hxxp://chatgptsk[.]sk

Analysis

max time kernel
117s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://chatgptsk.sk

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2fbed68e-d2eb-4ada-b263-798545d08abf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230517111522.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3340	powershell.exe
3340	powershell.exe
2604	msedge.exe
2604	msedge.exe
3432	msedge.exe
3432	msedge.exe
1540	identity_helper.exe
1540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4348	3432	msedge.exe	87
PID 3432 wrote to memory of 4348	3432	msedge.exe	87
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 4604	3432	msedge.exe	88
PID 3432 wrote to memory of 2604	3432	msedge.exe	89
PID 3432 wrote to memory of 2604	3432	msedge.exe	89
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91
PID 3432 wrote to memory of 4944	3432	msedge.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://chatgptsk.sk
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://chatgptsk.sk
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd499f46f8,0x7ffd499f4708,0x7ffd499f4718
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff78eb45460,0x7ff78eb45470,0x7ff78eb45480
    3⤵
    PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,822825127117017711,12546717616329861669,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\643adfae-6857-44ac-bf9d-5590a5805c79.tmp

Filesize
6KB

MD5
4b0f521f0fb60a4195fc989b6f2d8c32

SHA1
f4e8970f379be841c75944623be613b8c49efead

SHA256
64afa1cd0975c52f6c2f3d1de4f2d9110a02ed2dc30afc6339b012147b480408

SHA512
7b30ff4bf0c3be0c057a5a187fd8c3a442dd297b6f9a340f764e41200cfc52dc20b432fdb710d487e657ef27d1b5e6b5ac62d22fc2c001a8a10081a9474dfc48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
31KB

MD5
0b5729a931d113be34b6fac13bcf5b29

SHA1
88ba90d2d2944315afd28a706ee5715ed980c634

SHA256
ac1c8f94750b39b12327a5d0c56fdf946dabfb6d91e5d2a202879ff9a5d67e29

SHA512
68e1b473a9cf3731a4fb9ce3c3225aa1152009d3ab7d20e198c203daee3e388b25af41a3a4b2a8ed79b4028df19a93384fc026228b9192ac23d67add56c2ca11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
491KB

MD5
9ec513d705ed7f4deb2b50bb05914817

SHA1
630bf0e29410ec27622f65d1270c6bc435cdff21

SHA256
d05806144185f1156aa17ba9b21c85a5afda3f92d5663e5a46cae4073a41f3c2

SHA512
d2636bd8e2b2922fef65965666eb0698a9a3612c013c1180a77c1d6c7e7ef5da4721597b4141f64ca35902d9d50a55a929a220a3661acd3e64e0df4fcb8c213b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
362KB

MD5
cfe1f194fed43c1ea945580ec6f37750

SHA1
74beb042e044359645998dfb7033bd2801043134

SHA256
2b223e5c589dff67b6d81545bf31275132046abcd6a0b4402c1422df9ddd6fd8

SHA512
9b08e616491d95a948359b1733852211aacd581e8b4da70d171822ecf8a25806385af33abb2fa85e0bcc5e0ca312d30d3cf1690b7e1d48bb785920f869f9244c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
52KB

MD5
dc80108751f0618cec4e377449577ee0

SHA1
30e9945aa038bb9452de40834a17effba1c1bab5

SHA256
d33588d9a844bfbc49f64cb6d8f406dc984b99fb2467f12f62a4904e82ac3ac0

SHA512
a24e599260d82a99d99c296ad762c230ee5a1fabb8d31a60fb8c0685c8977d3ea53f57f248086804f55a7decdb720a1cc217a4feb1f0e8cff6018f4c6645823a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
39307e27138b106e53f1a4af27d63094

SHA1
9c2fbfb3f19bf72a282a101d1c802c287dbb5fab

SHA256
07c09b206faa8934e6b12c518a4f834d8bd5b2bbe92a07a4f169173ab620b464

SHA512
8e48c468cceab8dfb296c62c2fcf4e82adde92fc06e3b14418a4cc08dea5712aaa7f61eb5421b9d5fbc0803b1b8f2b05a344a2e3db7831212af9e2579972bc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
67KB

MD5
e865821e376bd895c10b04171ad130dc

SHA1
bbfb0971f9a79695d9be5dd30108c6407ce70f38

SHA256
201820213fe2da842bc0e9c5c0a614e4eb07c26f725152826627500ccbe6b32e

SHA512
51085608486ceb3546b884b04a1709234bbcf28ab382c35f804cd13eb4b6394ae400fb90e90402e1b16c43b33e61df2dfa0fac3d8ca321eb9cae4b8beccb893d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
84KB

MD5
5d22954e70d3cf96555cc574168ffd21

SHA1
e48fe94d07588fa610b9186839f83bcd62ae2db3

SHA256
20c1dac91aa1e9929a9839a637a1053ae8fa7ee9effdb76f0423bd4f24ed3c52

SHA512
52e0ebad1ec15609bb188b6a4f391429139df2c288a8078867b3296cfc629870c61b3e594ff1b2a2383bc77063c0ed43ec55e7d2358933605a59a31c12013c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
cde93118ecce9d5ae4e8e52f2f0bd311

SHA1
a12aa967c7d3b17f6b54cd69aefd9bf6b7fe802a

SHA256
0c15a544c88ffe3ea7b0d050af8666ea5290f76eef8b0ccdefbba609aafd8b50

SHA512
5f797426a78c4773d7862f0681f8dac506409c828ac0265a654ad58226ba17e58898a86c44851871ec5117f8ea27b389fd7638f542b7359cb659058ddf27102b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
e1ee7c6ae30393fcae2cee91d32a8695

SHA1
b2e85ac2851ec4641c224f13bff4a607d002427e

SHA256
f052de7db170dadab6e01c96af0614369c094c9c9c67ecd67772f8e37a5a481c

SHA512
f52ce04b154325a4e83ccede8e379386df377cc6c36a211bbf53bac9b481bfe83d5043e50de0b020f85496437214ea5391cece2cc263845ec06d45a018e61f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
e4fb31c7fbfe9ecbc78a34a8624e025f

SHA1
4a589e5d401a0d8b195ffbbb1599507ba02e17bc

SHA256
7d3e8c61cebc5da82c2256dfd2cbe7d5b9d1c57d5b5d5b88f5c3ec86ad0c07f1

SHA512
bb1b0774f9b055d465283047475ec21e7672a5897a104208dcbbae9928708422acca00845b47bb88d6d34614ae3de5de2409bb629b1d688708dd3679e4faf700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
8d0f8d54a962b08a98e9c1b7c3727690

SHA1
b1fa53c4dec0f715d9113c6ab7bd9e6c8c4143a6

SHA256
61653d77e14a792db861e7d7e3297620dded4d6ef415bee538f53e15a5c732c6

SHA512
1d9d69e1528f0280cd3a85be9312493b8934a815acfce6abf56793b3d4fdffc2d7637284a0d8fe7a9e96e71080c52a89833ace80ad79db969ee4e371ad824070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
4acd5f71b026d5f3ef3ab05f14d72729

SHA1
995cdff7327389c0d3f8f57c877005b0e3b7188b

SHA256
b89d55d177226c7d00adab54b7cfacdd01a8a342683599986251251ba5ac9c4c

SHA512
f69bd9a7903cc3414d80a998613ea7d9efc653f2830477ff85fa171caa64eede994f6a9893500b06647688c01953dbb7ecbfb07a28d1cce41b5abbc6e566e656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5201e6484f07b9661e2dde05202264e7

SHA1
64ce3789810f02c37fc890a1b75b6fd2d8127272

SHA256
0cc5e7a40b792d1aa3583e84c91e90d14d5a4a23b22fb6c95de1bec42cbe2212

SHA512
d288d113d5110e1a9b8902d77a9ba7f4f73e0496e4ad4d03742a93a18b947a158e90c860ad83776dfc5f8a442b6e21db4c107090f96fac1db57dffb72806a619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4c579c66f74d587136d017812c5a40d

SHA1
b6ecc9be6b2f36ff322d3ffbc6d17f39ff2f4ea0

SHA256
b11222b84e1f50439c8c48c5f21b48cff8a9fb2dd19162fa9d952b8aae291f8d

SHA512
28cbf2525713db83b17083b048687c13c5b6d3202604ec72ac49670e36f9d415336946327ec59a70c4c7a4b909644aad8583203a4f2a18acabe6cfc03715f5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
2b8b985e8f98539bc84d513b2186831d

SHA1
0d5e1d1cf52340c6f424239ffe1bb01c80858bc6

SHA256
fd255aed5a0af474d1cff471ba61797f770d17e04c198af60171bb6bf7ae6727

SHA512
ef6ca3f5b0c5a1bce536f047453f0d79d3a76e300141eedad3781a3b43a1d633d07a19f9f5f4cc612ff54c44e53e2cab655764f6c9f59f7fa56aac3ee95d6659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
117609513c39ea9d58aff12c374a2b48

SHA1
531988c487d26fc84cb4708009d13ce467723fcf

SHA256
4985b171f5398104994378a394861df502fb6292f2d095e7ef647b16774c81b1

SHA512
7c3491b12f1b5bdfbb722391112c43d5ca95089972eddc61f084fb8bf3d5cf246f4e1a8ba272c8cc68f9993ff2dfbc48f8fc54d7c3a1d0236165dfe6d6855d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f408923088e7fea231e2c125eddc4d93

SHA1
05abfa97dfd67810e6dacd3b7023cb8ed18bb56a

SHA256
0f3d61b6a120d0e0ec0b6542308a54c50f765e47d20c4e7bc9fa6fae8c1f11a3

SHA512
cd9ea424e69a3f1659ff41415735ec40caf4be1f03afc45a85870213860f742d6466628ddb0e92e4276b5512d66455746c83b4e494bac9fe30377b09a5f2f7e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bed74f5198abbe5e27f01573bbdb9e2

SHA1
04364cd81e86db1809e1394d909dd02f82198ac6

SHA256
fbaf24a795521984876ab0b8ecbe5341968a3266bc0a530ea689b7102f2ac28b

SHA512
1e3ff7eeb19b33c99bb9d6e45d7a7beb554484c8bb96f796569378d132524b9ec23665121e75e9566a6adb2dcc759a63fcaa84d000e226b4b9b426f017638743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3d874cbf2372e29aa7bde5be5e1db4b3

SHA1
a9214d4e1ddfd7f4cbe8fc61f838f9f2a2f2f26f

SHA256
84c9c0c31f068bcdc2258102ef25547073b785cfedc7345f510de21dd6096000

SHA512
8f90c381382b2a95c3ba3fe941429cc70094c92e78668a54ac88ed3e030c14ee7c3ba8ee7f450533456fd1933663b4c300f265da972fc0493aa409cc17b9fe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9164bfcc993d71e7277b9d8df6bb3aaa

SHA1
01a0ffd4eed479687cdcc62e42bedd001966d428

SHA256
b116050de5ae693eaed211737f863797e85f19b732804e214c9ef650ab146dba

SHA512
396db238162b6fca86efbc27c7beff122456dcbd9085f9ba59dabd52aade99cddf3f85ad0c0e8228cc38d79671c82bcab9b2e0761b930f5ccbc40ca2ad15527a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cc5011ababa2e77d3eb3a499c7289b1

SHA1
427f51fd4ac7532fb9d87bb85e7c37db91946d16

SHA256
5b243cf6e0343173defe07e18023569b5c63fdd691b05a36f14bef3ef020dfb2

SHA512
22b0e0deb6190b80487940a74942b31208884a87feb67ffe7829470509f5aebfdafd961903c70a90fb1f4cf8fa7be7b886144892fb76be3c5f3aa879c30db81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1f306db751f7e47b83c9f491fbc0d36

SHA1
76e3c5e3def56f21814f2ac6a28c595450e15085

SHA256
79a583a1049999718bc56bcf3e9387d9c67340168b882a87fc9985656bf7761b

SHA512
19bc05e6cfb7912a688f3fba56004195039cf3633621e1fb28bd0070273358217f53f3ef210599c3427688ed55e835fb853a159b5d54f4e3b54ece3cb4fb7164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57056e.TMP

Filesize
704B

MD5
c854854a405f0cd6c2ec0b0014646804

SHA1
6d5656a4e8cf8d69d121a08f2df9e81511281163

SHA256
35ee8c25bc21557979c918b539b4cecce1417287cbfb22fd7a04c194994e9f2d

SHA512
586b400ee7f8c6876649e576e1ff4c4d1299eff8d33cb933724ecc3031786b5d11f0a12cdf7c5d6a7c5b2b2aae677e31edadb61fad98f74750ce9eaf83c7027e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a56a5e6f87e07f548776ac84dd67173e

SHA1
df5d64792ee6d764c381038d8c41282a54f6213b

SHA256
f1f7d07af04b82a50e0fa01b05e47a2e5128d6d4b575dc2b49b7f8fa5b207e08

SHA512
cbe30e57ed86c4d3013eab114b7be9888ccf6bb6e54e3d28201fe4d88570fa3a2ef046bafcae4bb9511da94400cfb5a68545f75ede47e1147d1783cc6b66bf0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c05efd8353d3888727106c5b83dad28e

SHA1
3e968d818373eb209f845c45f28a8a97b0b2fede

SHA256
8739ce990ed73bf005cc7b167f5c7a4b01f966492ebcda4004c95bcd62f0c15c

SHA512
caf758b4eb215abf5060dae6612f038f0b37910c87efae6d87ed09d89b90ad3a1493be8edcba709bc135b46b00cf28c185dcb0c86d80d62001b33b0c78422ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tnc1akvs.dsj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
24581864d9de7f719199326c55b94b77

SHA1
f2c44d1def101b6c868271d44f563f366a177926

SHA256
662d471e5c6adac739841a9eaf3e9a05ce83c56d6f48aef803e74c29126febfd

SHA512
f8db80fbb131cc899933487d649f1547b6f450e460ff18a4cab8e64888c92461689b69391e3d54b8bf599c0868f7aca6c73fdc24797b92fe66d5ca3400390b01

Download Submit
memory/3340-145-0x000001B49DE40000-0x000001B49DE50000-memory.dmp

Filesize
64KB

Download
memory/3340-144-0x000001B49DE40000-0x000001B49DE50000-memory.dmp

Filesize
64KB

Download
memory/3340-143-0x000001B49DE40000-0x000001B49DE50000-memory.dmp

Filesize
64KB

Download
memory/3340-140-0x000001B4B8600000-0x000001B4B8622000-memory.dmp

Filesize
136KB

Download