hxxps://sites[.]abb[.]com/sites/Pricelistsandquotationtemplates-confidential/_layouts/15/mypermissions[.]aspx

Resubmissions

19/05/2023, 06:45

230519-hh2cqsed8v 1

19/05/2023, 06:43

230519-hg7s5afe72 4

Analysis

max time kernel
48s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.abb.com/sites/Pricelistsandquotationtemplates-confidential/_layouts/15/mypermissions.aspx

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e58a9143-2d51-46fa-ac7b-d087d368e22d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230519084405.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4152	powershell.exe
4152	powershell.exe
1060	msedge.exe
1060	msedge.exe
2064	msedge.exe
2064	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	powershell.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2780	2064	msedge.exe	85
PID 2064 wrote to memory of 2780	2064	msedge.exe	85
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 4924	2064	msedge.exe	86
PID 2064 wrote to memory of 1060	2064	msedge.exe	87
PID 2064 wrote to memory of 1060	2064	msedge.exe	87
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88
PID 2064 wrote to memory of 4424	2064	msedge.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://sites.abb.com/sites/Pricelistsandquotationtemplates-confidential/_layouts/15/mypermissions.aspx
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://sites.abb.com/sites/Pricelistsandquotationtemplates-confidential/_layouts/15/mypermissions.aspx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf61d46f8,0x7ffbf61d4708,0x7ffbf61d4718
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff669f45460,0x7ff669f45470,0x7ff669f45480
    3⤵
    PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4464055081683530208,7248579791451655130,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93601995-12c6-4be4-bb93-11382cabf12f.tmp

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a9e44a071f5fd9e6976c5ae288002209

SHA1
3eaf912d8e19e72e2125359c217dc78fda04f2cb

SHA256
e8ac6e026e8a4c9cbcc5835257f604e9fdb44257fe92c3dbed4a6fa46b96efd9

SHA512
d385432f244e6d2179403cbee7dd110e962ea6c4913a948e42c7d412657c1153c4dc23233648432f45385878d573c4dbbc72443d86312d01fd7b37a6790b77a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
fcfadffba5fb1223498f32ab19180b8e

SHA1
f85a7dd3fecd5a95d99e1707e85b687186d60450

SHA256
f4bbf421bf65573abf07f00eac1cf1dbf45a53bb555f76b83e10a99670578fd4

SHA512
2c0e796643a48d8c7cab31e92e9b53dff59888f9bbcf7ac0054056cf1c432e4f8bc9333ea7806b0bbc98a4f62fe90a65e85a608d44d7671dfc1c079ad0dc91cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5768bc023531d1c423a01d8d1f667ff7

SHA1
d66c9c37afde44adbff064eb6beab93535c3b6c7

SHA256
e3bacb9d7dfdbb69ad28440a15d0c04e711e7120f967607aeaf086c664557cdc

SHA512
ca5c21fbdb53e6e433e8c9181786e8b6f401e176c8bfa28f25071140b928ee87b1a22984ec4d4fb1589d8e38df6406cc3f78e23f8110e65ec1a8c54b25fcfbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a11a233fa7018c3a3baec163549b95ec

SHA1
aa71688378ff94f5d54008525396d2f4eca87049

SHA256
52aa3dd859b95fb0e34b5cd43c026407c0567bf1293e984c4c5fdb4d6b2040d3

SHA512
8eda7b021c16fd94c6a2526d574d4ad8df46d39add3f31ad6aca4c22da9b77b8535e1d604d5b1f271f5e25a6646ca3f1a1fb2febad7070e15d7cf7da45699ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
126bc40b372af2ad6ab9970f92412ba0

SHA1
e7fff4d962b371994506872f550f1c079be59bf2

SHA256
7868e5f8b870edd06793c40c9c5f6f9d8118868e1e0e9d196c569f7c7d4196cd

SHA512
5bb25053fe5a55524a66a8ba19122c92f72efcbc2f9167d5a1973d3b4042b8562650a07111413379224479636465afdf96e3937bfa870c31e4a8672d3c3f7a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
10d857a51fa453206b308f720594a769

SHA1
ee8432e1eacf41c2340378fd38176745bf71b2a9

SHA256
d66a94ce81f3f546d0c8e60f355a9400eff5d39e0fc18255599e4ffd97a744b5

SHA512
af5f2ce14ef4bdbee60da85c43dc4f51d8bc2d203484cfd04669be7986c4eba905ca1da0a1ce938e1cee1f69b73ded02dbb955deff2073bfe32f089dbaaecabc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56dc5b.TMP

Filesize
539B

MD5
336a97ba34227df20d3cdeb849fba23a

SHA1
da63cd6958ec74cd24a7d7c203f8cf4544894de5

SHA256
6e8f0c754518dd2b8bc7e2bc249a3b646fa6142e94c0fb6ac914a0a959e2eafd

SHA512
20cdae43935cbf58eab00daf55849c806e1a515a061c74d5144a7031ef19749d830453a8274009735fb3515778189482f3b457ecf6fdbf25048a0d44ee05cad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
239f48c858e8d6beeaac2171016191af

SHA1
fbedc7765984d5a8172cfc65e0cbb348278e6da2

SHA256
9b6e5709788f17c6ce517f923cd7880298718650823577b3833d85c4b8bd9c9c

SHA512
8c962113e6dad6430bbfda5e85cfee0dd0a3194068d35a7545cada409b939fffca99ab80069ce294667d8eabd06578f1642c05b99f460e21c39aa37ad6372a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
925419add7da72ec5e43ddea645c1710

SHA1
9aa8208d8fe241618fec9b5d7224352f5bb9389d

SHA256
cd547051a1c0aae4771bfe96d57acd17b1d49eedd6c1e0c429ecd207eb64a413

SHA512
954f4ca7e2ab314f8bf135d75a95697ad184cde687fe5c6b0c78b339038008407343b0de5be747576f7ddd11673ad75d429dac2ac5a254eaace0933a1b885641

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2doyi1ac.5wg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6f082f7af7849bb3a00c15ac3d9a3363

SHA1
56db732d87dc8c98014f0087ec7d58b5f98300d7

SHA256
6ec83c7a0523a62023d2829d4674d6b883405a23d2ad0a990a98a06aab5f4e73

SHA512
7c13380a135b410765dfb6008b9b49f7896b3ab8fd58fc8ec7420de433a7dec3fcc019b671663b759bd7fd184ec6db9bee08a013e698c631938f4ebbec2a8601

Download Submit
memory/4152-145-0x00000181D8560000-0x00000181D8570000-memory.dmp

Filesize
64KB

Download
memory/4152-142-0x00000181DA810000-0x00000181DA832000-memory.dmp

Filesize
136KB

Download
memory/4152-143-0x00000181D8560000-0x00000181D8570000-memory.dmp

Filesize
64KB

Download
memory/4152-144-0x00000181D8560000-0x00000181D8570000-memory.dmp

Filesize
64KB

Download