hxxp://belyr2bbbn6463ab5621efa[.]iamthe[.]ru

Analysis

max time kernel
299s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://belyr2bbbn6463ab5621efa.iamthe.ru

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\acc4b684-8784-487b-a522-8e73789b9c9a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230525070051.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2372	powershell.exe
2372	powershell.exe
3820	msedge.exe
3820	msedge.exe
2960	msedge.exe
2960	msedge.exe
2884	identity_helper.exe
2884	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3736	2960	msedge.exe	85
PID 2960 wrote to memory of 3736	2960	msedge.exe	85
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 2392	2960	msedge.exe	86
PID 2960 wrote to memory of 3820	2960	msedge.exe	87
PID 2960 wrote to memory of 3820	2960	msedge.exe	87
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88
PID 2960 wrote to memory of 4120	2960	msedge.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://belyr2bbbn6463ab5621efa.iamthe.ru
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://belyr2bbbn6463ab5621efa.iamthe.ru
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb396b46f8,0x7ffb396b4708,0x7ffb396b4718
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff758595460,0x7ff758595470,0x7ff758595480
    3⤵
    PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2023142431374687228,7881537434763055648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f32fdc0-22c9-4ccc-b440-0d65119f6da8.tmp

Filesize
5KB

MD5
939596ac371f8be44bbbb9e0938a4bb0

SHA1
0fd982f190fbf942450a1962137c9c074e4c89a8

SHA256
13cd07d64623517341e4e6ae29d5c28598c6d6d331082123790b744ed2309c24

SHA512
8d7085edbbc34728b93c3acae20a7f4b0f10effe246d207bed8c26dfbea0604b372345369931b5c2149ed3559b072dd719c2859377205f883870a394e9469c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ff133f4cf7256fe1e8a4b82d6d9594b0

SHA1
4bea57cb802eecb3e943218d97ed634731a4e467

SHA256
f13e31fe82efb4f931b15b64c2898d2e9629dc30d905e0b554a23383ca5df70f

SHA512
18a109ad299334eab15ece7f5581e2e6188a8e632df4034bd238368f29214146bb697326ec6abee6297fed227d90af7c62267ab1ba4731af68dc44d4f76a67ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5193d70fd67f5c09510ba5bba42ebb7d

SHA1
b400e4505cccde3e8e591dc154f249af0d7638b0

SHA256
302f5825fb9ee03ae8180cf2de959b2504322481a704a13f092f720fe14a2913

SHA512
d9ee01fcc355dfffa824fdad267c94cb1a8517619efe6bcd3a008ddc93249fcf5dded771c69c317b09c003ab54965e7d5d6e80637a4634545ed38207f4f11029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
8c7f76f18e420c3e914cb533f4f319b8

SHA1
884bac6c4540392c81fe33ae1b206d6d57480f4f

SHA256
9480f96f91e899669f968ae287f727f9b57bb62f033a1cfb34411143bc6e2039

SHA512
85b066353cffd6fbdeac7da01301ea9af47998cb7f8c3b9a1ba0f230beda4b5778c82db117a3ce985643bb54211a15828f2a00c3405ed04555027e303a562eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
a0f4a95a913d8f78d483ed8b46504827

SHA1
dc58b3df7996866e46fe4462b24bb04390c92573

SHA256
3771391c668954c8d6907717be7d1819de42550b40a89566be39729ef814943c

SHA512
e15a30aa1731df0bf1ab3752dd2bd9f981b88f7942dca4663190cf2edca1926184f7c0566c8b9eecdc92384551e4d22a4a705fc26b3c466f712ec87001b096a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
483B

MD5
74fa191f776dd22f8e6094cde63e3d8e

SHA1
c687bcc71661be8a039e13b137d027309ace3d7e

SHA256
4ac1c34604573fef1420ee894ad6980499d308c774db8032519471ac727f9b4e

SHA512
ab56429649f903c7570ccb0aac7216ab9a5d4813828c7ee523e212c05c66ee13beaa48948cbee1ead691224392382df63e66f0695f844bc5e4d495d525844c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
df6afeb1a220e27d82169bfadf86bc8a

SHA1
db0d96dd1fa34ded1871c80810ed4f959bebdec8

SHA256
144180245124667adb19cab115bdd953827373b03a0b138a0134bff868da9278

SHA512
b171fd9dcba1c1332970e02027dc9daaeffa6f9b6bb5be241053f107085c71c2485cda4041047fee7a40e52612b6ceb28adda6315dc424872d066aba050983a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
daaed5cdc2e8989bd1e058b6b9d182e9

SHA1
7775938b6e459f9f55f46da8dd1d829881f94a4b

SHA256
b67989618ca49ca643eeb6dde26271a2e1ab90d92041507a515d6da0e34b45f4

SHA512
d65c17ca8032067bda0083594878822cc44c1ac5e77b4cf4c700803a7e6f72d0da458746e68186a3a5d5245f7b7623113939566ca91da58d08ab066a70fb5689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e68979cf4d7f7595921a5d398ad968fa

SHA1
c9d5227b026921856ff18ecd844940bec156890d

SHA256
863701f0f196d9a3a35de7c850ed5fb082eca6020e5f70773c013ef155db9681

SHA512
811188ed1aebf0b527da9a55f6a436151d9b68f3b1af205a73d3a06bc0920d1f074e86423a3eeb284f14aed3a3f8859d3c840f0ebfb437e6ecfa0bc0812d1ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f60f9cc13af6e58943b66d2d298e2eb4

SHA1
0a775bca816e9072153dc569ea0da5ea80cbdb0a

SHA256
62472ea99c452ba5eba2c029e7edfb4028b8adb44f8f430673de3d1d8398d3f5

SHA512
67df4457ee8fd6e593782d10c28f7efff549bedb32020ae14d172f2af2018201d593f315dc5dc28635f44f2bc2e0202538cf590011be4697d0684739fe3ce8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b8b2277f82ea7c4b63fa77eda82df874

SHA1
371837bbce49b3d0294d37d270324f83d6e60b9c

SHA256
5282ff0db1fae52b53494d47e927f6fed634b9e1e18c9968971366a4dc201536

SHA512
26c0a6d2a2f6f3c90b406d7aa6a83f7ba945f0457e6f4fa774396ce761219e87b181a423313534910546b1416d868c6324bd259c978534a7f5469decd581f554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0a3fb5ef4f65aaa1d36750565e0d19e6

SHA1
9be19f2e19832c48eab5047f20fafd4b94548908

SHA256
7f7ed699023b3959b5fc04e7bdaee958d5bd2e9961f91f1a30f0bf70f01cbcf9

SHA512
7f474c8847dc0a7365e30931a6101487f553bd9c0f724a1114ff647094826fe35f4cfffeeb7e62790089354ae9f72da90cec7af45303e15785254111f9e3fdee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5918d33a53cb161d55c4ed6d62ca4c47

SHA1
7870e7e19b818bc752e8baf633b1f20b7902fadf

SHA256
242a766a73e5edc17d516a27bf2c0df02b40264860811104da68f0c5e0495a83

SHA512
aa1c5a382b7b572491b201d5ae92529ab7144b486a1528a138534daef9c2767b2e71fa4e2ff5ddca5ac6ba9769c2f9c33a381d35cbb5bfc470ded00caa921573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
69b72d0a4a2f9cbec95b3201ca02ae2f

SHA1
fcc44ae63c9b0280a10408551a41843f8de72b21

SHA256
996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c

SHA512
08d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
c6774cb00165e5b3cdac927fc09eaf58

SHA1
79ac0fba95806bcc42e1fababb5003ba1b418998

SHA256
99092f5a2b34ceba6225df158c2d77c46efec8b77cfc140c47015e4e49a6c45a

SHA512
a61c22856a8146ff7f03e669c7415d57e7fc65f51329595b2f9bf0308f9805469f3fe3e393168901bf8d4cf92983f6d16c7e7d5ea1f6720fc8ea509ec1a7b1ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqhy2pti.jqr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f7ea3e6620b2221de2201cb4ed8e88d1

SHA1
1aeb337a9ba9bd27a98607492d05d6338618b3ea

SHA256
2287d555e5eacbe95a57d2e7d02d4f1388444196f5a4c2fb8c8619760d4a781d

SHA512
f829580a60e4851ea63b2f172a2cd61683aa9fcfd13c0b5543be8bfa45648153340d6e70084a51031ae5bc37d6901599456bbdec4e8d4b32b910a927af53a9d6

Download Submit
memory/2372-133-0x00000293315F0000-0x0000029331612000-memory.dmp

Filesize
136KB

Download
memory/2372-144-0x0000029331640000-0x0000029331650000-memory.dmp

Filesize
64KB

Download
memory/2372-145-0x0000029331640000-0x0000029331650000-memory.dmp

Filesize
64KB

Download
memory/2372-143-0x0000029331640000-0x0000029331650000-memory.dmp

Filesize
64KB

Download