hxxps://www4[.]online[.]compano[.]nl

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www4.online.compano.nl

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dc3d6997-0996-4774-8fae-8bca4a44ac9f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230517065024.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe
616	msedge.exe
616	msedge.exe
2692	msedge.exe
2692	msedge.exe
2644	identity_helper.exe
2644	identity_helper.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2288	2692	msedge.exe	86
PID 2692 wrote to memory of 2288	2692	msedge.exe	86
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 4744	2692	msedge.exe	87
PID 2692 wrote to memory of 616	2692	msedge.exe	88
PID 2692 wrote to memory of 616	2692	msedge.exe	88
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89
PID 2692 wrote to memory of 1888	2692	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www4.online.compano.nl
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www4.online.compano.nl
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff8cebf46f8,0x7ff8cebf4708,0x7ff8cebf4718
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x234,0x238,0x23c,0xe0,0x240,0x7ff7b7605460,0x7ff7b7605470,0x7ff7b7605480
    3⤵
    PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=188 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12339994010250535560,10420949301687285455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
cae5b31dd10045059950bf86a12844a8

SHA1
6e841d87cbc08149e024cfa66bd42fe9bac1d7ac

SHA256
13ac93b15144b7a7ea190850e0335f3b217bfab74960e392e9026bc649bea09e

SHA512
bca0a411f05b433ff6e09a2a72b160a9536534387bb09d94a6a3d4509dc0989893e18dbee19d11cff0533d1acd73e586c974d57dc9111643bb0f50aefcdcfd93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56e42b.TMP

Filesize
48B

MD5
918ba726f67f5748143e8e2bf7adc2ad

SHA1
f04c3badfc9251533ed761f4b640a17c30597a02

SHA256
9bd5e71bbef1ea507966d6b86dcd1669558f7bd2339721b4ed8c90dba6244232

SHA512
427f019212b98e07204023af332f7f2fccdbe0d35a1e9d8ddf49508e4bbb20e51dfc2cb93ead2f934a23da88634efbda5326a56e054f14ee585186e9779cbf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
7f2c952a582be0d31eb0a9ee71e42733

SHA1
c966207dc2e5c180f366ffd81947473935478696

SHA256
2491ebec94795e3d89c9fba24fe094d564dab3336f4cc433520e154c048d298e

SHA512
d848506af168d15380ba6d3d91752afd6a244e21e5d03f2e17d87f318ce83db7021e92ac5b44853994f2d49da74841984c4484a2963a4030b9b031b3af9820ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a6d453079b2d669003d361b47e07a051

SHA1
d590dbfaee0e53b6f36e54406780dc3b345837f1

SHA256
40a432de74a4bd7994a92632acdae73719b5fd917a63e95037bfc7a32c3cbe3d

SHA512
3e440b8d0d7b1273c1f95408b63ddbe38a7148a0817f81202c77d77bda54bf668c0deab304ccad9bf8311bfc776475e875bc3ecfd485387d9f8001fb9ab7d9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2b2819901f6d3bd2371e8c288c8c019

SHA1
adc6e4bae85bb0acc7b21bfb94a86aa16d46479b

SHA256
15478fd549ce46e21b754f9c1674f87e94861d34ee8b1e5b7dd2f934eaa97aa1

SHA512
7217439f637ba698bb157040eba4eb32fd00b55a54d38a24c024d3cdcc24d25387762d1fe87b0172fe4e4682e6685185db9ea428214e59d9e0d701e494a21475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88e8a48a325deef44b65365acae9b25f

SHA1
336853798aaddd9f731b5bbb994f8c40eef1ea49

SHA256
e5fc2eb7ba20b2688472a34d74df9401c6300863734051c107af773f99e6940f

SHA512
93d769e15266c08c3f1d66538feb60005ee38e753370cc7a9ba0d1f847c55980f3558bf57d76ad311ef2a6088cd6642fd9c2808e11db4c11f30d27eefbdfbe18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68d56028ff590738e04b2330b26bfe01

SHA1
e0a380bfe4bc625e04a9c72d1f8e93473613c9dc

SHA256
0273328ebdfa0d5ddb9ec49305f8ccbef5a70ffe794525d40be88ca3f932aa5f

SHA512
8ece1d68ecac798da11419122e0277d2129990d1657c6a188569797bd7c6f5091a5737db0dea4666acaabe314990d9094b1f9bfb7f0d5ca7ef816654686d9cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
96664b4024cd31c9dd850c28284e49e5

SHA1
b1dc7f4f1504ba3dcd26073397ba86789d41bd25

SHA256
875f4157cea6ce0742dffcd259469df7547e732813dd70b3f8c8ab3c6a120f31

SHA512
a80e87448aa00c0ddfbcf8e274c7d538eb169ee928228f7a374d558ef0976853a68dd4ca45439821f5b179afad4fc879a614b1f3b9f53cf6eb0665f48231fd5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ja3fgxm2.eot.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4601a5b07d94b3e0928fc76b27a3e062

SHA1
cf75c5c8c80113e7f3dfe6f285261f2afd9d917b

SHA256
26af0951daba31d287aa96687873f2692b765ddf3ff78472e12359050ec87e41

SHA512
b8f13ef18c85dd02b405d91305ac4fe01f9ca2221a363353d521f5c33ffdc1e4be121f952ffdc25958d94b2b29725e7f60641e83dd2951824e240b71ebbbb5fe

Download Submit
memory/1996-145-0x0000016EEA950000-0x0000016EEA960000-memory.dmp

Filesize
64KB

Download
memory/1996-144-0x0000016EEA950000-0x0000016EEA960000-memory.dmp

Filesize
64KB

Download
memory/1996-143-0x0000016EEA950000-0x0000016EEA960000-memory.dmp

Filesize
64KB

Download
memory/1996-142-0x0000016EEC980000-0x0000016EEC9A2000-memory.dmp

Filesize
136KB

Download