Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2023 08:27

General

  • Target

    https://bafybeihb2aim5uuajb2hd7poq377bjcxfb6uenqoqf7b6dghnzivhsirvu.ipfs.dweb.link/nnooddvse.html#[email protected]

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://bafybeihb2aim5uuajb2hd7poq377bjcxfb6uenqoqf7b6dghnzivhsirvu.ipfs.dweb.link/nnooddvse.html#[email protected]
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4460
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://bafybeihb2aim5uuajb2hd7poq377bjcxfb6uenqoqf7b6dghnzivhsirvu.ipfs.dweb.link/nnooddvse.html#[email protected]
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0xac,0x104,0x7ffaf64246f8,0x7ffaf6424708,0x7ffaf6424718
      2⤵
        PID:788
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
        2⤵
          PID:268
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3120
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
          2⤵
            PID:4432
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
            2⤵
              PID:2620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:4780
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
                2⤵
                  PID:2528
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                  2⤵
                  • Drops file in Program Files directory
                  PID:3172
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0xf0,0x22c,0x7ff60ac55460,0x7ff60ac55470,0x7ff60ac55480
                    3⤵
                      PID:3744
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
                    2⤵
                      PID:4304
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                      2⤵
                        PID:3680
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                        2⤵
                          PID:4556
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
                          2⤵
                            PID:4492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6048146000429595155,1814350568408632065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2212
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1808

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            ae2c65ccf1085f2a624551421576a3ee

                            SHA1

                            f1dea6ccfbd7803cc4489b9260758b8ad053e08e

                            SHA256

                            49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

                            SHA512

                            3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            48B

                            MD5

                            2d8c5a598e4074dabc0f1c9518ee06c9

                            SHA1

                            7166b6c134ac5af65b8d450a11de9631f69ff098

                            SHA256

                            7b10b52a099a26a57d510e50b70fadb2d4589e88f863442e592f50f67bcca204

                            SHA512

                            f1929dad778d4ff0ef06cd6d7c3dd659750627bfca94c4a42496a6a33009bea1ee9d022b6c13203be703ed13ca787e7bbba34f82a271687071188032de58521c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            72B

                            MD5

                            fa789e884cc9a6bb83ba4731bde56d07

                            SHA1

                            70adb19bda74ec43d3fc28c9e815e6f7b9d48f39

                            SHA256

                            919a68ac47c018fc2a730e582ee1418fb79c930c9a6fc235372d0b717f3cb082

                            SHA512

                            88eb526b917bd216ff5ecf6bfc00df0baef2a68ca150bc7d7dc20c5d11aeb211fb76674ee128788641160ce3566f33cdab232c32d2f04b7612d4ba199ef66fd7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                            Filesize

                            70KB

                            MD5

                            e5e3377341056643b0494b6842c0b544

                            SHA1

                            d53fd8e256ec9d5cef8ef5387872e544a2df9108

                            SHA256

                            e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                            SHA512

                            83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                            Filesize

                            2KB

                            MD5

                            c3b9538d26002e25df4fcfb1eb245216

                            SHA1

                            b22a0e1ac93c3ac4ced7c507f8cd85e56e51eb5d

                            SHA256

                            9ffb38927584f4356064cf8d87c0a1f176f5cdc52f078696bd66d1c6b72f6d74

                            SHA512

                            0f3b1812e53a016bd14025d1670937c6fcf16e13271a642c7ae263fea8dcf8a6c0c18c36c67d2b015f45705a346005bf7081c578672ec455d81d14614b2027c6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            111B

                            MD5

                            285252a2f6327d41eab203dc2f402c67

                            SHA1

                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                            SHA256

                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                            SHA512

                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            659B

                            MD5

                            bc5102e23034d94d66a6d5784b24e25b

                            SHA1

                            a3d5f4099da34ea12f4bcf5f861ffb648021fe14

                            SHA256

                            9c7d285c8acced560df7569c17f678434beab0a5e8dceb2a4614374da289738b

                            SHA512

                            e7e3ff75db0410824cdde76476c279c12c7d4f960b1187b03c8aecfa385cd335aa060c836e60ea37b1e7e8c0855557a24488de5391f75516a054f9f3fef1503a

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            3cc762fa64188a2c40eb98e1ae84e46f

                            SHA1

                            5382c6c59dd7a6c708e441f63793f471070f60f5

                            SHA256

                            2dec715b66f5f26a0d92220f95471455f3937219830a4e1d9d6fc6a40a206147

                            SHA512

                            7ab25134a366830da72e99f68f519d7440b45cccc15fb32ed682d1bf0e7a0a0f8cae2d271e97b1cf5914947b2696e11ae6051839498bf7c9f913b1e9a0ee807f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            969bb42d7672cb6da607803f76e17201

                            SHA1

                            f1bdfe3ab3ef0e6384684481afbe6b5fcd0e3ed3

                            SHA256

                            5da074a5e2b42c830923348209b9fab63fdc910332780f741040c52e1679ef41

                            SHA512

                            677b2c57b8042a3d5357fb6ecb5466a1a010a99ac692eb27f51d0d6c100cf050b1692d550c9b4b9af80303ec34420d403316f77ff29344735acf54100c7a69f7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            2a1cad5a665c42745a88e4caf81ae608

                            SHA1

                            3212f96c776ddd10d7d454cf3ae918e4db2d067a

                            SHA256

                            08f396ff47633e0eafdacb86769528994d5c9047c60d8228486bd77da72dafdc

                            SHA512

                            98c758537a9e28af913b191e834e0fec1890d950fc43c41183b7e4d1e29656a9b68cfca5b69070ceed7ba7297fd8d2a644c2f2eb59e7f543857ddf7de9859423

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                            Filesize

                            24KB

                            MD5

                            b3fbb8a02260d5e41407a7e1af3ee2f6

                            SHA1

                            9180c8b9593405936b0fe52272571b63829525d4

                            SHA256

                            8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

                            SHA512

                            8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                            Filesize

                            24KB

                            MD5

                            cfd585ce0db9a1484f8223dc2cfce2f8

                            SHA1

                            4e5e287160c05ecdff8acdfa0899faa5bad4de82

                            SHA256

                            0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

                            SHA512

                            b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            370B

                            MD5

                            5783528be7f3de9e2368e3f8c17e42a6

                            SHA1

                            5540252a8b34877f9172b75140fe85bdba7a9731

                            SHA256

                            ba1696f8be387734669321bd44dd30cf04faa48ed92fa6747dd926c0138f8586

                            SHA512

                            a91d0332005222c793dd539b8a9bdcb4fb1027bee367f6ba54f8846850e3858dee15a1eca39fdf5a7ae0950bd6e64f3090d24b837a3848e5284e66cd8dbdf711

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56da67.TMP

                            Filesize

                            203B

                            MD5

                            ab04b15aa046bb6be78517aa4e3bf529

                            SHA1

                            9f0e82d691296710a4c51ab97ae81488719f1fdc

                            SHA256

                            e3e3b0df24289ca476b7c2695dcca385a50d5a8e23eb43b7cda140e60d0757a0

                            SHA512

                            963f7e5dbf1a1a0d8c7ffc4709a5050c4257203ef5ebe758248bded9f8d194e705ab61c8c4a9b416733d09b19642cd4e03005059633183f62de7b55ea3f3b564

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                            Filesize

                            41B

                            MD5

                            5af87dfd673ba2115e2fcf5cfdb727ab

                            SHA1

                            d5b5bbf396dc291274584ef71f444f420b6056f1

                            SHA256

                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                            SHA512

                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            9KB

                            MD5

                            c689f79437ff6c219e29ade45bb32cdd

                            SHA1

                            a023bc1c3f0b877a878e8b22dc8fe6563e15e50e

                            SHA256

                            21e6e104240d5d13315e62103b7ea1c2d8c6bd07e2ee7048c6697635ba113f6b

                            SHA512

                            154cff6a97c018868ecc0f0c871bf99b20c07f5050b2b0fab28fb3472865a7c92b42728fe828e9dcf4bcfae6494aa903ee977c43e64623f60961d90055d79a4e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            12KB

                            MD5

                            d28b0a273a578f11ef69ce68db6ccf49

                            SHA1

                            fcfaac56e1ddee46d0409c50c924337cbcf8631d

                            SHA256

                            d4a262b1b6367a95bbbcf1cd796deb1e63114b0b4b96cef2d59663ad44e6b3da

                            SHA512

                            29c88987b33cd86e6b28f9719ac251f1f444519fe523a499ba2402ac51d88a1eba94439f714d7be7dbbffd131a192f6ac59d646d2ac8f075c85d23fd14ec4d8e

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezbqrqlc.pzb.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                            Filesize

                            3KB

                            MD5

                            47e4ca86fd92b3a5861561c84f986ff9

                            SHA1

                            837de91eb521967e4fb462111aa72d2e38246e7a

                            SHA256

                            1d1406463f7f17a3bb7df2c2e37a7a4053796f6d6fa8f6fc1d42961b51eece51

                            SHA512

                            2e59f1be0c31769fbc8cea37dc0ba0fd3b449e535d75cab27b19eb25eb9519d7814866c1de363901b20f61ae3d3a6e6e7790c10e4b4d405a045fa5bf569395d0

                          • memory/4460-142-0x000001CD48920000-0x000001CD48942000-memory.dmp

                            Filesize

                            136KB

                          • memory/4460-145-0x000001CD48730000-0x000001CD48740000-memory.dmp

                            Filesize

                            64KB

                          • memory/4460-144-0x000001CD48730000-0x000001CD48740000-memory.dmp

                            Filesize

                            64KB

                          • memory/4460-143-0x000001CD48730000-0x000001CD48740000-memory.dmp

                            Filesize

                            64KB