Resubmissions
31-03-2023 17:55
230331-whl5psde7y 1031-03-2023 17:48
230331-wdf3wsde4s 131-03-2023 17:47
230331-wc4gsscb74 131-03-2023 17:39
230331-v8eymsdd81 431-03-2023 16:18
230331-tsdvzabe59 4Analysis
-
max time kernel
315s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 17:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
Resource
win10v2004-20230220-en
General
-
Target
https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8a44ad30-092f-4a39-8cbc-1e1c7f1d68c6.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230331193955.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
Processes:
powershell.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3480 powershell.exe 3480 powershell.exe 2596 msedge.exe 2596 msedge.exe 3928 msedge.exe 3928 msedge.exe 4416 identity_helper.exe 4416 identity_helper.exe 1880 msedge.exe 1880 msedge.exe 1880 msedge.exe 1880 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3480 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3928 wrote to memory of 1512 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 1512 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 980 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 2596 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 2596 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe PID 3928 wrote to memory of 5000 3928 msedge.exe msedge.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9874746f8,0x7ff987474708,0x7ff9874747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff76a695460,0x7ff76a695470,0x7ff76a6954803⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8405367616461219808,68066032769997871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aaeb1f5e097ab38083674077b84b8ed6
SHA17d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2
SHA2561654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef
SHA512130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD551a5d289c869baed45511e594d8a39c0
SHA1a01ef64f1bf389e4b6afda4ff3eba22704a9e70d
SHA2562f3ab8789d2a6435323507058019d0f5b5bbacdb2a2a5222ed241f433fe3a940
SHA51212e7741a34aac8ea330933975fa7465c4276d463d830d82c9746cd571d97dd089441d2706feb682313f4da806e51f17863f7fa33d865fdcf0b14bec1feaf0699
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD5e479ed6e03dca7daf9aa7abda4262b95
SHA1e9d0cde01f833cf4595238bf50b39f361ff03e8f
SHA256e1057a222c315f8bc7ee515b942eeabd25818034c19a0a62f388c14f38996e77
SHA512504599c52b691862cb5ffcd56e600f90a1a0cb14fae210dc895e54860079c1752cf7d08840c82a97941c7c2c351185e0e6c2eedafd3f5d6bf4cd55a3250a239a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD510b6cb24054e5719bc52f3f968cfabbb
SHA188dcfa99eeb10fd0b5a02a9fcc491e3d0187c788
SHA256368440688f5d8387712e5720b47cc81dba54073b389ab7b969d1c6fc6b0e6f6f
SHA51278779b0846ea63f5fcd0898eeb14aa1328cc89c733ab0b24d8241291cfa598e33ad9ce174d18288ca8e9049f594f82601a7abdd709e3848b380b6651afbea4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
188B
MD503da8e9f1c34251a6a9fc171f9972a58
SHA14817ec312c6bd1ce48635f652f4ea8d70a190987
SHA25608bfcc15479ee1cf404d6d0c9aa3a5a1eba16288f4e432b56b66861d88052451
SHA512d8df733d82c529cf321cb5ac9db4216b32b6b6904201207600fec3fcd26c92e550520335e02ff423747d3772ab672ad95528f8bc4a15bd70abf6421d6e0ac727
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51f2ca4df1f9104d971390c743717d253
SHA1c0d8dcb0d7d9902c6868c8a9b5a8ea85dcc1511e
SHA256f19400174d2e2df126d951388ecb193801e3780fbd6c6d4b5c1e871b6992eb45
SHA512e1c2df16097bc19934191bbd42533f9ecb695772fcaef6732703989d94e727e2f3731a1d9c0ef1519cc6b75d181b9f000e839047796bf84921dc3c3b2784558e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD524c3beb7c31fc37cf6324c336b780258
SHA190ba2e0fae4b7378c8b486409040b04f5b7b0cfc
SHA25649a756d57704fff3e189d0fd8a069b224584e4cf5ebc2d84508be808a06e9290
SHA512b2fb8895234e35f5f5840cc25c1ecd97a9c968a63f490d91335f8109d7256bed6909b90f17cda46412b6c9b6596819d60cf2ba469ba1ceee3814680696243cb9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5b2e41b26f657e31c169e41b9b2831c74
SHA17abaa747f6afe6fd6300d949fa2b2832157b52ca
SHA256694fbb32bd0b45f92d4ad0976b1a2e7d2cb1e4591bac54d37fca1e096d791a91
SHA5125f4477913e2e90661734a1988b6714a4eac4d3a1169f185bf60fdb24c505705a45ee5ccfb42d2f64f6a56602595928f83b7ecddb1f4f1e21aee361e94738984c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD547e94a96372e6f095b8a3fd7edc48ec0
SHA1377b68f34e5964ca8be1b1b0c1507dd7f0e5f005
SHA25615c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e
SHA5125bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5a5ec557d09ed6b3cad284318fd383580
SHA1b716ee6b608ff736b6f87fec3eb339f806047367
SHA2561e83ff775981215a95a8e2efed8870e90a0ff544e04e5dd4ab903b4bdd88fd34
SHA51275a922e311af639211d7a8a9f2279d680391754bcda18ad44242c8f9fbf27c09eb97fbfae2f59a2bb7986be0392a3477dbc64715a9b988414df0aa4c4497a350
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5dda7dbf66b32289555bceb322cb20db5
SHA1a4757aefd595d1dfcc349722665100c6be72a215
SHA256144a7dbe27bcd4c0d853db7bd129f2f92351d5d97d015d35fb2955acb29ed3f1
SHA5126aedbf15966353a8c12d6f91b6e6404553f38936375b45895b24cd2c48f8d49ea27522c70b468cc5b402b568086daf31eb628296d6284be3ba80fd9c9fab8615
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gyg2ovwl.gxw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5ab7efe4387647fe293d9eddbe8286b9b
SHA14c82c10de74ce93ae07864ffecd7e6c8c3232a81
SHA256da997132d14056901a84df4a2d0488aa086f60e1600cba676e9c08d6789f3397
SHA5129e919db9126fef0e8848fd73d19b957ce3cb745fbb76c34a2942c980fdd119c327b89b6c8caca3f4261b77213ab1aa3e0a6767e54be393607be564104e87d607
-
\??\pipe\LOCAL\crashpad_3928_MMVZCUEEGPZQKDQVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3480-145-0x0000015D9B910000-0x0000015D9B920000-memory.dmpFilesize
64KB
-
memory/3480-144-0x0000015D9B910000-0x0000015D9B920000-memory.dmpFilesize
64KB
-
memory/3480-143-0x0000015D9B910000-0x0000015D9B920000-memory.dmpFilesize
64KB
-
memory/3480-142-0x0000015D9B8C0000-0x0000015D9B8E2000-memory.dmpFilesize
136KB