hxxps://ws1c[.]mojedatovaschranka[.]cz

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2023, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ws1c.mojedatovaschranka.cz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1648	powershell.exe
1648	powershell.exe
536	msedge.exe
536	msedge.exe
796	msedge.exe
796	msedge.exe
232	identity_helper.exe
232	identity_helper.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 3892	796	msedge.exe	86
PID 796 wrote to memory of 3892	796	msedge.exe	86
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 4488	796	msedge.exe	87
PID 796 wrote to memory of 536	796	msedge.exe	88
PID 796 wrote to memory of 536	796	msedge.exe	88
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89
PID 796 wrote to memory of 2012	796	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://ws1c.mojedatovaschranka.cz
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://ws1c.mojedatovaschranka.cz
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0x9c,0x104,0x7fffab7746f8,0x7fffab774708,0x7fffab774718
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6efd75460,0x7ff6efd75470,0x7ff6efd75480
    3⤵
    PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12243100128820415477,15572119395166390335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
9787feb946b0e384e286302e705fbe34

SHA1
3803e8b1b2f6ee418287381247b3cfa90c474285

SHA256
8d4ebe10ea669849db1d9ffa21e068955ed90d86a37dd1795e72e48d6758ed06

SHA512
b820bd1953d359f2b373ee79c47bfacce5d8c6f4311345ee999f2803aadd911e6167d117d0f68bb9189db35ab29d31a28e8c40a599eea19bb53132f130f5acc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
836172551ca5e65f0be50bb27dcdb635

SHA1
1c9c31aa6bb1eb162a855176a54d5638d8b6dca8

SHA256
cf46bb8dc173d1dab50422beb674de166cd1abfed2c212c72f09ebe1d969dee3

SHA512
5f7876330bf279632e9d959bb185701a35e73c45caf65b7c71db1f6006dc8605d50f2d1c82267475e44f23b5ad90f1224703daee1fcfaa2355d0cd29ea197cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2df37e1f66d2f92a5fb8a741bafc114

SHA1
e5af1da6fbb25f76a2917311c6f1cb202433c2c3

SHA256
6133085161ccaa70e7cdbd5767612c647bcabc7af635d91e43a08d8ce0e2860d

SHA512
6800268b4180d3cb2116cf04f5b8325445cdca24fb9c56dd6667f8d2f2eb8f9348bea8d1a2039bf1ff86b7288404e87219a068e55b8efe5c04cc78d4c96afdb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
958a3d1e3db64bad0f4b01e55cbc1fbc

SHA1
26040f3b0dd04dba7401306ab16628aba15e12e6

SHA256
709c0cfb75bf274d744626ba4d2567e66640507f673d7edd0bd13698542ac067

SHA512
c61d96c914597bb6bfd84b4bbca0badae6a8dd7c5c19665f80d0324e47b60b16029e1767337208187f934684e01f38d5f635fa6d7a01654ee751d00613ac47a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e4c9122baef98ed951b2479877f042a6

SHA1
2af8e3543b490bc7214b4b3ee3cccb3c913008b9

SHA256
0f4be948dadcbe9f561acddc6bafeee676d508c0683349c718ea1f1cbb025994

SHA512
53154395d313697065769843ce5a3a112a5b1fc0cc88e07dd9bd32742e25ce48e2e4bd9d3e4efea02cf6867e59458e407c48ab2e1ff7031023ed6cfbf4ae1c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fcb6fbc50e66f245ffa8c519f8a23c21

SHA1
21e90a40505232c6de29366629ba0adb3e8d1df1

SHA256
82f25a42b02eb680748d10c5f21f934e99343d6472bf6e429747f8f7fee3a075

SHA512
98121a01d516bf71975651c47758c9764ab2c96c97b5d5da0ccc53c3c71f0e33dc830cae23deceaa1e7094dd72b8d241c06a422143a70719c5201ef8019163a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jx35ymwg.31l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
596a066f78c2c66762aa233dd87b04c6

SHA1
080e9ede4620bd0440afae429e478e2c7dcf6e1c

SHA256
bf18b0ef40146ce176f6f98ea0e0e6163c7df4e53f8f57b866a47230e6cedf1e

SHA512
8a0b1ae7595cbeb839772a14aa7643e378597a67cccdb8e0aab3254d0d3543d5fac1b24ebe3be3b5fc4aa678c23e59c40a8eb45b36015860f5a42be82a56bb16

Download Submit
memory/1648-144-0x0000013B68C90000-0x0000013B68CA0000-memory.dmp

Filesize
64KB

Download
memory/1648-145-0x0000013B68C90000-0x0000013B68CA0000-memory.dmp

Filesize
64KB

Download
memory/1648-143-0x0000013B68C90000-0x0000013B68CA0000-memory.dmp

Filesize
64KB

Download
memory/1648-142-0x0000013B50750000-0x0000013B50772000-memory.dmp

Filesize
136KB

Download