      SHA256

                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                      SHA512

                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                      Filesize

                                                                                      69KB

                                                                                      MD5

                                                                                      164a788f50529fc93a6077e50675c617

                                                                                      SHA1

                                                                                      c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                      SHA256

                                                                                      b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                      SHA512

                                                                                      ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      3d20584f7f6c8eac79e17cca4207fb79

                                                                                      SHA1

                                                                                      3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                                      SHA256

                                                                                      0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                                      SHA512

                                                                                      315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                      Filesize

                                                                                      107KB

                                                                                      MD5

                                                                                      2b66d93c82a06797cdfd9df96a09e74a

                                                                                      SHA1

                                                                                      5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

                                                                                      SHA256

                                                                                      d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

                                                                                      SHA512

                                                                                      95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      006d56a45de985dc2a20307f23501fd3

                                                                                      SHA1

                                                                                      bf73b84b4efbc45e63c98f47935b40a0d5a3b694

                                                                                      SHA256

                                                                                      c139c057844199c92c372efcedf6e2e18927526078782491c84f30133cd36409

                                                                                      SHA512

                                                                                      cbd003e88dd230c9fde2bc2d189b0181661610c2aa647f5296e659458b96f3da5be40306d8aa24dee6c42f566085e30bd00d745eb48452a7b70caaebd22818be

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      727212c9bb890cbda7060151818c7947

                                                                                      SHA1

                                                                                      866f443f607810298d8f65e2b189819e5098a1d2

                                                                                      SHA256

                                                                                      408ba1fd89e1084ccefffad335c8ca98f19cf88c6ee88a2ce3ce02d7d1c2da6f

                                                                                      SHA512

                                                                                      18ee4f5183fe53f270116be5783d9b7e6762c5bdb8fc6251efbf19ab231789b71a85e74d0b87d96d85c217a45a27eba1dd5efe991f800cf093bbe383663bb7d4

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      bce68624b6425a0a3791f00e4bd2499d

                                                                                      SHA1

                                                                                      cc516d147f93c7ef73e6f00b42b01238c52f4aaf

                                                                                      SHA256

                                                                                      db7e6f7827b2297d3dea5955e5c3897709f837f430a8e67b88015c68e6a3700a

                                                                                      SHA512

                                                                                      d72920a52f0a4f4b91531b2280397d1eec0c0523b148d730818d9d6e8ddf2ce5ce4027e9a75087ecd18aa897ceaa72f5f4c84447b5d3e18784498c9b1be3413d

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      111B

                                                                                      MD5

                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                      SHA1

                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                      SHA256

                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                      SHA512

                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      d751713988987e9331980363e24189ce

                                                                                      SHA1

                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                      SHA256

                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                      SHA512

                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      13KB

                                                                                      MD5

                                                                                      4cba4ac4eb6db62673aa1a522b11b939

                                                                                      SHA1

                                                                                      0f43146c6604e5536867090130ea2beb348ac01f

                                                                                      SHA256

                                                                                      f61ca9a51b5a7f167d5822b53508bedcecfa35d780cd26ac40584362e0ec19f5

                                                                                      SHA512

                                                                                      50cec123c70611235e9c3e3cb52def9f7d0685bd458846dcda30e37128c30105a93fe340c000e530f68c22064710246fc6e8a251a3c37ac244b38d79b51590a4

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      14KB

                                                                                      MD5

                                                                                      bf1bc532e43232daa89b665301b2cc42

                                                                                      SHA1

                                                                                      4e861093959ef19114522629c179a22efcdf3afb

                                                                                      SHA256

                                                                                      48ad532814f4c458c4fd1b693b70f89d7795e034de63fe6e944c8c5c4d441ff4

                                                                                      SHA512

                                                                                      56f495f5bdd91433ca320aefe986ea4ed2431bf709df72bb9037d955655548b6d6c7db5d51f26249e43bd7199c39a00f9f3e956567157782a37c5f9f82c027ca

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                      Filesize

                                                                                      37KB

                                                                                      MD5

                                                                                      f1b552f3d8e79e3026b4605236288fce

                                                                                      SHA1

                                                                                      3a32b378c3448643a07d56381b024b887e9e9c55

                                                                                      SHA256

                                                                                      e748e8b26f2cdb8ecaea6e2a8cd39638f88416397884f8b395c3f20c0b0eb310

                                                                                      SHA512

                                                                                      b8d47c73a63904b055c10e5384aea166819a2d896c1193b92ec54219f509423740e4971e818d6566e45f733de09d4b4c0624c248712a2f4426057b307b4d2f1f

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index
                                                                                      Filesize

                                                                                      840B

                                                                                      MD5

                                                                                      2b2beae9d1e6948f1131228cedfbb67d

                                                                                      SHA1

                                                                                      978d4f6044b3296c3ca89435d9eb09432584e435

                                                                                      SHA256

                                                                                      55a9d8f16bf7563a1f44bb1b2bff44847052568a3a89b790615c72e8cad67b2d

                                                                                      SHA512

                                                                                      97f39beb961c76984c96bf0d9efe97e23ecf437ba5902f17e42f7854feed533b7c469c6a9b00b94d0043ec14ccea33682002a4d9f15f898385d2d27916d48bd7

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index~RFe5be51d.TMP
                                                                                      Filesize

                                                                                      864B

                                                                                      MD5

                                                                                      eeeaa47de54de94b0e99930dfe57290e

                                                                                      SHA1

                                                                                      45b35ffab0fd28653d7d6662cfe934a8a6da6e97

                                                                                      SHA256

                                                                                      595a38de18a9489b2597b3145e87cb3dc63e2ca3ace5b71525fc235a3bd1d3b1

                                                                                      SHA512

                                                                                      d11cd8d91fe45084795568d815c68f4b68110a158b1d8daa4c4f5847550f2ee2b0dd0d63d2d1435ed4930ad37ccba48fa46ef1b68ce572195c4a9ce16e265453

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                      Filesize

                                                                                      253B

                                                                                      MD5

                                                                                      fa0c1b517a0db858f7dff3cbb72f20af

                                                                                      SHA1

                                                                                      b584a6f17a563962f760287f87ec417d5750a1e7

                                                                                      SHA256

                                                                                      5c477146ecda8ad8c4bd8ca8fc8b43b6fa55e716e630ee9a9f34b300827a6b57

                                                                                      SHA512

                                                                                      5aefc055d1c3af875d8e17594c9aaae3cbb6cefe5ee8a0be11f0e48282825f589885fc0f56050e48ee2f830bcc82eb0809fc643307adb3bf32e2fc12aa17b612

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      e10233accbb72737f92d331da8c52af3

                                                                                      SHA1

                                                                                      5c29db14521da1e317f6ea91755405ca46a9d770

                                                                                      SHA256

                                                                                      b24b0fbc6cf20b5d6b93fabe98f87983b4b98d3f21008a063b15bd57a5225989

                                                                                      SHA512

                                                                                      835d4f799f79d1b376b067a2bc9e4371dc188346d06f28173d8a2af65f1d7e41e29397538fafde90d3393f0282308ffae8290da822c4a1949f9d94a737af77d0

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                      Filesize

                                                                                      876B

                                                                                      MD5

                                                                                      0729153dad06270824329c594498088b

                                                                                      SHA1

                                                                                      524adee0d831bcce57af1fe624eb2a77cbea8b47

                                                                                      SHA256

                                                                                      a878c3be92ef3e1c8b48692350a32642f006df13da3083d53e078c813bb17352

                                                                                      SHA512

                                                                                      13d67fe953c8f655aca6abf40e69555f0a01c3da813a404842c705fb866bc2e8096130ebb53808ffc0b6839d43ccf3f3856f927f12666d892b1233c391fe29e3

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                      Filesize

                                                                                      23KB

                                                                                      MD5

                                                                                      3c925f23a20f99805b7aa5e69f231e02

                                                                                      SHA1

                                                                                      6b71757fb689a82fffcee56f2d008f2a9b6e2ae8

                                                                                      SHA256

                                                                                      eea46caa400c6f5aadc21d8f265f3af335029a9aed04086443c8279256f07e69

                                                                                      SHA512

                                                                                      abdab39e044dd803d254cfa0fd95d9f1df350d3ad72dddac72d4a9706294a8dea70e5debea14cbefe2a50d582032146b41af9397b1f7a3b490a07a82169d8c57

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe583803.TMP
                                                                                      Filesize

                                                                                      467B

                                                                                      MD5

                                                                                      d2145e62fa840afabe759d1f53acd7d8

                                                                                      SHA1

                                                                                      84ace10b95683e8086e843580fa615dcb60a496c

                                                                                      SHA256

                                                                                      41d9c8e3043b953c3e7628c9e734a8c838aef1e05a0e0f06694f14e293d596bd

                                                                                      SHA512

                                                                                      83e0189b9315edd1082aed715eeb6b1cb5a73273b73513f629ae00caff0480b5700b0bcb4bed305de55f5d7afd7fc6498142e480fcb40eae40f249714ad74263

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                      Filesize

                                                                                      22KB

                                                                                      MD5

                                                                                      3f8927c365639daa9b2c270898e3cf9d

                                                                                      SHA1

                                                                                      c8da31c97c56671c910d28010f754319f1d90fa6

                                                                                      SHA256

                                                                                      fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

                                                                                      SHA512

                                                                                      d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe583a16.TMP
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      47430e0e9ad4838b6b88191b7966810f

                                                                                      SHA1

                                                                                      8933b4ce19e396751f93687305d3d378c48e2e0f

                                                                                      SHA256

                                                                                      98c1f419b9efe0d2a9f4350442d90916bd07593d9ecde4706030d1502cfb90d2

                                                                                      SHA512

                                                                                      e3a4e44240a11ce2173acfe66f6b52bdae8fc9c97dfdca441700ab47b5c73a46b71405da95a2cc08c34507fddf4349923c33da57da244e45b5019b9898e6b65c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      94406cdd51b55c0f006cfea05745effb

                                                                                      SHA1

                                                                                      a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

                                                                                      SHA256

                                                                                      8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

                                                                                      SHA512

                                                                                      d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      30KB

                                                                                      MD5

                                                                                      b7d2a1c4a86be3531b5ff42fb7309f42

                                                                                      SHA1

                                                                                      23fd1534eed79050749b36b0cd373fb6d44f4f8a

                                                                                      SHA256

                                                                                      7041152092a6e72efcf4c10a9fbabd708273afc9c7bcce055757ea473952aebf

                                                                                      SHA512

                                                                                      c4a19b08ca9115373f90c09cfb324dd7efb3d72ac957ed96e7a28f482bb021b460bf48cbfdd87b0267d34ed5a98820415c6dd28ff14bff785d7daaa25564c8ff

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      7bc4745417e30a363e54bfc593d4d484

                                                                                      SHA1

                                                                                      9044ec23b9f4742ea204c4c9171bc3bebf424449

                                                                                      SHA256

                                                                                      ca748faf3bb7fa7e505726ad14d2b36ef440473fbf624aba205c37293b8a9634

                                                                                      SHA512

                                                                                      556996565c2efd5d50ac6c3d4cee2970dd82fe7912713727169ade3482e570636c375c854701c2b43895b088740e8f55d1cef945f0d0c7c93f49ae474f4b422c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      39KB

                                                                                      MD5

                                                                                      c28b4bbb0fd137b78b23cf7526f10bad

                                                                                      SHA1

                                                                                      fa97fb11a5915bdde068ce9ea7e14a951a0ab279

                                                                                      SHA256

                                                                                      8f4f548f929d9c9325d05c333ecc763fdc1f229d2be8850313ea4fcd9363be67

                                                                                      SHA512

                                                                                      5e8c73cdeb7ff84161653aee5aa0c897c7df3d7276b884fff1fe74079d934ff2230985056703583001c358c47225a8a42c27f0a1049ee1978e4bbb93d7ded337

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      40KB

                                                                                      MD5

                                                                                      95cbf8fe8defd94fb7c8227e88010c45

                                                                                      SHA1

                                                                                      1d31f05286236b83ff35bb7a5b2f8ac08ccb094c

                                                                                      SHA256

                                                                                      8ec7a6a23885b131bac891dd524ae7d80740c94259bfe5ee4fd29c2836fe5cee

                                                                                      SHA512

                                                                                      accd38dbf120cad5597f2ec9acfecb97b98db4e1059e8c171e44f76db04d17f86a02384bd28aa8d76ec324fb41fa2a136a9254728d4203d5ae9966305662a30c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      f315e659acfd2c84e2fc01402712e522

                                                                                      SHA1

                                                                                      16228317823d770584974f9f7cdf68e9b782316f

                                                                                      SHA256

                                                                                      aada811ba38a5c0ad23c42174d8ca829d0a9e45febb51923358d37b4ef5b2965

                                                                                      SHA512

                                                                                      2498a6019c7513491385aeb7731056033fe1664f56979f89ee00150903813aa16f8164af85cba30fac70a8ee0c16d7aa23bebdbee2e1d985c7bd19dc43aefe40

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      bef4f9f856321c6dccb47a61f605e823

                                                                                      SHA1

                                                                                      8e60af5b17ed70db0505d7e1647a8bc9f7612939

                                                                                      SHA256

                                                                                      fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

                                                                                      SHA512

                                                                                      bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      499d9e568b96e759959dc69635470211

                                                                                      SHA1

                                                                                      2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

                                                                                      SHA256

                                                                                      98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

                                                                                      SHA512

                                                                                      3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml
                                                                                      Filesize

                                                                                      325B

                                                                                      MD5

                                                                                      16f5f244cc62535a5fbc2ea4c1e2dcad

                                                                                      SHA1

                                                                                      15f1d1333335f7398500fc60ef3cd8d67d8b7366

                                                                                      SHA256

                                                                                      ffd8f02c149ea48d873de4d15ee2bfbe4cf237f92d2ec14e1b10bd30798a61ec

                                                                                      SHA512

                                                                                      6a0820514eeae2b854ad75006f45d0f00f0ff9e2241e43bb4ccf2485055a5dc85bf8a526e3545884fcb068312e18712fd41fbf30e0c231099d5ba9ec27965bd3

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml
                                                                                      Filesize

                                                                                      15KB

                                                                                      MD5

                                                                                      fd2aa7c3983dfe2bd08a83677b9b102e

                                                                                      SHA1

                                                                                      19464628ec129d9678ec62e040cfbf235624d5d0

                                                                                      SHA256

                                                                                      05a2650b3afd9bbb755a9aa459f1c66487a0a50c218cc1f03c0bde4aab92fedd

                                                                                      SHA512

                                                                                      d961acf1137e9a1daa535936b934be2bf09ecab339eb712eeaf407f8a8a2728e11e4fda9a56f8596c4362422759b633ba9af0dc6ec754c6a0c87f2b511270367

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\926d4c65-52f8-466a-95bf-896d5b404382.tmp
                                                                                      Filesize

                                                                                      1B

                                                                                      MD5

                                                                                      5058f1af8388633f609cadb75a75dc9d

                                                                                      SHA1

                                                                                      3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                      SHA256

                                                                                      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                      SHA512

                                                                                      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\e51e588e-771d-4ce7-a97d-3a0cc6bb135e.tmp
                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      78e47dda17341bed7be45dccfd89ac87

                                                                                      SHA1

                                                                                      1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                                      SHA256

                                                                                      67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                                      SHA512

                                                                                      9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir4408_1627742681\75280fed-85e1-443c-abba-f1acd285bc4a.tmp
                                                                                      Filesize

                                                                                      152KB

                                                                                      MD5

                                                                                      dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                      SHA1

                                                                                      d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                      SHA256

                                                                                      fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                      SHA512

                                                                                      65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_106093008\manifest.json
                                                                                      Filesize

                                                                                      160B

                                                                                      MD5

                                                                                      a24a1941bbb8d90784f5ef76712002f5

                                                                                      SHA1

                                                                                      5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

                                                                                      SHA256

                                                                                      2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

                                                                                      SHA512

                                                                                      fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_1074334310\manifest.json
                                                                                      Filesize

                                                                                      135B

                                                                                      MD5

                                                                                      4055ba4ebd5546fb6306d6a3151a236a

                                                                                      SHA1

                                                                                      609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

                                                                                      SHA256

                                                                                      cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

                                                                                      SHA512

                                                                                      58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_166315461\manifest.json
                                                                                      Filesize

                                                                                      134B

                                                                                      MD5

                                                                                      049c307f30407da557545d34db8ced16

                                                                                      SHA1

                                                                                      f10b86ebfe8d30d0dc36210939ca7fa7a819d494

                                                                                      SHA256

                                                                                      c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

                                                                                      SHA512

                                                                                      14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_1702439979\manifest.json
                                                                                      Filesize

                                                                                      85B

                                                                                      MD5

                                                                                      c3419069a1c30140b77045aba38f12cf

                                                                                      SHA1

                                                                                      11920f0c1e55cadc7d2893d1eebb268b3459762a

                                                                                      SHA256

                                                                                      db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

                                                                                      SHA512

                                                                                      c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_1847455354\manifest.json
                                                                                      Filesize

                                                                                      43B

                                                                                      MD5

                                                                                      af3a9104ca46f35bb5f6123d89c25966

                                                                                      SHA1

                                                                                      1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                                                                      SHA256

                                                                                      81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                                                                      SHA512

                                                                                      6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_468105432\manifest.json
                                                                                      Filesize

                                                                                      160B

                                                                                      MD5

                                                                                      c3911ceb35539db42e5654bdd60ac956

                                                                                      SHA1

                                                                                      71be0751e5fc583b119730dbceb2c723f2389f6c

                                                                                      SHA256

                                                                                      31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

                                                                                      SHA512

                                                                                      d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_708079432\LICENSE
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      ee002cb9e51bb8dfa89640a406a1090a

                                                                                      SHA1

                                                                                      49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

                                                                                      SHA256

                                                                                      3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

                                                                                      SHA512

                                                                                      d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

                                                                                      Download Submit

                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_708079432\manifest.json
                                                                                      Filesize

                                                                                      79B

                                                                                      MD5

                                                                                      7f4b594a35d631af0e37fea02df71e72

                                                                                      SHA1

                                                                                      f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

                                                                                      SHA256

                                                                                      530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

                                                                                      SHA512

                                                                                      bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

                                                                                      Download Submit

                                                                                    • memory/5052-1017-0x0000024ECC200000-0x0000024ECC220000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5052-1016-0x0000024ECC550000-0x0000024ECC650000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5052-1109-0x0000024ED0560000-0x0000024ED0660000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5052-1113-0x0000024ED0560000-0x0000024ED0660000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5052-1015-0x0000024ECAD10000-0x0000024ECAD30000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5052-930-0x0000024E98990000-0x0000024E98A90000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5052-929-0x0000024E98990000-0x0000024E98A90000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download