hxxps://sk[.]porscheservicewoodinville[.]com/lancaster/lancaster@clp[.]com[.]hk

Analysis

max time kernel
257s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sk.porscheservicewoodinville.com/lancaster/lancaster@clp.com.hk

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230329123421.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\919d91eb-703e-4a5e-9761-a8b6e9f2e129.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

Processes:

powershell.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1520	powershell.exe
1520	powershell.exe
1468	msedge.exe
1468	msedge.exe
2348	msedge.exe
2348	msedge.exe
3164	identity_helper.exe
3164	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
2348 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1520 powershell.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2348 msedge.exe
2348 msedge.exe
2348 msedge.exe

pid	process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

description	pid	process
Token: SeDebugPrivilege	1520	powershell.exe

pid	process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2348 wrote to memory of 4420	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4420	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 4852	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 1468	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 1468	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe
PID 2348 wrote to memory of 2476	2348	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://sk.porscheservicewoodinville.com/lancaster/lancaster@clp.com.hk
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://sk.porscheservicewoodinville.com/lancaster/lancaster@clp.com.hk
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3e6846f8,0x7ffe3e684708,0x7ffe3e684718
2⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:8
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7cf935460,0x7ff7cf935470,0x7ff7cf935480
3⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
2⤵
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5940019637758171987,17649309652605555881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3368 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6506a09f-a9dc-4c31-8a2a-ca72a98d5582.tmp
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
c864f97c86e064a3f52f04767216ed9b

SHA1
faa0e7c9fa73c6f9170263ac5926ac5300e3bb9f

SHA256
85ccfed702c1051a8a8d60960e894cd06b6d2fa91ac57c7b469d482baffe7ecd

SHA512
fe8bb4f5c49011190839210fd5d5ab0f96515bcdccb7bc60d7a56ae72d946476a70ea29c4c36f65bf01aef8db0c7fbb198903737c26aaa6981a4035624fd4ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
3f3643afa51293f1a78f02c3f7f8cdfc

SHA1
5dbef651a779521525b4b579aff65bbc985f69a3

SHA256
1889cefce667cc033a159d8565735745a87a8618196f5d50f9c35c01addd1cce

SHA512
0e44500364bbd80637f43541e3f44ddb08067759ea3337650c47a7775acd74e9e533182dab9822eeabe2b2170a88909d4cca78de7d1aa994c4afe6667e6cc705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
f0e7b8ba2fa219b7ad7d96c316adf634

SHA1
e9e964f556862af67b59681c190fd68410d409ff

SHA256
68d5ee403aba793668a6df97b69db8652535c10b88bc4900442a75c6a03cfdbc

SHA512
218fd80836146793f42953a5f7d7cb8cceecb28b5a3686c3eaac9f2e68a66c5feede23262216ed1260a44fb40f80b253b7a07c9d574a86cb6f74c5d7fee1f304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
996e884dd3507193cf3143d833716835

SHA1
ff394adf7a71eefe08b00ca8045805642a982a63

SHA256
52f6a7b2050421f6944649510c29a70e31cf513741263fb4f1a7cd726f3116dc

SHA512
7a7e0cf97aecc181613a1b8e3a4549e9f5cf82dceaaf4840be6a03ba20074ba6306df3194bdc6606f08fa6d638416a29616cfe0774a72dc948ee93f557bf662d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3cc95da9ad403552fd270f53f1ad1eee

SHA1
80c85e88dd7b731658ce5ec9bfb5d0a35647b4a8

SHA256
b853b4e083bcbc48a2acf49ebad8761b391a7af16830f386bed4d71aa418be8b

SHA512
1a66f6bb55e8f113616b3a5a13db245585e3a9855da802041fcd8ab88ab9766d40b2c9a02c224561949efa45a5c07c86e6e0e68be3856ffe4976e649018b3a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
76d407bc61e0a1bfec4100cd598c5927

SHA1
6957062bdf219c5c9bbcc11b47a8aa9399c2d8bf

SHA256
4c2ffb174baf2b152251e869070e8e7f81f5565cc4548f20949400fc3e3a052b

SHA512
0d8ced140534bbfca5aa9a6f733fa1f8a4da5955cbf5b12b26a70d06297e6ba3bf07995f4a7658b96ddaadf3d09866d696b7d2b2a84ecc40547344ae26471c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
e323b7c6df49d7872f912b255730cc4e

SHA1
f5f9c752f38a047a22c07cef894d4fe7850bff49

SHA256
90eefae931dd5729210f2037981f4aba2c72f756821bfdca4fd39c9dc61ffd31

SHA512
164eeb4de3b0ffe0d559989d70b9864a853f863c3994501424e29de2451cc66c9784b7ab81ac88d29a8ad93a2e517d6dd11cc79378f5bbb182724181d9468cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
09e54662957c661127defa5c74ea99fd

SHA1
6fe21ea5c3c967be80038fdd6b4b94ffe229c6c7

SHA256
312bddff5996363e2dac18f0c0fc12458bdd361f2d0318a8123618ffbf1803e3

SHA512
2c7cb507c3a6f26cde1c192de06e6b59eda041acf84ed0515f156bf1090097d810d447ece3028160ae8843b5bb2628a32eb52972cea8890debb9edb068baf6f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_luivqvnp.fvd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
Filesize
2KB

MD5
1e4fdb001d640bde7a80d13d5a68ea4c

SHA1
2e080c7ebdb324d8128195f02fe582048d6a6e81

SHA256
176376abdc71a187c4dff3fe1a9a8fbb84e839771579ec31cdd6829167b974e6

SHA512
4240460f23712047c66f75ce5fcc0070b5cba847db4c27bb53a44c6c2d2baf75d7b1ce2ae2a59a08dc9095f8a38738c331491d165386ac51a6a7884256107cae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
8477a414e30488876976ef5d155ca9c1

SHA1
c5261bb768b097f2ef4bc0ec3dc7817f959cc471

SHA256
5d9e8ae153de7caf7edceab57682904aeec8e7a0b2ae2a7429598f3f8b8dabba

SHA512
260dad023f580dd285a715d851219095eb2a8e934e8ed57f5b41c161a97319e5e4f995179e56b41bc0aabd6e7d1104f3c3b7a81d7d3b70f5a8b5cb2b37fc87ff

Download Submit
\??\pipe\LOCAL\crashpad_2348_AEHYNQWXHJFGJJXH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1520-145-0x000001BD700D0000-0x000001BD700E0000-memory.dmp

Filesize
64KB

Download
memory/1520-144-0x000001BD700D0000-0x000001BD700E0000-memory.dmp

Filesize
64KB

Download
memory/1520-143-0x000001BD700D0000-0x000001BD700E0000-memory.dmp

Filesize
64KB

Download
memory/1520-138-0x000001BD721C0000-0x000001BD721E2000-memory.dmp

Filesize
136KB

Download