28fbeb8ccfa7f5806fe4a72937a5a2c58d9ffc7376d3767fd5b3f83bd5bbefae

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

search_download_use.html
Size

1KB
MD5

37e7684c5ed67d4dbc24e5e91a56d54e
SHA1

10aa27c6e1f9f34077529f75cdff2fb19debb2e2
SHA256

87a9d44bb004b1f7e6242ee5cafca09066de91eed8aa2baf4796260644648dd8
SHA512

6d52193fc1050d98c867abdb07f367ab187175f566e0671183969379599ba6479160924be55518a77a75e6bf3dd17f3fe0505fff6f36950976ed5e8b8b2ea370

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b2e06e54-8ebd-4dab-9d2e-a1a0563d4904.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230524184848.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2764	powershell.exe
2764	powershell.exe
4204	msedge.exe
4204	msedge.exe
3344	msedge.exe
3344	msedge.exe
1208	identity_helper.exe
1208	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1864	3344	msedge.exe	86
PID 3344 wrote to memory of 1864	3344	msedge.exe	86
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4276	3344	msedge.exe	87
PID 3344 wrote to memory of 4204	3344	msedge.exe	88
PID 3344 wrote to memory of 4204	3344	msedge.exe	88
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89
PID 3344 wrote to memory of 1092	3344	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge C:\Users\Admin\AppData\Local\Temp\search_download_use.html
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch C:\Users\Admin\AppData\Local\Temp\search_download_use.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8059746f8,0x7ff805974708,0x7ff805974718
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff648575460,0x7ff648575470,0x7ff648575480
    3⤵
    PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14022518133870004392,3841901104829064607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f2c151cb51b92076070596db4a4cff4f

SHA1
715944c19ae2fa7b9642ab91d1924552609780f4

SHA256
dc7f54dc6f96b5eafe2094ec10ec052fa65867bf10c1dcd6fcd41ebe46c845d9

SHA512
65c15816226bc6a2e99da52a20b81523ee64787f04ab2893b1e1e8813544949939ea1d3a23dc65b95af06406f463f7c39cc579a8ecce1073e545e09345529ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
bea8d40e26f81b970fe3e0e1e70606c5

SHA1
576c60893a2fdaabf9adac882894f0ae2a9c8420

SHA256
d97bf205b76d45800cb1daeee35b309ff6982b28e159c7234c8860405dde6da9

SHA512
de99f270a9a94d22b63e319c0d83a801e801028a5a39fc24047b0a865ecec327bed8c2c8f44995eb9bb0e4c8b53776433e8c744aa6eca6c04e4940acfcfde759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc07234263ea0ee5e3067e46124c4132

SHA1
be3950f521ac06297f0637cc058d7f0cef89a206

SHA256
62c74f0cc3c1e1c424ea1415e3183df734672017789b8a3b13f9ef06204c965e

SHA512
679ec20ec530491ec5f9484c621f10e819fa5f38a05b283c685fe2fd6afd327267522653c8e175d74a43e6fab415a38e7c4af1b8559bab867bce752a266231cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e308e8b9c8f8fc4bab59bfc416ba6655

SHA1
4a4e28fa96d0bcc14dc9a05e143a42807d494788

SHA256
aff38a235ad8bf01f29fe19df9105a84c6c1ec974cdffcad79797425cdc995ff

SHA512
317d80beff2dce5f8fda6db4dc8d85efd01fcf2eaa5808d8cedd688c36fbdbd2ac31ba7222bdd52addfcfd023af95e66de05d032622524f530ac363165f942a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8f0ff1408266cbadceb994732941cdf

SHA1
59e402488751bb7af46ee84ecec2de2fd56ed5e2

SHA256
c4df2e1773bfff9605c47cac55815def416e70a46484c36b61c8f5333a71cf9e

SHA512
09a20f719688c4df193aec9a383ac39f97e970e5eb322e5fa05ec4d86e94e1d29512d9a927eb0a9562008eaa4a11e8eed280e13c5c0dd87306ca8d1405d5e0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
89e3105deb4fa7baaba72e57d4a41960

SHA1
99f58308558a16d4322e5c33c6f378a21ecd7ebd

SHA256
8839ee94c83db6d5681865eb7e6fb2a9d536e796fe7c0e7dc585fc67e66fdb46

SHA512
2215b8e6a82cdbbb14367e5f29558364dc6a724fe85a791541b2ec520f71bab719174b2ea93057f6b7383003b9b376d7b5721cd63ad5c63e9788dc2a76ab4140

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tknutmu3.cd2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4a834d03d80756b3f8c686b8dd3596da

SHA1
3802db6c81437c7341c68587d840decc8f700d10

SHA256
7dd50ce299a4d62f124bda6482b88cc4e0a0a803e2f8c571885da86546758abd

SHA512
640b8b1d509f4496f5c659bc8788d40691823ac9d20585664c679047f016ad319878ac6efd699a1385da2ec5098c716f65d41764dc9b85e523eeaf71a9070ee7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1197518e8611a355a84670f74384b4db

SHA1
7b85f0d6f9b43dc5c3c8066d90b07b639a7a439c

SHA256
79fb35300e84287590672627cae8ce5a5a3ebbd89320170402bd5c6a491e40d9

SHA512
674123f2c4461bd6078816e6e148d36370c90cf50d2d29f5b452b264a8085ba7ff08bcfe7c464f7065d8cfa52887a99b4ddde5ca85f0f4f0f45017f2960bce96

Download Submit
memory/2764-145-0x0000012DE0AD0000-0x0000012DE0AE0000-memory.dmp

Filesize
64KB

Download
memory/2764-144-0x0000012DE0AD0000-0x0000012DE0AE0000-memory.dmp

Filesize
64KB

Download
memory/2764-143-0x0000012DE0AD0000-0x0000012DE0AE0000-memory.dmp

Filesize
64KB

Download
memory/2764-139-0x0000012DF8FC0000-0x0000012DF8FE2000-memory.dmp

Filesize
136KB

Download