hxxp://my-gov-review[.]info

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2023, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://my-gov-review.info

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1e2ffd68-c3b3-45db-b5ea-cba9b32dbc8c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230303013113.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4324	powershell.exe
4324	powershell.exe
2936	msedge.exe
2936	msedge.exe
316	msedge.exe
316	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 4536	316	msedge.exe	87
PID 316 wrote to memory of 4536	316	msedge.exe	87
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 1520	316	msedge.exe	88
PID 316 wrote to memory of 2936	316	msedge.exe	89
PID 316 wrote to memory of 2936	316	msedge.exe	89
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90
PID 316 wrote to memory of 1604	316	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://my-gov-review.info
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://my-gov-review.info
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc3e3546f8,0x7ffc3e354708,0x7ffc3e354718
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6625a5460,0x7ff6625a5470,0x7ff6625a5480
    3⤵
    PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14813667812095088708,2384308591744040018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
798893ea14a2f338eefbd9b6d66bce72

SHA1
a57f9451cf2fd9e4fbe9e1f0039a878a56116535

SHA256
d62eaee0df84e2d4fd8f33841d99022f6954ef0449f8b76122f2da7558282142

SHA512
ea0a44ee09152e07e19c00c05461faa0842558db8eeb87f60882d43820059154d0550b40952c2d30fde4ada8fc58e63b725ac0272f9a99e92852eca7ac15a390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
eb59dcfb86f13da8300af236d5df18bd

SHA1
2db5ca053a532c8e59a6f5d2e42270e6cfd3af09

SHA256
76d6d3645715a2488951f5a2dd58f03061f32f4988e1aa76e92ff33c9c307844

SHA512
6cceec7a7685f42077a05ee83315ca4c87e1dfb6011d8a381ef413bb03358024605cc3e6117158e6c1186484162849827cae4720783946d85dc36dc6969d4988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f116d51bb3e53eb09439cec5f49c95ea

SHA1
d221cabcecc90ea356de14fe249e2fafc0f6f691

SHA256
05ac90f07ae7764787bd25fa6bf2ca6584c30e314532b8f6e4e5c430ad6de04c

SHA512
186393edeb4c0bece47cd4e3c7ca870488c811b13478cb71a6835eb943eab9eb3e0b92b62a16ffbff2d5ba0f7ea3bc7c44fdee215dce63b555b9b608336a5da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
518B

MD5
22e7f6c24ca6c6bea6947b2354567073

SHA1
0ffd553a586a12832c9189ca23f5dc183c3bf1b7

SHA256
d073926e3aa496fd51633d22bb7d7cc7948244e236c13eae6fe3079ff58562f3

SHA512
678d104a7a8eee5cef8ec618b549190f1357e631dc827b46eb0fe35e72dfad11e34169e56450cf25f0fee7f43f41a02808a99ed31cd420e7e27922ef5b704a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
4cf933129600fc65ae9c45db8e498196

SHA1
883fd872a17ff4316c6c08f4d537f305aaccc9a7

SHA256
b4d8d673a07508619c8e9282a33ab79d4445f29d74b384cc3c63e08cec5f95b1

SHA512
0fea7c58049dec21aa580f44583d8224b08f5a61ed8b6fdc09a7e73e243b44b41eae4f7403f52e931ff3fe2bfb97792b0b2e18364145176ef28e5ae76cd3e6a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3ee09e1637064ef9f9a6b37b261c785

SHA1
71b3064d351eceb82ea85d99a393ce64d6f87e64

SHA256
e6062ec9ec5d00946ce017c2e904732245bcbc2429e8380eab1744a5ac65d49b

SHA512
b34b31acde281aac4e19513fb8376473734c5639341b2427c97d28424722ad042df9cc755b024d8aecfa1928a9bb60900383182993da1b747a99f144bcffd838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
638d07bb4b2fad690108ff231de4a5ad

SHA1
115b58349f30c15c3a716f0b7f0ebde9d5321a05

SHA256
d6c6f0c228f07157eb4d94d548e8965bdb39483803081e71fdeeec2d6ea195d0

SHA512
274ac6a6aa1da49df25d87b5e7ffd7031abcd52d2ca975e7492d9442d22fa6df11e84ea812e21c41b6e50d7f962a00b5ee87defba686c2065479c98678a35ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
a049c87e60ef276154c00aec28eeae8f

SHA1
5d65c53c5d6b0f035232f4201a619b3db792ef5e

SHA256
0cf200b1407392926be4959922e9ec071ba77eaddc3dbc3aea21374d50b36a2b

SHA512
45937e30233b7a6d35413f738b301cc5e8f44ec8297ba9e0d4360b65122ae716c7cd3a508c6bb4d07cb06d62f183f6905b9cac3228583fe026affd0ddd68ae8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
08d4988e165616628a382e5826667b6f

SHA1
d06aabe381bdee38c5766d0af8a9f7e00867305c

SHA256
efe268bd722f9ea515251a3155e9aff2dbf84b3329b7596de4ad0e1f597892ae

SHA512
58e613caafee00b89bd6def67f82fb42a64ba9d245720ec7ce602c7191f125260cb5b54fef898aa4fd0f51511d6c320491bb4ecb793b159161cd353e1a11cf13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
5KB

MD5
196b6a43f7630a51650d555058a484e5

SHA1
4a1dccb4e94791f45ee4f02c0bea2e27f5ef086a

SHA256
7f95ed660ef38084da473a72a937dd1f3c5adc26b6e9879b1992783b90c3e485

SHA512
10d89f9847e8600161afa7996006030369daedc86cd3b459a5ddb002c0dc4c2d9b7349d19069d3fe54f441acfd34714338ee87770939b16a8c5b25a652357f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_le3g4owf.maz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
cd776898f1efe5348cbe79a97c182046

SHA1
6e89bfe26c693497788c64e75ed82bc7dc9bc69c

SHA256
ddc158eea438a6c85bb3fb81e55d7fb95bc2592a27a0b9fc81e46cef54366ba6

SHA512
6575ffbfe4cb7d298cb825b828c97c0b1817c6c4823a0d7187ea789fed5439f5493c04c4270808a0485e5b6bb3a2b15492983a524cdcbc3cd348e6426e2bba70

Download Submit
memory/1520-158-0x00007FFC5C360000-0x00007FFC5C361000-memory.dmp

Filesize
4KB

Download
memory/4324-133-0x0000012366340000-0x0000012366350000-memory.dmp

Filesize
64KB

Download
memory/4324-139-0x0000012366280000-0x00000123662A2000-memory.dmp

Filesize
136KB

Download