hxxps://usersdrive[.]com/hustflx4zims[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://usersdrive.com/hustflx4zims.html
Sample260818-mltvaa1ake

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5080	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315228257259213"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{51C2D0E5-4C92-4841-ADCD-55AE73616404}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1132	4720	msedge.exe	86
PID 4720 wrote to memory of 5080	4720	msedge.exe	87
PID 4720 wrote to memory of 4128	4720	msedge.exe	88
PID 4720 wrote to memory of 4128	4720	msedge.exe	88
PID 4720 wrote to memory of 2992	4720	msedge.exe	89
PID 4720 wrote to memory of 2992	4720	msedge.exe	89
PID 4720 wrote to memory of 2992	4720	msedge.exe	89
PID 4720 wrote to memory of 3452	4720	msedge.exe	90
PID 4720 wrote to memory of 3440	4720	msedge.exe	91
PID 4720 wrote to memory of 3452	4720	msedge.exe	90
PID 4720 wrote to memory of 3452	4720	msedge.exe	90
PID 4720 wrote to memory of 3440	4720	msedge.exe	91
PID 4720 wrote to memory of 3440	4720	msedge.exe	91
PID 4720 wrote to memory of 3584	4720	msedge.exe	92
PID 4720 wrote to memory of 3584	4720	msedge.exe	92
PID 4720 wrote to memory of 3584	4720	msedge.exe	92
PID 4720 wrote to memory of 4244	4720	msedge.exe	93
PID 4720 wrote to memory of 4244	4720	msedge.exe	93
PID 4720 wrote to memory of 4244	4720	msedge.exe	93
PID 4720 wrote to memory of 4180	4720	msedge.exe	99
PID 4720 wrote to memory of 1940	4720	msedge.exe	100
PID 4720 wrote to memory of 4180	4720	msedge.exe	99
PID 4720 wrote to memory of 1940	4720	msedge.exe	100
PID 4720 wrote to memory of 2580	4720	msedge.exe	101
PID 4720 wrote to memory of 2580	4720	msedge.exe	101
PID 4720 wrote to memory of 2580	4720	msedge.exe	101
PID 4720 wrote to memory of 4000	4720	msedge.exe	103
PID 4720 wrote to memory of 4332	4720	msedge.exe	104
PID 4720 wrote to memory of 4332	4720	msedge.exe	104
PID 4720 wrote to memory of 4332	4720	msedge.exe	104
PID 4720 wrote to memory of 4368	4720	msedge.exe	111
PID 4720 wrote to memory of 4368	4720	msedge.exe	111
PID 4720 wrote to memory of 4368	4720	msedge.exe	111
PID 4720 wrote to memory of 4192	4720	msedge.exe	115
PID 4720 wrote to memory of 4192	4720	msedge.exe	115
PID 4720 wrote to memory of 4192	4720	msedge.exe	115
PID 4720 wrote to memory of 3468	4720	msedge.exe	118
PID 4720 wrote to memory of 2568	4720	msedge.exe	119
PID 4720 wrote to memory of 116	4720	msedge.exe	120
PID 4720 wrote to memory of 3136	4720	msedge.exe	122
PID 4720 wrote to memory of 3136	4720	msedge.exe	122
PID 4720 wrote to memory of 1964	4720	msedge.exe	123
PID 4720 wrote to memory of 1964	4720	msedge.exe	123
PID 4720 wrote to memory of 4404	4720	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://usersdrive.com/hustflx4zims.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,437107415131954917,11751941769257635753,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,12837326614988515354,89837581165988936,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,18067607323295775317,11300245662440289906,262144 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1347830906108699762,9077703096360385694,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15056457309180316578,6614513729177987772,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,11799083983913404751,12826705291781230608,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,4488605658616326649,17333904572825230859,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,12054334863183460767,6339550493926858467,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,16771140283923169343,3036952776464993856,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5444,i,12074927218300231931,773257478450600237,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15882520340180988433,12592755980436573390,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15882520340180988433,12592755980436573390,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6028,i,12511368067078271306,14351887093583625210,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6216,i,14538954235866640681,8002942700138891739,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4244,i,9878834973165154456,9592242657454099401,2097152 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,12412403220322149387,16003401488646501491,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14462213721575871727,8785116508935448842,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,18319796482390571489,11729712104163910812,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,6676727285356719731,6461539419970464558,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,10093976696717457423,8959059583964594348,524288 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5132,i,4010678265350579425,17088748401231304930,262144 --field-trial-handle=2308,i,15889873764620829994,13283016715218761602,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 115e8261b870b5794e803ba059173f775c071184fcdbcd781748cbab8262fff9
MD5 a9f233b8f3d6f5260c34545087caab8c
SHA1 37bc1a00e9db287c9c45824fedbc082174db96bc
SHA512 ddb090caa55bd2f2b01b3c25ac9e4a4f892b3d793895d3c97b194c7f086ff8f4254af368fd3c771910cb84e3bbc1577c0f87a056b9abacc210191d4ac813bcb6
TLSH
T136619570479EB4E0D32D09F0C9E2C69A3B7443C8FB4B5F7606715F32A5263A60612F48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f73.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592f73.TMP
Size 2KB
SHA256 7912e46876b76b3708c4cc34977e5c02b7e2e416b914ab30cecc4267b6ae00cf
MD5 837f0163c37509efa1c27e8c0e51372c
SHA1 d2ba80b8c0e1587f641b773fba6943bfc7186e98
SHA512 aa01021a516db3e30363c09aa3103992bc9f0e4c8bec15f6300e3eddd1bf175b3aeb634e5e6ca16b9cc331098922afc6207aa267befa09aa581177131ec6dfbf
TLSH
T1EA51627047AE28E0D32D06F0C8E3C6993B3593C5FB4B5F3205701F36AA267A90666F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cc3cc3a2e2e90d379a5b4d055c6528e092b504f76c49158f6c222211ec976575
MD5 aa7ddee233623c5c2f3bfb2dd8d2fdea
SHA1 86b07e180b653c0c678a5a1ba47f5f5af2353fa2
SHA512 c5bfca3da35f55681d0d9a891e09047a79516404226b71b5d489eff26eb402f69a017f41cef0e2a1e35254619138601cd81cd44d912d9aaec4752715fca41a57
SSDEEP 192:D5qSD7YSW21At0XFlCNNHFswQfjYRlxspancnpWr8+nZlGT/T:D5qSD7YSW21At0XFlCNNHFswQfjGlxsX
TLSH
T1AA028BBAC7E4876ED81912F157247D26CF6D092842283D678EE5FF8F53E24B1D201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 eb72a4c607b93968487affe69d57f56acdf1469e2f4d31a8e79b504b80fab020
MD5 f8231110c43c7ef2600d0197d4586dfb
SHA1 b668fce91d526ca32e18d5419bbf9f6ff2a18925
SHA512 ad9b5cf6feacc9b2d2847892d5761a99f8943d2ff0aafd54f9b8c772dd4989ad743220b5f3d312cfb3f1a7a9eb1a4d2ec232d53345cfd474c9e6998003c781d4
SSDEEP 192:sxZaRJkOW/fFs8L+tVIdp0AHW6+WNjaSx/Y9I6KndIgrJ:sxZaYOW/fFsS+QJHbbx/z9
TLSH
T10922C8166E38A87B8CC7E319BB25BF13D2F9503191D51E58AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 13f0611299eb06ef5b2da63082e54ae073635ac7bbbd6bdbeefc238a4de3caa3
MD5 81f5a57a022dd89baa09831b551f6eb4
SHA1 b731029c7c530b3a9f87570c7b2df5c588788fb7
SHA512 034774fcb241301653e5c2bd9df180ada7e7852d236c831b7a002f407faf9102be4d05c5d18695a99491bbcaf30f9f928ade62f8575a7c29ff852ee4c1c859b8
SSDEEP 192:sxZaRJkOW/fFstLcXVIdp0V2HW6+WNr7W0x2aW0wSxbXY9I1CyndIg50J:sxZaYOW/fFspc2fHbdzdxbXtN2
TLSH
T1B432C8166A34A9778CCBE319BA15BF13E3F9507291D01E54ABFC8A1C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c52dc3b6b7e88afbc86bccc8b1b43744af2887e45d233231e38d16c3e28bc42c
MD5 b3745b20604d210ae9fbef22d3ea7ee5
SHA1 192d4987082bfb25b4041a99e1ccc3a256ecbf62
SHA512 a1cfef0751a96327a7ec7a4e890a6a94cc9942bbb3bc53a93f3bb37c0b108fd6f305e9f78c9bea7b703409996e5134be1bc79b8cbc2800effbed373a59cca9ec
SSDEEP 192:sxZaRJkOW/fFstL+UVIdp012HW6+WNy0x2aW0wSxbXY9I15KndIg5eJ:sxZaYOW/fFsp+7vHb5zdxbXts8
TLSH
T1D632B8166A34A9778CCBE319BA15BB13E3F9507291D41E54ABFC8A1C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7f7ebdbeeab78a880485e41cd9ebb82cf7502f0ad62423fdb32ff502904dd848
MD5 7485424f0448b7cf22554337dbb77a93
SHA1 4521b0ad05deaddb786611ab44abfe911f61aa2e
SHA512 7e80d5650d2f23e5114e80c97398432593cc0f9ffa0ffd14d4706cfa925ba0a91e6b894f05750544340a2407ca431b8fbb93d07b2f2f55693544790a6e338138
SSDEEP 768:sQyvIZwWvu+I+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7LronbOi:sQyvIZwWvu+I+u1jamFLeR74nj
TLSH
T197C2E92F240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047F9994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd6f840721a867cedbe02b39aabffc0af98339fdb9e4087064a99fb19b65ccfe
MD5 d259fab65d5c3decfb0107c20f27b31c
SHA1 18cfc61414172fe0703302b8dfc954d38b566719
SHA512 449a1febcf1c5fb1933b4e8dffd049bcb73ed3db358555dd3ed75a64b29377999ab4bb3d625c36c99ffe2843b18516c851b1412879f7430814b879dd108ea067
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWK/QQKZS+g:mTr7Ybg
TLSH
T1B1919501747A06533C7F680CA3A6963A5F4235A33458E86F7BB900A28F6BE115DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5966bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5966bf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 67e74d1626a30d8e8ff0f77d7d2a534872afe9e26a6b43c9f8dc926010ae3d54
MD5 b4a747d5de8252ae735fcd2453ef68a7
SHA1 3fe3bc46ccd381e5faa6db7040b958272ba1be43
SHA512 de092123be4cada503544b507055eab9b7d6466729870fe564f2c5b35f4560a10a26171ecbdc6dfb76de971e7c477ceed4ce52e0c06b3239b9ef822b5b4bc2e0
SSDEEP 384:E3yFaeO8WsNftpnziXTfe+CfOESJrt+Cr2Yq9m6BMMj5k5f:E3IzhWWzuGnOEShtbaX9m6yMA
TLSH
T1FA928D36B8746CBAA9A2A540F5073217AFB4406BD5D53F94D5DC6F0E06CF19C230B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a752eb00dfde09670e1cbb803386407b94757432f77addf5243f008cd3ca00cd
MD5 3f0fedebb2c87d9d6cc1211b7dfc855d
SHA1 0214f6aa95670a7c5855da292bdec1dee3c0b568
SHA512 227b40243b5fb880901e80676b35903b2e480895e281dd7e2ddee153c329811576f37164d0cb49ee6b59547a425bbb447491442fde99148d2d2d4adf1d99a0f6
SSDEEP 384:piFZ3yFaeO8esNB8TUNTUlIlUpnziXkg2e+CfOESJry+Cr2Yq9m6BMMj5k5f:AFZ3IzhecwgqzlgBnOEShybaX9m6yMA
TLSH
T14FC23BF658E3587AE9AE5743A73E3E039EBCC067F4942950B7885A0DCD861BFD306901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6def5691bfd2f4c97d7d4cb47ab29c6241206b5e2a81c4e6b06582940aced5d0
MD5 a93f6dbe4ecd0ccda32e4ea7769206f8
SHA1 d081092dc94c9c47e7ee27723fe274c7165f0d9e
SHA512 56896902b465b1ae76e292383e4b9093dd4e7d43576c77f8f0ae623a81d5a0ff348a0bd838cf06695ef0dad41d2a94dd41c1b1746e6b8b09572a51eef3fa80bc
SSDEEP 192:JONys6v+YLNQmiUyNzZh+CGSOImWusw4U6:JONys6vz/IZh+CfOuVU6
TLSH
T1E5020A35AD682C6B9FF2AE45F48737175FA8213BEA952F80D9D82F1C01D774C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02d53652bcac7aa01d6e2bdb38c7c1038a3ceb959663a26bee496093689bf1b2
MD5 8a23a39b107553472526ed96cb94492a
SHA1 c97c3b49d3349069a82e2cb35bf0e24dd0210042
SHA512 4075a790a612a8cc6e441d825dce1e2a5bf0ca1d6f8f4dc4434434f891d2ca4db26b821ca41a07642f1ffdee1506cb07a0350886f1daf73e5dae7f81a95ca1a6
SSDEEP 192:hONi6v+YLIQmiUyzz9h+CGSOImqnSJrPCH2qNwCLU6:hONi6vz0E9h+CfOESJrk+CU6
TLSH
T1ED121A3668786C7B5EE2A580F48736135EA85177EA4A3FD0D5DC2E1C02DF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 eaa7d48e5ed57fd7e99d1cf11a183cd2c13cfaa7f87527a3e9472fa5838c77d2
MD5 921c893c531c94ef7ace1c8c2968d1b3
SHA1 96e480c99c7200b913754f1c9d44698399dc177a
SHA512 1735f3f17e1cf15b791fa884d6f01c54a3bab2cdcc046f3cd0e4efb7d0ae5d3692d1c8acd8d88a7dfa0ba0add79266871ac2edaac03afeb6e290d10729db6f40
SSDEEP 384:N3yFaeO8WsNfUpnziXFg2e+CfOESJrt+Cr2Yq9m6BMMj5k5f:N3IzhW7zEgBnOEShtbaX9m6yMA
TLSH
T1CC929D76B8746CBBA9A2B540F5073217AFB4806BD5D53F94D5DC6F0E02CB29C230B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 94c4f652d6438d22b211930794cf23dc1be1f500cb0ad4e33994f558e90d6559
MD5 3ed12769eb1fe290ae75eb6a6575eb81
SHA1 6ff357a7f7d54f53bbeda9beaca06203006804bb
SHA512 ac0d0272bf1dfba3fd8053c714cdccb4ba07fb7fa29e225c6ba220b71bd53fd5f3259839c5223fb1988b318f5faed7e738729c38cf6c9478a3868d9c2e04674a
TLSH
T121E00202130001AFC474033050933B352AE68020027202455A3001691C273006F21BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e673.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e673.TMP
Size 392B
SHA256 68070617d2854d8a6427f7326b37a9c36bdac489c4d349219693caa7cf45993d
MD5 65b6d118ce16f48781c61c3c388f3ebd
SHA1 ed49847aced36e030cd8525a0b71aafd04d682df
SHA512 00e84de5cee53fdf37b6dbccb655bc4573805a2167aeda754ecb138ed8b9ee9c42361991c3dc506177fe3e18198791b987be0db69982588f516b3e9f881cdb68
MD5 SHA1 SHA512

Submit Download

30a6176c-3784-47a7-834f-3906ee756fad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30a6176c-3784-47a7-834f-3906ee756fad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8606ab8d1e05289047b358b54d8f9d33c8a037eaa098f25ad8b2aa560ffeb902
MD5 c34f34942e3661277d3aab9674575bc8
SHA1 80c732f46078d4dc00a2bb1c6841800ac15dde0e
SHA512 36f9ad32dda0e3d6d2fb6d80918aa0311194270c0d99787e543f6db41fcc91c21aa52e5dc5cc54e85c42ae8fc71d2252194baf3d10022b25264b0795ea8c85c9
TLSH
T119411B58A6ED1108B3B37E1AAFF6A81E447EB8772F07945D00110D4F0A32B00D971737
MD5 SHA1 SHA512 TLSH

Submit Download