hxxps://wearedevs[.]com

Analysis

user interaction
yes
max time kernel
199s
max time network
201s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wearedevs.com
Sample260808-vvcalaee96

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
442	716	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
3404	DriftBootstrapper.exe
3956	Drift.exe
2376	Drift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DriftBootstrapper.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5376	msedge.exe
716	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306831319802692"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{EBC7AC55-D7FE-4CF3-9F4C-835103ABB9C3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{8E698262-2C3F-45AF-9E0C-CF1D8B62BC1B}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Read-DRIFT.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DriftBootstrapper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
5672	msedge.exe
5672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	DriftBootstrapper.exe
Token: SeDebugPrivilege	1688	powershell.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5140	4448	msedge.exe	81
PID 4448 wrote to memory of 716	4448	msedge.exe	82
PID 4448 wrote to memory of 3024	4448	msedge.exe	83
PID 4448 wrote to memory of 3024	4448	msedge.exe	83
PID 4448 wrote to memory of 3024	4448	msedge.exe	83
PID 4448 wrote to memory of 2604	4448	msedge.exe	84
PID 4448 wrote to memory of 2604	4448	msedge.exe	84
PID 4448 wrote to memory of 3920	4448	msedge.exe	85
PID 4448 wrote to memory of 3920	4448	msedge.exe	85
PID 4448 wrote to memory of 3920	4448	msedge.exe	85
PID 4448 wrote to memory of 3752	4448	msedge.exe	86
PID 4448 wrote to memory of 3752	4448	msedge.exe	86
PID 4448 wrote to memory of 3752	4448	msedge.exe	86
PID 4448 wrote to memory of 4652	4448	msedge.exe	89
PID 4448 wrote to memory of 2516	4448	msedge.exe	90
PID 4448 wrote to memory of 4652	4448	msedge.exe	89
PID 4448 wrote to memory of 2516	4448	msedge.exe	90
PID 4448 wrote to memory of 4868	4448	msedge.exe	91
PID 4448 wrote to memory of 4556	4448	msedge.exe	93
PID 4868 wrote to memory of 4800	4868	msedge.exe	94
PID 4448 wrote to memory of 6132	4448	msedge.exe	97
PID 4448 wrote to memory of 6132	4448	msedge.exe	97
PID 4448 wrote to memory of 6132	4448	msedge.exe	97
PID 4448 wrote to memory of 4208	4448	msedge.exe	98
PID 4448 wrote to memory of 4624	4448	msedge.exe	99
PID 4448 wrote to memory of 2660	4448	msedge.exe	100
PID 4448 wrote to memory of 4564	4448	msedge.exe	101
PID 4448 wrote to memory of 4564	4448	msedge.exe	101
PID 4448 wrote to memory of 4564	4448	msedge.exe	101
PID 4448 wrote to memory of 8	4448	msedge.exe	102
PID 4448 wrote to memory of 8	4448	msedge.exe	102
PID 4448 wrote to memory of 8	4448	msedge.exe	102
PID 4448 wrote to memory of 1192	4448	msedge.exe	103
PID 4448 wrote to memory of 1192	4448	msedge.exe	103
PID 4448 wrote to memory of 1192	4448	msedge.exe	103
PID 4448 wrote to memory of 2204	4448	msedge.exe	104
PID 4448 wrote to memory of 2204	4448	msedge.exe	104
PID 4448 wrote to memory of 2204	4448	msedge.exe	104
PID 4448 wrote to memory of 4696	4448	msedge.exe	105
PID 4448 wrote to memory of 4696	4448	msedge.exe	105
PID 4448 wrote to memory of 4696	4448	msedge.exe	105
PID 4448 wrote to memory of 4788	4448	msedge.exe	106
PID 4448 wrote to memory of 4788	4448	msedge.exe	106
PID 4448 wrote to memory of 4788	4448	msedge.exe	106
PID 4448 wrote to memory of 4876	4448	msedge.exe	107
PID 4448 wrote to memory of 4876	4448	msedge.exe	107
PID 4448 wrote to memory of 4876	4448	msedge.exe	107
PID 4448 wrote to memory of 588	4448	msedge.exe	108
PID 4448 wrote to memory of 588	4448	msedge.exe	108
PID 4448 wrote to memory of 588	4448	msedge.exe	108
PID 4448 wrote to memory of 792	4448	msedge.exe	109
PID 4448 wrote to memory of 792	4448	msedge.exe	109
PID 4448 wrote to memory of 792	4448	msedge.exe	109
PID 4448 wrote to memory of 2088	4448	msedge.exe	110
PID 4448 wrote to memory of 2088	4448	msedge.exe	110
PID 4448 wrote to memory of 728	4448	msedge.exe	112
PID 4448 wrote to memory of 728	4448	msedge.exe	112
PID 4448 wrote to memory of 2936	4448	msedge.exe	113
PID 4448 wrote to memory of 2936	4448	msedge.exe	113
PID 4448 wrote to memory of 2936	4448	msedge.exe	113
PID 4448 wrote to memory of 1840	4448	msedge.exe	114
PID 4448 wrote to memory of 1840	4448	msedge.exe	114
PID 4448 wrote to memory of 1840	4448	msedge.exe	114
PID 4448 wrote to memory of 4896	4448	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e0,0x7ffbb86cc188,0x7ffbb86cc194,0x7ffbb86cc1a0
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,13810510277564695464,2586480213097523938,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10289450322237337477,8296683548349773332,262144 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,6045650846153105185,12730543253860497128,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,16010485282103325856,13346525685563572489,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,16351853362260784846,13966651754892976819,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,3609130537516256842,10044069972854442091,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,14520134133269282682,3000115892138067972,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,6308175451674451712,15968186612114054326,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17588898750452348744,2060859557710235915,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17588898750452348744,2060859557710235915,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6296,i,8093014936605563265,520233714114182062,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,9115157271385998036,4242565108291602381,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,3824454984854890466,14553246996320375854,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,10461513893661976834,1152244093237581151,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4768,i,368068495318398119,13219389099603971626,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5516,i,15070245123360889688,10680458082013414300,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6328,i,18068927020983427995,12912629010760994338,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6652,i,5871289968929048170,2500915995827344768,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6776,i,4393567867194214657,9492611746731774303,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7148,i,1111576058119323060,16910466711867123161,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6880,i,13369150995843049846,4221270551677793734,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5824,i,77612320376487795,2946958148041975007,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6364,i,1791532509703166248,216611037863983929,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,3728052691365347596,5684665594106670494,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,15720834295437344754,3335975609375242517,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6776,i,12428988626412418562,1400121829080030476,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7296,i,10085275479649720906,15591980410166344783,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,4015766634111607036,16718539216991991817,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:12
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,7058377743923873793,2202397857295581298,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:14
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7916,i,11962335484128533653,162585658597023837,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,7058377743923873793,2202397857295581298,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,2735282905896597419,18121795152997278487,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3796,i,14171091696464866587,15824256831890516906,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8480,i,17440512137612468186,6648025128457561875,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7788,i,15096016743944030518,2202448118870757477,2097152 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8564,i,4166126090074547226,11125819314376036740,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8624,i,7060389573757861716,9401234110505290678,524288 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:14
  2⤵
  PID:2124
- C:\Users\Admin\Downloads\DriftBootstrapper.exe
  "C:\Users\Admin\Downloads\DriftBootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEQAcgBpAGYAdAAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEQAcgBpAGYAdABJAG4AcwB0AGEAbABsACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARAByAGkAZgB0AFMAdABhAGcAaQBuAGcAJwA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABEAHIAaQBmAHQAQgBhAGMAawB1AHAAJwA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- - C:\Users\Admin\AppData\Local\Drift\Drift.exe
    "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
    3⤵
    - Executes dropped EXE
    PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8068,i,4817925805338437269,5721817630361396548,262144 --field-trial-handle=2172,i,6947172837126557255,14468853854327731325,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbb86cc188,0x7ffbb86cc194,0x7ffbb86cc1a0
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,10269909825556074431,16084130619180710119,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,1363840523723338237,7338975237494948146,262144 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,16392915768637558518,3144168501908486794,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13038775963156315367,5866703961600935276,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13038775963156315367,5866703961600935276,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,3138452201385872531,4621745427189493176,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,3346930257650185343,5741111054680855803,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7935218541039384755,16796148758164424020,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,6427650001027183592,13721160484784237543,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,13815612167363864651,5847410550985359915,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,6730429242356429329,5563988495932898240,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,4999063127406616672,12083200311785473094,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,4753049390968801148,1254743835866549731,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9497734660070028255,16987931760386356848,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,2612744970525901348,15903826075474914765,524288 --field-trial-handle=2080,i,9533394305250803777,18158453602045397562,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Read-DRIFT.zip\Read-DRIFT.txt
1⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Drift.exe

Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
Size 2.7MB
SHA256 9d3fc300e58490e4a4f0959ee72d1df386e9737083a2011a8821f8fe61de5654
MD5 9596303ebd15d4bd2471084499e4a9bd
SHA1 411d41c2eb65c0a6668e943f43dbcb1e71e838b1
SHA512 4f1e68eb209c318e61ec5017fd0b658701a56dcb17c29fd332c61cd693e18c1a33df956ffd2ed48b31d96064378e4fc8aaf5e5fbdd721c84703121d033a2a779
SSDEEP 49152:Z1dn5IlgOhrOk5I8TC94UHUxgCMzERoz0Kbe6X9h8jux8CDhnNHvgp7:6QHUxgFz0keGv7PHk
TLSH
T1D0D5BF6AF66A00A8D071D0BCFD97AA17E272340503306ED707D08A591F6B7FC6A7FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2af9d181638231328c7e8de2df758443eb65254c218fa9fef6978d419af395e5
MD5 aa3abd00681f9de5f6b6ca0892d1486a
SHA1 9caa56b1177e754977407e12be7bb74f944d3115
SHA512 da6e26d49fbd513bd2f8477e08452cedef80fab6c154d74f29a2c64ce138e35b9f26bbcdf57efd2e520eee6aabe909a4c9fb55c897ce703b484603afdfe17a3b
TLSH
T1E1D023753B1DF1E0C37C403A073042C11772056230434741A2058C0CDEB004052EBDEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 62516eb256e45c97d47b0a524609b5db9193218609c5579dc6dd0d35cab8cd29
MD5 45786ce92b34a2a323de75186b6c1b09
SHA1 ecc6ad8c4af5ae419e0cf43b991054b7bc765ea8
SHA512 db02d2916865e56195df37c62d929a94151c68a94c7ba9fbf57de4b16370d99a313e53b457d108046603855a30358e253698bdd7c6eff861a9a4f940e59b8a5e
TLSH
T1AFD0A7B4770DD660C66D80365921A2925BB2556030578B629155984C99B405492EE49A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ea03a790c1170309560f79c5444bcd9e94b955db92c5aed30a2960d0527c4d12
MD5 f91cb5688a804bd9122a1f97def65f56
SHA1 663029265603f3a01904c21438b38c960c02f37a
SHA512 18462fe7fb2ea7c1470ac1827eaaf5d752dacfc68a2148fc976b1a81248aa4a9df69aa029205b40dcd87f5aa1c964577cc539fe2527ce0d34759e4efeef4720d
TLSH
T1F9E02BA5CC61B83B08FD271850545746E70413975B418A0F3E3CC1088FB163A454986C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 20KB
SHA256 9ffc24536d4b1077ef8972af691a335cb3c097c7741c06d701d71e049560ef15
MD5 ff34edf5e9856cf02ddc2244144763b2
SHA1 9a8872051a33c0b5da0c18bcb3a663123c0563cc
SHA512 08676f9258f7ec844a356d300065fe0b4d577ad9a99b4d6f5e5ab6b5798b97cbf71d4ea198b01e8c5672ca9cf60bfb395654294f64b852a4e3ddc643f4d4466b
SSDEEP 384:iu6Uc8V74DHG5m59jH8jgPRI+4ek1dcOBKQky/OAIgkPHvrpeU0c2nj1wM9K0s2q:Hvc8t78Pjcs6ek1dDBKR1Xgkn12hOUnq
TLSH
T11B92E277EB76CA77C81E4035286C5E520AE36759C13FD16BA13872321DFB70221A71E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 35KB
SHA256 57ad3bc69c218a19cc3f44dde72302f0c9731f36fdc0d3f8ec3e781925b529ed
MD5 070d7d3386c1c8c50764eef60a294de6
SHA1 d2ecb8d07341b919ef86416d2d89c8c7e4659b75
SHA512 9921b6139eeb7ed515a3de9e62882a6c3d26b3b87c9330985f33ddaec02d8877ced0f61a0df5c0184c65506980eab74c53354f23bdb823e7dda5c846c71ff11c
SSDEEP 768:xWZEZmISDMaa3XrrkytF16QDZ8pZC/71aU6q1FryHd4C:xWOZmIOG33kUF16xpZIav0F1C
TLSH
T156F2F15D6E5FDFB2A2C0F802F0B2042D43C219B456E287ED6602773B1DB8C99B650FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 23KB
SHA256 06df011163bc2147a0b8dbf5d412f24bfe7ebaaa1654a2d4ac2c68cc71373ddd
MD5 8bb0a6e91cbcf4aca9c691e9225b34a8
SHA1 83d921cf6e8334253aded6cd30ffb5781cf3c0cb
SHA512 27341610b65afd4d53f905989de533c340b3ea3b5da82463206e62e0880556786ae618459e06c9b24d43be73f59b7e5b68a85dd80ea52685fe18dc6b436e4cc4
SSDEEP 384:/nOQL4sw+FG7jQNqGsNiCUKXBAmIswDMQYU6KziRedelC96ajS+yDyQTdV/:fOQL4sdFgENqGsgC1AnZYmORe68z3Kdd
TLSH
T1E7B2E091FDD3B1DFA6A58562FCB250E28E600C3C8EFE454CF82A82505FDD0A60D609B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 17KB
SHA256 929c446805575e399ff7d6880544b408f5923fe1dc1667f5b6531d09bf5b9476
MD5 c3487fd31aa7061b3d60cdeb6d3f98ef
SHA1 707e706f27dcf7f0158c7384c1644a6759e2936d
SHA512 bbb97aec314350f592ed8d727f6fb562d84653d36cdbf597d886db89eb99321b32eea357214ce1be1226d6d951f92ffc81584543d92c45e657e0480642017937
SSDEEP 384:/WARQaJRwHUpBWrvrMrlEi5TwDSV+HvexiZ7Eaohnd85O+x0W:eAnJRFpBE4rlEiaGQuGBohd85Xx3
TLSH
T1D772D092874ADBDDFB269E467BE8F4C75791AB35833275360A0D872916500F1BA0FCD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 51KB
SHA256 c35135cb4e8e6a4d1c9cc60ff9b0e8fb23d5568cc69272ee6df455afef52e2a1
MD5 529b5adccd0797228915db17b3ed99ca
SHA1 78b4c38dc561a81c96a05912a28f22b4a22e1866
SHA512 53ab629b320f633dc9bcbcbd71284c0b8c36767beae6fb6e4e83171d226de9c88347787e0cb93d263704faec7465189c3913c112f6afae39d4bb0e8cb12276b1
SSDEEP 1536:13HtckVrCyymEspIQVRwc1NBCdRnF8SVWCD:1ik/pIQ/13BMWCD
TLSH
T12E33018BB1D4E43BD8A5A5FDA39DAC2ACD8282C58ADCEE335300164D033FC73E695915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 51KB
SHA256 8e95246891091131d753fb3af619af7404a96b8f0f251a4f1178a0f5df99fdcc
MD5 1dc2969f93ccfdc026d8a2f7926d503c
SHA1 223dce52d5a4561c58ee8a1540bb26c3fa1fa73c
SHA512 571f95958fd6859da85d3b5109c52ff49fee20f4d3236a2342f3f39e8621b508a063103b0227ad51e22dc09e0d9a540c886cd6ec3c31a189798e4ed8588bedbd
SSDEEP 768:zh3HtckmdrGW9JfmZEQaENVN03x1gikZbBryGtho1CMWYufNrvvaPGSz2E5Ylw6:l3HtckqrG6fEHVkXO8Yo14fpSVz20CD
TLSH
T19133F2CCFB99D616E5753CB3259928018BD800AC03E9CCA95705AE8CA33FB378AC7355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 91KB
SHA256 b746587b04bfd7e4d1011a6ac3d5e967a2d9df351d43137f6ece6a3a452d1dd0
MD5 2f4aad557670f226aa5df58d531e4e3c
SHA1 c274d2a4e9ef24f862b9d72a754e6acea0ae92ef
SHA512 321bc23df4e3b610df79c26c3c21d5c4694f89543049e33aa7858069a7fc81adc4e447c54e3105ee69c5e67328ec10307370f21b75a947759c9dd465f6915b3d
SSDEEP 1536:7S+Hm7+mXKdrjLJn8In7jt2jHZjWXCH9JfcOM0bCYzki5a5MjMcm62Cqvhvd:G+mXKdLl8Invk79WXm9p0WCYzt5a5MjQ
TLSH
T11393127D4CBA191EB78CC61B98357ACF446033D9FAA380F43AB6591E4D59F9F1B00426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6f720e9ece5a6b9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b6f720e9ece5a6b9_0
Size 263B
SHA256 91317c27e6207a659ffabaf6a77617d2dccfa7964c9e90640cb82ed4c3aa7c3b
MD5 91387b74208f4fd42316247bf7c5e201
SHA1 1db110696f1bc38c400e498b5b8932849a8cb5ab
SHA512 e8dc29c5ee980e918a89b0a2720ac3a17fde1dbe8130f879884b7dcd7e91e5e380f3bd89a6e5358a3c1c04af118712cbb99df11f44a7e15b444ab6f50e2cbb62
TLSH
T18BD02B6304805101F01EC3B4CDD6810D4A1330306F9CC101818360734509AB09999A9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 25f44ac7b4c829ac504945dd89cad0d5fb389abb3809e898f8d34eef4d8b0de4
MD5 61d464959c37935450cd9b17bfd0e883
SHA1 20d0808f83c208e9ca550714a4583938d84b3637
SHA512 9503ac027ef24d961aeb5c3c39007accb4709b933a71ddfd336dfebade61d8557927d2bf4e12d0036141fac2530d9724c428c362cce5455f17731b6676f753eb
SSDEEP 96:rD2V3LU+x2e7jWicUBfN3nECHohDlqyJoXVYofwoqN7+xsA0+kgIh5Eriv:rqVbiyOFhDYVYdSxsBnP
TLSH
T178C1D9900CDAAA91FB566631F3804E3471E4B6B33F02AF834FE19DB5168FFC65499602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5958d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5958d4.TMP
Size 2KB
SHA256 477367f1b2eab023e14e143f67c9a03bf34002f1f01e3efac982f2cd2a29aac6
MD5 9aab99e0d6e89074a7fb410f311b161d
SHA1 8de8d2563b3c537e6fa987ab0aedb0459801902e
SHA512 b27e4435f189305f493701f3d89e5d3e9da134a300dec4e00f39a9e1f043e295ec34a7e84ca10fb1c8d87fad8b2366914ee65bedbd014d259723aadb4f9ffd73
TLSH
T114514C6508CB8AA2FB27663077D18B0871F407343F43AFD396F0DA3968DEBA7521A004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 d16f7a3f72914939e5c03394964963e3a7d94787c3503610cae92aa2ee1a1ad1
MD5 7c16f58b0ce2b5ade5f95710f18eb58d
SHA1 efdda2b41390ebf8f1ba9e3d301a5016c7c0b9f7
SHA512 9d4dd10fb921495e098035fc7474c9964cebb7e95569bbc5fc5b2c7defce082ec90456f55f1fe1d08ae6df76c11cb38b7906f3a0c8ba464aceba31f4ac2678c5
TLSH
T1C0E0262429C8C16DAD54689B966C7308C3D034C3AB8CBD27270A88886102241F387E90
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 4eea609f500247e691bfcb57c7b344a016f901e6d7c3ede7eca524c074164ac6
MD5 6c7e904da2b8f289c3a9936049a82522
SHA1 01648758f42979db5cab3c3667c00d79f76510ca
SHA512 059e1efb8a860a080effe651f9a3ed7bd765cb93d58c4b068406a025753b13ccdab4dd4b1b35ca6633e85a99f0e02e39519a267f43ec5a5378dcb8a91b81beab
SSDEEP 48:IzBmw6QU1PzsgQ6TM1sAjsPwR6o652E6f8A4Xo/46L6tZ94L0j5+AVcIWwh68j8S:UBCxZTvZM1buJj5+CjWWNIofDuixiSH
TLSH
T187B2E8BF6E797802D7714DF6321A1539DB37C1988FD9ACC668388020C979E65B4B42EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 14d048616769552c15fb9e139c2d447036c4488dad6bd965b0deb4e416589c5e
MD5 8deff54623007bef96ab0f90ff3e4815
SHA1 70d7116fb84e98ccad4caf21587fa97a855fe76e
SHA512 fcb67acb37d2d1ac6916f961210c3891ea6bfc07ab3d9150f3f1b747ca76bb33456ad9d59a4e672ef93d013211813c45926aa01c3c9726c91ed60f5c478fa0a4
SSDEEP 384:bHOd1IDIka83uFBBQ1GkSNWIqUjm2jcQfjS117DNspUG:zOd1I4FBBlLWIjjcQfjS1qUG
TLSH
T1DB14A67F6B353312CA78407668E654975E6FF03E8B567AC6E8700410DEE3A16B06C4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 fb8670763a34942d25e279d39ad5a021119bdabda888a92d04798459778c9b74
MD5 d03e869014e0f55411b8fbdbd70828d3
SHA1 c215b9f7f0a537cd4df11a6b890c41c0b2584a13
SHA512 09ff30e6b2b655b212a6435bff35111837f1e1d2439ee275f9fc3f85b6c63fc3bf998326f0d9efab9b703fd7217df457db76237f028a2fc45db0fb3fee5f992b
SSDEEP 384:D1GzWUpCDTJEeBBeXP0J6ieQM/y1WJpkmqakCKciaaiGhQ8O7fYq/liAJ2ZfJWtS:lV1QeDupbYupWM+d
TLSH
T189928BB3C2E4897E992125F897246D3ADE5E181D42183D26CDE8EE4F93E1433E34264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b3203adc-96fa-4d04-be1a-c9097c9ea81d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3203adc-96fa-4d04-be1a-c9097c9ea81d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 54946bcac33e49de2bd3004f90a9c7083512d59e2b47271c8196e34e4f249ea1
MD5 f5b925b64ca3b68dcc886025bb07ad5c
SHA1 c90cf26bcec4403926d2d4f39c4fb82859159333
SHA512 c8cb9eb539b96f71b3e3cf7d8ccc18f5cf68c66b48490378317110aa4b47b006dcd2ea0db81a80e29a184e8e015bb5ef6d7f3678f93b537b7216efc4734763f6
SSDEEP 384:sxZTBuqX8B/fbsqWvTMUrx/bs4fIq6z+x:sVRMB/flYTMU9/bsWIqv
TLSH
T1B572F9156934697BCCE7D21DFA55BF53D6F9142392904E44AAFCDA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 873e1421fa6e74d11257715518a2442a992c792c64dcbdb0e91a2fd8d978e7a9
MD5 9a1cf74bdf43d4ac55963b75fda0a840
SHA1 6d57b55058d1a18383f30b8fd850bc0742130b99
SHA512 90625a757fa64da17fef12da81a1da5c3eccf43925683bac8df4415bb25087d357a6fc5e961ab5cf273010abdd33a19018f8f97b502c73c17aa021c0135537de
SSDEEP 192:sxZTBRhyMqZjK1Ml8UQdY8B/fbsDMKTG4w/zodptj/W6+WNr9FzY0hp/M4Ig5P+x:sxZTBuq68B/fbsDMUtx/bTz5j1+x
TLSH
T11F72F9056A34A97BCCDBD20DF645BB53D6F9157392904E44AAFCCA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 65e815baf608cb27a1a781cff935f8f54bc38ecc47d16d25f94055ee288a1754
MD5 6181f030473bd3b9b12c6f2161a0cb74
SHA1 cb2f02adba1dba9e3e26eab306d5f839093bd359
SHA512 b610beca9d46add4ff2377cf8151e540593e25ca8e7666a2859cfaa534ebab5cfe4d686be339d82faf65fb465be219a0c6807c99c0c374852ab3a2418905185c
SSDEEP 192:sxZTBRhyMqZjK1Ml8UQdnZB/fbsDMKTG4w/zodptj/W6+WNrlFVY0hp1M4Ig5P+x:sxZTBuqvB/fbsDMUtx/b/V5p1+x
TLSH
T1B672FA156A349937CCEBD20DF645BB53D6F9157392904E44AAFCDA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9c2999dd7e38f5265f164b84502d8243a4060db071cd29c24aa9e505b57d0f87
MD5 58c5723235e36132c912ed7e961509dc
SHA1 f2f157e5c53d2b83840cf92ddcd0335c15c4bbc0
SHA512 e954db06bd105b91a346496025a3a8a0ea6abc36a81650456db60cda5a7d21c2d2d30be265c2e4399615ee9afc6012d07ab9950a38845d8ca934fd1e25b78be0
SSDEEP 192:sxZTBRhyMqZjK1Ml8MFB/fbsDMKTGJw/zodptr/W6+WNro2/Y0huZm4Ig5P+msJ:sxZTBudB/fbsDMUsZ/bJ/5q1+x
TLSH
T17962F9156A34A97BCCEBD209F645BF53D6F9157392904E449AFCDA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1737c90ae200703262534ab827e30122523c91aa96b3c2074f1e950f64bf1fb9
MD5 4b09c5c83c7003d6a285532f5b1f785c
SHA1 49f4bd1b283516f7ce5ce93ddec80dfad4884ae9
SHA512 885b1c3630f85c53059aea9f041c0e3f683fb22acefa52e196d492062c20651ae07b8925c49d6fbe3828521a4958cacafa249fec3d5814db1ebb738ebbebabb1
SSDEEP 192:sxZTBRhyMqZjK1Ml8MnZB/fbsDMKTG4w/zodptj/W6+WNr11rY0ht1M4Ig5P+msJ:sxZTBuhB/fbsDMUtx/bbr5x1+x
TLSH
T16962E9156A34A977CCDBD20DFA45BB53D6F91573A2904E449AFCDA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea6f6164b6f1bfb0a22628f632990b3ee9a75e5979cf1bfcc7d3aaacf2c56040
MD5 b6104557ff7e82dc86f0a32bb90c9a8e
SHA1 5edb4a47c3facd965da8a6c908ea743e7d8fc1ea
SHA512 bbbd8afb95b7e21539dc3e1be83c4a87d21086321115c418e5f4e97df6867e873325a041d0d37623f5d924c2b9fee769017325b31ec434239d1add11cb5b7597
SSDEEP 192:sxZTBRhyMqZjK1Ml8MFB/fbsSdKTG4w/zodpW/W6+WNGY0hbZm4Igj+msJ:sxZTB2dB/fbsSdUtW/bG5Nj+x
TLSH
T11162FA066A345977CCDBD309FA45BF53D6F91573A2904E44A9FCDA0C04E6ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9952de1ffde3e397a01070a3ff57637b367870dc0f35ffe23aa708e3f2b6e2f0
MD5 83094dc1aabd356e7f04d4824a77184a
SHA1 190cf9b564485c3cd1eb295f8fde4b7924f1cda6
SHA512 e516a4f2cdcd10c8c563860435a6d9a2f48d0196f3b14033e1ea674f834f4d0c7cedf0a1285ae26de62966c16d20d75a43dc5617da3dff303f5dda9ad18ea4b3
SSDEEP 192:sxZTBRhyMqZjK1Ml8MoB/fbsDMKTG4w/zodptj/W6+WNrUOZY0huZM4Ig5P+msJ:sxZTBuQB/fbsDMUtx/bZZ5w1+x
TLSH
T1FA62FA056A74697BCCDBD209FA45BF53D6F5157392904E44AAFCDA1C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 19c7e716cb0009962ae437fff947c8aed437f3beaf899fa59e721e19988d77d9
MD5 debf8c89ca73e7e9cd2582842403230d
SHA1 2ef3083db752ca30644cd60aa24cc67a2701b0e8
SHA512 708593427446f5716ee1ae4797c759678e48152eb01ecc8e012c77e093fb52c2a605062f219d25166c3ef6d8bd88fbdb75ffc7d293b9dbbfcb8c1c01fafd7a78
SSDEEP 768:wQAKq8y028bWRmj1QIT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroS7:wQAKq8y028bWRmj1QITu1jaKL4LpfiE/
TLSH
T1E1E21B3B280CCB7E4FC44E9DED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 023f7146b9dabe2df2af26e2e21f3d139592655dd8e9365b9cfb41899f6dc13d
MD5 6c3864d463a854ee7a0698627d971145
SHA1 70fa824d0c21da02fa16db2b7a92ca348ad6177f
SHA512 84b3966427bddade081f2aba9880dbff4dc531684c1a249d32caab7aa097ca9a8da8e4c6da20aae8b3c9a03c0dc724255e489148da7bbd6806cc0c725fd8068d
SSDEEP 48:F2em5HdnJp6Tf59Oujpr7mp6W59OpOpU59O5ykr/BAE2gUz/B/EQ:F1m5HlJp6Tbjprqp6xOpm5EOVEQ
TLSH
T16AA1FDA39B046042C9D866FB6039F5D8651EC60A6FFF87E650BC8F6D92412D63329B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ceb05721c4785db2009e35c945c331fbfa3e2e82469205a500be908990deaed6
MD5 496659f58a994edf3b8bca9d6b89cca2
SHA1 216c3f0e2b7f4752b5146d3e83e9a6e456816b32
SHA512 15d68cac2c3cc74c27610130ab59ca1b1d28e5a74f9fab904b431b209bfc31ccde88f9b9f6f0a67d6832050859e08d8c65077a6f8b89f70fcc7f36b40571e3e5
TLSH
T134E07DA01ACEC17D7C95248B0E68B348E3F47457DBCE3D232F04D88C6582544B397590
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f45056e91e30a35a54d097b7f4f40c6d01719c89266e15d96ae7276d35e958d1
MD5 87df665653ce1db0aeb799b0f3fba04c
SHA1 a4e6b1bd3478630b2e394ec1de83bedcdd20f0c3
SHA512 051790c373ad322ad92258f5dfecb954a0284b73003c47bf0f51f2e20ab2cb6e9ce5b2baf068f33eb2d8ae3bcf30ab95a983a1daea5672954d92440749d82225
TLSH
T1E3B02200CA2B300AE00083F032C22A20F3208E20C3833208E0B0F0AAE80032032B220C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 9961663f279bc9e7b84c63d8002289e14de59224d46cbaee4e28e282926c1b32
MD5 92ccc832416446c3cf3c33f16df9921a
SHA1 ed59c44631288e654e5bc9f7b105ca617cb3bfa1
SHA512 7a8710576034c0149874f146a46313ebf1bddf486708773d1b89a57938766ed790fdd042d96ccfda1455cae4bcea02c7513fbba16e4d11bcab8772c6f6966b93
TLSH
T195B09208BB00A10AE5890BB31A8847E46310E01520001813D814CB200888AA4BE128D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2c7938037b05716a7acd427fd51d649796a24f3cbae2a1a6836b10c88ca4f62c
MD5 db3aa81c5a459f0d60fed1e286aa4dc7
SHA1 83edfff5de8843c606a36da3b0c1773dbf617088
SHA512 44dd0cbd05c6064b894d5876f5a0087cc11a1c4460ec1a3a85b8304d7d6e89f88685f1a41e9fecc7ed5fac6a43c378fb39b2f7f175652e7503bfce18bbd294b6
TLSH
T1A5E0D8203DC9C63E7D97208F9618FB08D1E27452DEDE79336B0894486206140B383D51
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 23a9f38ea239a99eea7910ffd6276e4d80d5d3cf0f5def4b102333d5043e1788
MD5 5603896c43ddd1b24f0a722b6479e6ca
SHA1 4f9fa532611e55827567729bfc458b1ea8d8f4d4
SHA512 906bb8905fde86144d94758e710e24146893856a7c473e77e367b9f09597139c5a88941fe441cab9ea94eda755170923ba65c981e4e750b69407db7d06bfa782
TLSH
T160E026F07AC8C6BD6C41748B4BA8B70CD2F07886DBCB3A2B97085498A501100F3ABD91
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 789e651de9d85e22e3d6c27e0e396fb68b0b71ce699e08ada94b48a617e7df10
MD5 3c9824f09784b52e726509b6ea9c5261
SHA1 d033b4e03539aa6f988d9facde76f53052a631c2
SHA512 c30a7d9e4e9cade71e9e4005f40f6b2cf3a2ac56671960cd89dd44419f33a64889f4b1ae884d74fcd829ca49f0a70ba3bb28c2c4cfce67d001a7d54c4bc29103
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5P:GZLVDJjEDPV0/Zdkp+
TLSH
T153A2590232BA42023C7E391C93968B674A42F563345DAC7F7BA904B54E67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 19KB
SHA256 d94bfde8514a7bf6bfd2f87ed3069125d38d3dcb3f8eff433ae99deeeb875acb
MD5 9db0f13977b7de80947fd5f642e9396c
SHA1 3333665a59c0e1d2cfa8095e4161184c8e093a4f
SHA512 91ded588163a9e1e8616d759924305f98e80cf51005b4cbf31ff96ea154edd82bb75eed1a018db3f30bbd00417b23e71a3bf632059ef0a2c295a34d26645701f
SSDEEP 192:6+y5Oq5AsylrQEus0tL0BmQGIIIVbFMIMnuYcYMrA5AA5zXA5FXA54EeB4AZA:62qasIgs0BQGIIIVbFMIMuBj0dc+O
TLSH
T17492C76A37552777D35E7BB602BD4F8807E9DC054666631C30A1280E4DF3A278AD43F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 8c7c6968f2e0f016c70d7037c1f7f940e2840a4b783c6dd07b0618368638b120
MD5 9bef85c17fc3eef847332de0bac4c084
SHA1 6559113b23d4e9907a5f3ba7649734fea4e8c000
SHA512 cd814c1cb5380419a7822b995a35d690574db45eefe7e0163031c9a25ad74f169843ce837ea040fce291f03254638153e5a6e1a6f264a8bae1e8d81562fb00e9
TLSH
T103E0DF20AAC8C1AFBC55209B1128770CC2C03A43EFAA39271B08844CA402500B787DA1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 75402d4d3d2b2ebb71eb4275bbd9bb670bc65e53d0b83b9bd75a3a7300b46e71
MD5 e1f4bc5bd6699f3724fca699cceb3dcc
SHA1 92c4bedac7ff6e3a1aeda8e4891fdd7e9cb69761
SHA512 f04a12026183a26b8954ecb4d909b63d09670dc5b86a2ceb2216449e8543a5d8210135d881f811ee41549b40afa1bcfc214986d18ae85d5809330f00b7100998
TLSH
T14F218E56F320C148E58E863E642B9B6A1338E8029FBCEC4F407970352E71E001E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 93f83d342d3b2d2c7534244ff29ffdfcb6cb72953328e8ce2456467fa3952d76
MD5 d1917f5e05055e6071c3260b85cff7ea
SHA1 bd507dc34be63866b580d1bd2b80c3383c611444
SHA512 f6822c77913123d126ae94622183e9c70bd9776dca373dbf44d6e44540e9ffcb10d6c233f8ab775c4a442b2048c3fa970622aacce01904dc56fc51a0f4ee4e68
TLSH
T135E0DF20B9C8C1AFAC5120AB0178B74CC2D13982EFAA3E231F08884CA902541B78BDA1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 33dfda117a638644b1ea75e9abb4daac029b6dfa0262a67b81b113e3887315e8
MD5 3f7cd671343054fae284426d38dcb802
SHA1 c562c322d7b205c99c589575d89f58f4c330c45b
SHA512 1be7c6f37f5fe65f23353136a599994778f47b7a3b00c50f55fd3c99a6148a50b5e3310149fb663d061e4c50878bb565499192aaaeba012292c10b2bfce91a38
SSDEEP 384:ngiF9CcmyWCs38N98TUNTUlIxBPm3ek32nn9b+af4Jf+8G7PHOZcEL5tISe4KV8D:7Fccps3GwgPKekmBOG7fO9USI8p0vO
TLSH
T181C24B32EC68C9BBEDE64F99B74A3503EDE04267868C89D8DADC2D5D00DB19D530B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2538920edff5c18ae29b5551a2413481c01a6baef514595b8478ab5da14b8d28
MD5 e4ed468feeaf0c451db5732172392011
SHA1 a1765dcdb86cd339724a802ced5fb619602fd2ee
SHA512 c2c87100706366fdaba10792bf432ced08df2d82acacb3d1c457ed9a1bee4f90e7d55821d580bb730af30650d10e33751e03414bbe6e25d49be0509c8e83fdff
SSDEEP 384:nXiFiZcIg38NR8TUNTUlIRTPm3ek32nn99TIu4Jf+8G7PHOZcEL5tQSnTKwBODNu:SFQg32wgNKekmovG7fO9USnewBKZOr0E
TLSH
T140D26A72DC68D9BBEDEA8F89B74A3603DEE44163D68C5AD8DADC6D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 eebd840a3ea767bf157201ae190f6bf4549172bbacdb46a84ce14c1fb3040e98
MD5 e29bb3f1b0b786cf28be101d733d9b06
SHA1 2e4d48db85902a8ab697c128a2b49719930eb334
SHA512 dd661acc77764a90fb43c04d5983435b5288a1f5685a870335faf6de96bef590f2272d98de40d940ffa80909771eed1863596158e0aa546b5461e7960a49b7fe
SSDEEP 768:jFQG32wgNKekm5vG7fO9XMSnewBKZOr0E:eG3AkXWXlnevZ0z
TLSH
T182D26B72EC68D9BBEDEA4F89B74A3603DEE44163D68C5AD8DADC6D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 df59bddad011f71dc83a076bc71a9551dbac7b3a5ddea440c1241a625197c73a
MD5 6add2cca817395c0902481cec6725224
SHA1 122ed43e5fb307f0c6339420bef28441f48c0c6b
SHA512 3b967d8144860b7d87292722125bf629439547db0c0e33eb99f8a25e20aeaad589fd886a76ebc9ba63623c9a9d47f18ca21069fe7d2978cb62caba4aac5a71be
SSDEEP 384:nHiF9CcmyWC638NR8TUNTUlIRwPm3ek32nn9/Tiu4Jf+8G7PHOZcEL5tQSe4KV8G:CFccp632wgCKekm8vG7fO9USI8p0vL
TLSH
T10DC25B31EC64D9BBEDE64F99B74A3603EDE04167868C8AD8DADC6D0D009B1DD530B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 29976247e918a106770a04e9d6a73e5eac5146a9231687da7afe40f3d1f51b3c
MD5 fb1df0f16b5f76db8bd448875da1f5c2
SHA1 3d4d447745628ce4584ae5441b80e2a401b2c842
SHA512 1daa90e29ecce1417b70aef066beb081f53a7f8ec56f09c1be16a516595b6f7f4e28bd316f4ca6d52e83a96845c6f749fb800d7efc7e25c6b9829f01717b0219
SSDEEP 384:nriF9CcmyWCs38N78TUNTUlIxBPm3ek32nn9BQQNs4Jf+8G7PHOZKhSe4KV8p0vO:GFccps3cwgPKekmYaBG7fOkhSI8p0vO
TLSH
T13DB25B31EC58CABBEDEA4F99B74E7A03DEE01267859C49D8DAD81D0D009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 30942a14b143bc211a42e80088c01dfcab7a04b27c438f2ed64483df90d04404
MD5 6b402e488d25b733b9cc29bbfcd8466e
SHA1 2dd61a637192ae139c4bde9f8ba13dbfc47993f0
SHA512 39857e5fb9771b1efe1961ae2a2a2ef752449924e61f269446a56eb73425e96260ddd52642bc9c91e500b3c2e8a24e09432660a5c7099ab5a71b286b5f9c60f3
SSDEEP 768:jFrl3Q6wgNKekmxPnG7fO93SnewBKZOr0E:Zl3QYkXWinevZ0z
TLSH
T17FF2E4F198D79877E9AE4B87A73D2D0299FCC153B5884998B7D85C1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a086ee4ffc4fb1e972c7d0f8b352ee5f0e0bb04ea3a0b9ce18c9f61d7f1db5cd
MD5 edae8933595e69539e64ee69e72a9d1c
SHA1 7d66257d8bc5623700c92bf005f5a803b8948081
SHA512 11af7fb9ba1c54089475be1f7e43458a10824d1ebe35aace1bc6e53a47696cb92b8b8f884b9c7a857f42bdea20350e3c297f0d8beea0edfe7ef5024f07d220e6
SSDEEP 768:jFTfQ6wgNKekmtPnG7fO9cy89e0newBKZOr0E:VfQYkFWt/0nevZ0z
TLSH
T1AC0391F89CD7897AD9AE6B47673D2D1289BCC177B4A84498F7940E0CCC6207FE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 24817884f6864272cd1b2a39ece59a47bc01cbf8edadda307507867bf1b33fdb
MD5 34a898fc16a56848b2ba1842bedce6d6
SHA1 3bef08b256fb1509ad7fcbc5e430242e752a3436
SHA512 40fdd2fbd0cd14d584a7bdf9b07ae678e5076b4c396c2b7f43f5c6aef331c5731acafd9b9172c435d08cfd19f6da88035d48f57b4c423e6b37e31f21b019f489
SSDEEP 768:jFHp32wgNKekmKPnG7fO9uSnewBKZOr0E:lp3kkOWnnevZ0z
TLSH
T184F2E4F198D79877E9AE4B87A73D2D0299FCC153B5884998B7D85C1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 09301b74f51da3b6ec2ae064db95cbf19a322e6b0845488d998bd9c59d75e45b
MD5 9c131ed557bcebfa97f24d4e530e590a
SHA1 e8ba3b0534b596886bfd050d1e45cfcc05efa206
SHA512 84db02e00b8ee932d36aaa3ca9933d59e0edcbd4c918f94614f2419387a25bf5688e4bddb8b3a2284f05af97d76610803755354865d0393604e5646690dfeabf
SSDEEP 768:jFx+3Q6wgNKekmwRPnG7fO9KSnewBKZOr0E:n+3QYkdAW7nevZ0z
TLSH
T167F2D4F198D79877E9AE4B87A73D2D0299FCC153B5884998B7D85C1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 92627d2c1def211de6023b5dfcf03c943fae4425066dff267d53c58522d8e6c5
MD5 a07102bbf31cad809ce8ac748839944d
SHA1 2560f4b6d5002ca263d03c77e42d5efd94ce6f1f
SHA512 3996089324a82e7be083c3e818c78b6678e5e052087d39305b9a4724364f9d1055e75372937b56dd69bf192a3ac22c78b6806f5cce557a4a9f62f41e9a148873
SSDEEP 768:jFTfQ6wgNKekmmPnG7fO9cy89e0newBKZOr0E:VfQYksWt/0nevZ0z
TLSH
T1DA0390F89CD7897AD9AE6B47673D2D1289BCC177B5A84498F7940E0CCC6207FE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 42893c6b6e76a2072295c3d1c1252a9b590eb3c0e39251c683f1ab451a5b76d6
MD5 ad202be816db066437077638f9976f2a
SHA1 1f6dc579b564e788eb0e402261d8333ba1f92fda
SHA512 0ad9701b75d395aef5d18fe38d504fca8e448be318ccdcb16f8957bfe422727391783ea507116cdac4a33768a53d5bbb48181c0252699fd88d69cf18483413d9
TLSH
T1E7E002019308049BC019133051D71B60BBB0D05103A303178611017A3CD2364AD70A41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 49f86db0283ce5b5489d52c643ceeefe6bcfd2de77ead70405c173f91bdab03c
MD5 9a7606f64584eb964177a9d089bd2895
SHA1 5bfc2f1c42d01961eac653bf09e5fb54036be06e
SHA512 dca57babfbf4b14ef63df3fffbf1da73a091e605c36c54a956af24edd1a3feb4bdb3ecd088bae54cab62f4a0a97414b74fa2a7aadba0d81a180b9ca06a2bacf3
TLSH
T1F9E002015304045AC011133011831B506BE1C05002520307862101693CA2714AD10641
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58fb62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fb62.TMP
Size 392B
SHA256 812994ee4233d26fdb94cf28d2b37a3666f5775e24884ceb93a6dccf728936e1
MD5 ec37a881da9d5d9073ea93d86f037832
SHA1 c119ed7493895ce3fb24cbfb0027241ed7592274
SHA512 4de652698c0f81664f454f71d76cde02b0afcf433923f42c6ef09ca68bee55728743c12156382c4a3e88aa6074e017708993807b2c9b6e82c7c64c16f50c4989
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 564afa3fe66106fcaf58849d0f5cc6efa4db450732890787e79f6e6a3464a7ba
MD5 d7b2cadecace51e51c83a4d197c7611f
SHA1 21f7b15be22a0efccdefcd0a1256bbb02bc605d9
SHA512 2eb39fd47604ab834a05a065a78dcfd4f7cda3d1bda4e2fb765ece6e093ba16d4682337b9b0c095dd3604089b40f124c207ad46eb50689bc0678207c10838c55
SSDEEP 3:MsEllllkEthXllkl2zEmHSK1:/M/xT02zke
TLSH
T1994404447FC0040DDF003170C055C3F00370D57005115F4334D34C135CCD5400C00410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

4c7c0840-f9e3-4ab1-ba41-b0e7075e9c4e.tmp

Path C:\Users\Admin\AppData\Local\Temp\4c7c0840-f9e3-4ab1-ba41-b0e7075e9c4e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

OFL-PlusJakartaSans.txt

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\OFL-PlusJakartaSans.txt
Size 4KB
SHA256 995c7199cab65954f545996326755daee7b63cc6b42b06c13da1f9502ab08a99
MD5 028e355944f58645eb2a8d190e6b24f6
SHA1 06a13446af986261b9604de9c012035fd95b193d
SHA512 3167472583c4301d1de3369dd9021187dcdb331daeb1a28be89270f44d753f56ff453be3918e8ed82cae92692f6476efda8c3108e3435170a82491beb09697d0
SSDEEP 96:snPUibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:TsMPZW88f+XvR9QHtE
TLSH
T13991D92A3F4423B519C0D242F737E9DEE21A517D33AB69C9505AC16C23A6D2C03FE390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-Bold.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Bold.ttf
Size 129KB
SHA256 14972f80fb151f32fb7129c6ad1893f6dd2a9d8bac30c40508c99e7f289b6682
MD5 1c51d1fb8daa95760a726496b2c5efd7
SHA1 9ea84454ec3da3a53230f846f2f21f284540ab3c
SHA512 ca056108693bec764a70644648539656d1245918ac1932d2c521a1e0fc900892416b85a65582dac4ea1f85fe27d2e9b027989ad98ec6dd0858a30271b8a899c9
SSDEEP 3072:dhXdj8wQ5IrWAZpy/kgkvL//wzIbQLKFisOmmXYUAiFHAvnFK4:dVdIZ5IrWkp3/z24
TLSH
T1E9D33B56BB17D38EEE162D7891F5EBC47338F9583E29C24F94E52E2DA8560D00C272D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-Regular.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Regular.ttf
Size 128KB
SHA256 6bcfbb10639b8a206b4f8a0a1a29459e7255b1481c95e20d587dd1f1a4b24646
MD5 086a38d660fc107d0a20aa9a91979237
SHA1 c0ba4d6c0f708c739f5b69be136e7306ccc4f61c
SHA512 991ce1891178d37526e5a9bf8ac488ee0cec1ad4df997819c5dea0e03b5a98f2ea89e4d5f5e5e65579d419d2e9470d98c7c2db6f44f97160eca7ea745ef71d66
SSDEEP 3072:WhXdjqsJwWk4SBeoPNFQvQvOfEDIwzIbQLKFisOmmXYUAiFHAvntb7:WVdWsJwWk4EeoPNWfEDGP7
TLSH
T1DED33B23FB5BD38EDE111D388175E3D83B29FA65AB36C24794B46F6CA85B0D00C57298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlusJakartaSans-SemiBold.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-SemiBold.ttf
Size 129KB
SHA256 de75ddb3917c5a3f2b7d0cd65fcf63795710f2e1fd944199a73a01731e66fd43
MD5 94fe9cdf95a72756739bdf895abd57a5
SHA1 0e0454a943671b35d44c7c704299c6a09c9e0607
SHA512 f77f9a84c6aae68cd6fff197a277e258ea7f833d19fdf1d2b6d1ad970dd7d108d8028e75951d69fed4afef12efc8829f792d79d23d148bd8801f476c5719c962
SSDEEP 3072:FuihXdjEWQBjlNp8b9rXbKyOmOv/DxuQtwzIbQLKFisOmmXYUAiFHAvnr2k:0iVdQWQBjlNp8b9rrWDx1Zn
TLSH
T1A2D34C26BB5BE38EEA073E7881B5B3D43329F9A11F29D20754752EACD85B1D00C533A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa-solid-900.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\fa-solid-900.ttf
Size 409KB
SHA256 fbbf06d7437aa30f3cd44c968380193545a8fc3eadfb7ad897bbb101eefec5a2
MD5 25914cfeafced317e1a0372187fbb2b9
SHA1 54217d79e7b35011798d712a96d1c4ea08a0ca70
SHA512 ee22fdcae2600a3ceb16f562ae88477ddf20b865aeba8f242400d3215ada4ad9b560aa2b84969c9da65f88c687564707f26f21f1452ffa11585e9e145d8454c5
SSDEEP 6144:Yma14LJlyQ0nqgBohapS3Asznhp+vvpt93aGqFHhjqYa89C:7Fly1WaAJrOvht1aBJZ280
TLSH
T15494F8D3B7DD9D06E42339784B405E0F2356A13882558226FF875AAEC5BE8E0C736F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_r1z5dja0.clo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1z5dja0.clo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b5b11944-2945-4b0c-957d-4185fae76ed6.tmp

Path C:\Users\Admin\AppData\Local\Temp\b5b11944-2945-4b0c-957d-4185fae76ed6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f81e8d4d-7f9e-4fa6-a48e-ea3a5b81aeb8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5656_1050731509\f81e8d4d-7f9e-4fa6-a48e-ea3a5b81aeb8.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5656_1300723898\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriftBootstrapper.exe.crdownload

Path C:\Users\Admin\Downloads\DriftBootstrapper.exe.crdownload
Size 322KB
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriftBootstrapper.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\DriftBootstrapper.exe:Zone.Identifier
Size 99B
SHA256 4d537baf004eabc03fd89337333baa78ae94765f171d2cb559340d1f920b74ab
MD5 faeb1b958c59dc536a5a06ac9cfbed1f
SHA1 778964d22496f9b0aa6340fb646e7c919ace655d
SHA512 54a2668591c85a7e5ae1ccfb9717f8f91071e5a04157398d16bfeed9be9e59d738f4ce4eb61138c8aff45c601befef67a44b9512bc08763015f92658740528d5
TLSH
T137B0121B0605F0048748318C11DC570C905F6028CF4443449DC4008DED8717B1AF8516
MD5 SHA1 SHA512 TLSH

Submit Download

Read-DRIFT.zip

Path C:\Users\Admin\Downloads\Read-DRIFT.zip
Size 423B
SHA256 e5066d21e99e83583c9428e80ef06906141b933e665665fc231362dd67ea22b3
MD5 5f31cc6b3980cd537b1b048f39919bc5
SHA1 abc272fd65174902d25a3c3e826721d7a61a2173
SHA512 64cc842507c4308952f21e66f78fc6a90c3c5e1427fa02fac9f6445bb1f7af905ab0dbe50855169c6dcfd004f673568c54fea685bcc72c523b9a192a21e19573
TLSH
T127E0AB20934E29D2D40882F3C0C149A2AC04869F100CB383E07BE80256716A19E0C392
MD5 SHA1 SHA512 TLSH

Submit Download

Read-DRIFT.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Read-DRIFT.zip:Zone.Identifier
Size 92B
SHA256 69a90a3b8639c70ebc1d58b9fd8723329de736eb3a900eb41e4c88ba58f10a73
MD5 a71f986205904f590b21d84f7813392a
SHA1 38aa4d5e2fff0a81842a1e964f5b3a515ae51979
SHA512 50221fbc288cf598e40fb80a74052352ef0faaa95643349fbfd024249b21c123ffedc5f98ee2ef6e1d59e85cc7db6e3285ad9c759ec6e07fe958d04582d49fb1
TLSH
T19BB012170584A805072071C810EC950DE00E2449C9044984DCC050CFE4461E959E4011
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1688-922-0x00000237CD3F0000-0x00000237CD40A000-memory.dmp

Download

memory/1688-910-0x00000237B4BF0000-0x00000237B4C12000-memory.dmp

Download

memory/1688-917-0x00000237CD160000-0x00000237CD17C000-memory.dmp

Download

memory/1688-918-0x00000237CD180000-0x00000237CD233000-memory.dmp

Download

memory/1688-919-0x00000237CD150000-0x00000237CD15A000-memory.dmp

Download

memory/1688-920-0x00000237CD3B0000-0x00000237CD3CC000-memory.dmp

Download

memory/1688-921-0x00000237CD390000-0x00000237CD39A000-memory.dmp

Download

memory/1688-923-0x00000237CD3A0000-0x00000237CD3A8000-memory.dmp

Download

memory/1688-924-0x00000237CD3D0000-0x00000237CD3D6000-memory.dmp

Download

memory/1688-925-0x00000237CD3E0000-0x00000237CD3EA000-memory.dmp

Download

memory/2396-827-0x000001BC213F0000-0x000001BC223F0000-memory.dmp

Download

memory/4556-189-0x0000015B072E0000-0x0000015B082E0000-memory.dmp

Download

memory/5412-1576-0x0000025A465F0000-0x0000025A475F0000-memory.dmp

Download