hxxps://437b8n[.]codesandbox[.]io/#?YmVzdC5jZW9AY29tcGFueS5jb20=

Analysis

max time kernel
1685s
max time network
1692s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://437b8n.codesandbox.io/#?YmVzdC5jZW9AY29tcGFueS5jb20=

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b42791f9-c59e-446e-9ee7-583801d4baf8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230325022913.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

powershell.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4640	powershell.exe
4640	powershell.exe
2488	msedge.exe
2488	msedge.exe
3828	msedge.exe
3828	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4640 powershell.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

3828 msedge.exe
3828 msedge.exe

description	pid	process
Token: SeDebugPrivilege	4640	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3828 wrote to memory of 5108	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 5108	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 4752	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 2488	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 2488	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1996	3828	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://437b8n.codesandbox.io/#?YmVzdC5jZW9AY29tcGFueS5jb20=
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://437b8n.codesandbox.io/#?YmVzdC5jZW9AY29tcGFueS5jb20=
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa08646f8,0x7fffa0864708,0x7fffa0864718
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
2⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff607255460,0x7ff607255470,0x7ff607255480
3⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
2⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
2⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
2⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4442759671904416182,7757517047561823544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Filesize
252B

MD5
4c17465b94d8d7e59e2ccd158b76c077

SHA1
8aa1096a6a060e5fe5a3a1a10086684b741dbd41

SHA256
03cb5ddc292a366bbf3ab766007c38af2ce27baf4bb2669f18156fd2ebd4296d

SHA512
3c01fa48170100b74db1f77022c48d4798a772d098961296d7f865b012a14cd825e737a2b2b6803a8d5f7290de09741d2ccb15572901f2b586ae1097f216e57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
162KB

MD5
4043af37a3392a9db521ff9ab62d9608

SHA1
83828688e7a2259ed2f77345851a16122383b422

SHA256
ee076822f35390ee382cda71759a2eec8f4db2bc18e4e3acd586173c29dab321

SHA512
97a9d37ec02796cbca922559f384e1632c249d9955022578c14e046f2bfd9f84db113cf55899cfcf63fd318fbee050f483d04ae3156220ff2f0d364f989e680a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
e266c644851b1e104f6207057baffc4d

SHA1
5c2207bf6bda38e301f16569a130655fdb3d8e4c

SHA256
93a16a213ae0a7d634e10dfab3b68191a2bf45e49e6e18a0b03d5a4a2067e69f

SHA512
ba136640d1af5969ab18a192bf9688baab985e48487b20b926ea2c21ca17adc7791c0172e904557447d6e45432d6797f54edf66dab4e97b55599a6e2cd834ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
5708e882f63f4743af5f376a579997ed

SHA1
21fbd0cec41b9b272cfb073ab2c82555b3ba15f6

SHA256
eb43826e221cbfc7ec09fd78b082f85d3ee82ae68c4db6f6f3ad026ba8977229

SHA512
a15d9c79332528d0453c27bd506fa610de0a385568a8fc7c535cda4f1279a6a333d1040ae56e213b99dc8fc425fa51cb43374042a1d53515778e4d283cfce475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
4b2767626553714d6d0e9d83d3acb052

SHA1
57c73adb3bc687d857ed7b1d9e65fd4124cd218e

SHA256
a722e55557890cd720c35b37514c9d69d8783b1def350b7dd34315fc8eb770c1

SHA512
95a2075163ec302ab3963b93953690a1b7e14e2011da5261e554a5868942beab70edfb17d7d1530bb8123b485f468ffa6393eb37191a3d718161ab1c958e12f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
2ceffa63566059d95bb4b86f1adfc866

SHA1
b1f4edac2f592ab1080a350c3f07dd828b7e0dc2

SHA256
f09cb78b389b8b8d82aa68fbdfa7f6bb099d59f2fbe1a7d7dadd0732e8caaad1

SHA512
4b044b6680256927de4fd93519cfbc605c72fb276801363d95d96fa5152636f21c3a78cbc58ddd6b0b20e1693d3e7eb201bcd6e2bd04a9035a1c1249a7d1e911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
8357ea42d1fdd91521da256aca7b1251

SHA1
0bc3aea1a113c1a02abc2ab511ab61c42fe3d1b2

SHA256
62f1d3bcae5fb61e8ae780949eb93f5ffa33cc272bd2c8440cb040622b024da8

SHA512
e5a145bd2a41d4ebcbc09c023228c15862b0cce44ed291e9e7f2ce88cbcadeb251fbaa5b8eaba62050a04eca2547a2fc5fc4a38464fb911ee98acf5d3a5391d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
b1fae1747bf47425c71b31fab4aa94c1

SHA1
2a0eb09db3a06ae3ecd73652b41f67f5b1099ee5

SHA256
5967a90e7f6f6814a3006ea3c6c374ac264b2f730f85e8a563a83532f30e8fed

SHA512
1d07b4d76208101067eedfb1f5caaa491c29c1747c6d6750b67c6a9bb691d5cf821bf6789731ce65d4ef8a5e85b183aa2b4c08f0017f1d6eb806ffb5f6a41356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
26fd0d509caad98ce320ccd13a7fcdef

SHA1
1e7297a42e6f9a283a1995ac5f3e16c2294053db

SHA256
3b8fd9df56ed9e964c8c237c7bf6f9aba7f08788d6bff7da4a1d93fd12d1d402

SHA512
3c3ac28c322fff3af50a283ceff91b7344e5d15c879c8a4c89be5171ad97faa12c6373df9dc48ef042a9b38e748f77b47c18090f36e47a7b435e9cae0b678e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e7973c0cdaecedf2cdd1c97530855d28

SHA1
66e629d1c01ecf8475d7570d863b47ec90b00d47

SHA256
96b7fbfef47be3890bd2fd0945d85ecb666799612c3f21d9df0377a45ca4b772

SHA512
f07a759112b331118daa106501c5406d3012702d396d73c2f05f2f5fa1a38caffa9ae6e0ae90c0c571e92c599c5d36f44539b965e616c8932f0b5d043cdc29c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
367f3b84bb213d7f54bfea6325f33143

SHA1
8b84dd23e107b4dd80c6ff2b6635b1a00a67575c

SHA256
73a5f9c5fea6e78122e5ab4a4c224d58f1913972d54201d71214cc8626d6053f

SHA512
e6e2024de147aac56632078e706df91f248b3e76ba4a96d443fab427402ba940c9bbb431330db0f3d13d4d492d31b825632833340039893c7f4800cda6898cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ebaac2ba9b1d7614daf1db5b67569981

SHA1
90204b536cfac6cc5ff5edce9584e27c7d7e8a32

SHA256
e0a07247c3e5792bea7e558595bb898f3e0d97c49379eef0501a91f82a619d5f

SHA512
4f237270e726f1a5718df9365e68f342640bd8ea843d57a4e69b993dc90e4948b4fe57700fc5eba8f4887e1e35694e21e4e9d1889f39abc70eeca9dcfbde601b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
936ea63afce000b4aecee5caf90d695e

SHA1
8f1af15b19ba282588812d9011cf2c72a9defa83

SHA256
5a378e92c20669f207381cc953c5a642612eb69364b757afe6d33b34a8760019

SHA512
30e3e279f1b702252174f238eea25f9908cbc7562ea3f359ce499c4124d4164613a173e4e80f5b667c9ab0abc91ab1dd8fa6a6a1a6d68bebd5e68acfe2d17f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
7f2589e75e9fd16b71f04bebf81f1da0

SHA1
64e08bdb6801213c3dbc123d0ef02860bf74c20c

SHA256
620be97656d794a73e0ed35b22f00fdc95e486cca447296438ef31e0e276ee58

SHA512
b137b63c0e30aaf89dee328ac5a6e1f967b0a89a358aa12ce470c9d04fa78787f4abb47d7247b5ae8e614f442adcb9a85506873d65b911a02fa05049fbe05615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
276caf6210d2b3cd6554fa8a09394893

SHA1
9fde8716a4c6cd3527178c13360f3fe7ed3e126e

SHA256
e371c8501f8d4661ec52711033f4e0a9b1d9c7c00155ad508ba4cab1b8b9d252

SHA512
0a319efe0d2888898cd59cab8dbcdfc9e5d4572461f73e134b7dcfaa3dc1b317e651cc37575d8d386373fcb0b0b41df15c3aac8b59a15b8a7d6f049d22330c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
1b391d1cd85bf69fb266a49d1f49bebb

SHA1
c43aefedf4015e8283c63a51f32dc89385c1b22a

SHA256
0abbf1105e3cd4bec80657bbf7f469c831441c966e44bb675996acfd3cf2caaa

SHA512
c53035aea40856cd5062014b4c14bc25f1708308f6985e51351ea2a06c5d121c771dd8d10f3eac97dfd524b1d28d176e13516823b8610c6fe1cc986f83a0e94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5732d7.TMP
Filesize
539B

MD5
222f3b69499cd67975958fe232f092dc

SHA1
bd87c2d5de2c6c9b55aa6820c595155485012782

SHA256
6f394b008018066cb7e0dfb0ec8ccc142ce49bf060793b7e2e4fd98e6dbce76e

SHA512
d375182d38a69110b7e24bdeda4b4441f9e78742fb9b0aad6478fd5822dc114a1af1ef240531a7d141045706bdb36805d4a1a4012e178092b0eae1108a6cc76a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
9b8ceb3a92b2e119b71c1c0cfd7c4750

SHA1
2a016eae3bb037e677cd7d7067e606aad3859649

SHA256
9296432cdda1f81859f183023b018139979eb8228fbc1dcfe0ebcd74afd1f948

SHA512
f18efcadbdede57908521f2b5a0cfaa8db14c494760fa792cf72fdd4cd26d27e46c167687dd3d29e373411e60835cb64f011849d2eb686fd519e764ec0a4574d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q5gthpip.dvs.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
385ac6bd3c50f1bbd02fd40d0250da41

SHA1
594f6dec1e97877c52b22ba73f2fd06e099ea2c3

SHA256
eb50721f53bf16ce318972f6c925e2d44d861242eb25e323e1d498f7875e42f3

SHA512
8ea18058a66e1723588fead2411764913110ffea0ad1ffd1460e2eeecef7dfd16ae0e7eb57473e113ed5f698600aea012a662bba0e4c2cf023d7b2add10fc715

Download Submit
\??\pipe\LOCAL\crashpad_3828_XNSEMEXMGOIBHRTU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4640-134-0x000001E7E1230000-0x000001E7E1252000-memory.dmp

Filesize
136KB

Download
memory/4640-133-0x000001E7C61F0000-0x000001E7C6200000-memory.dmp

Filesize
64KB

Download
memory/4640-135-0x000001E7C61F0000-0x000001E7C6200000-memory.dmp

Filesize
64KB

Download