hxxp://www[.]log[.]in[.]meta[.]HL3bNNuy[.]dv[.]la[.]gv[.]uk[.]n5fBJcuqM1Wx[.]homebox[.]ir/[.]qzq/[.]zqz/?n5fBJcuqM1Wx

Resubmissions

30/05/2023, 15:55

230530-tcykfaah3z 1

30/05/2023, 15:31

230530-syffbaaf9z 4

Analysis

max time kernel
39s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.log.in.meta.HL3bNNuy.dv.la.gv.uk.n5fBJcuqM1Wx.homebox.ir/.qzq/.zqz/?n5fBJcuqM1Wx

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230530173209.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b209816f-f38b-451a-a766-20af3ad43211.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1356	powershell.exe
1356	powershell.exe
4068	msedge.exe
4068	msedge.exe
3792	msedge.exe
3792	msedge.exe
2892	identity_helper.exe
2892	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4012	3792	msedge.exe	87
PID 3792 wrote to memory of 4012	3792	msedge.exe	87
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 880	3792	msedge.exe	88
PID 3792 wrote to memory of 4068	3792	msedge.exe	89
PID 3792 wrote to memory of 4068	3792	msedge.exe	89
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91
PID 3792 wrote to memory of 644	3792	msedge.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://www.log.in.meta.HL3bNNuy.dv.la.gv.uk.n5fBJcuqM1Wx.homebox.ir/.qzq/.zqz/?n5fBJcuqM1Wx
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://www.log.in.meta.HL3bNNuy.dv.la.gv.uk.n5fBJcuqM1Wx.homebox.ir/.qzq/.zqz/?n5fBJcuqM1Wx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c36046f8,0x7ff9c3604708,0x7ff9c3604718
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff634f55460,0x7ff634f55470,0x7ff634f55480
    3⤵
    PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2395084221404285206,17471729548996309784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
20f1289d81183d5574c6853083dc0027

SHA1
4f8da889654002beaf0d82afa9285724db5fc3d4

SHA256
15568d85e678c943ebb7693fdb5522485adfcab57515daeb4e17a378d736f5f4

SHA512
20bcc87b910332f7e29338e37cb84469b4077b57117b927c95c6af9db7cb856d0e8448c58bb656f2ecab85643937995deb5302b28dec8fa27c1000ec42f6cdff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
300f1bd7b4e64abbe1fc13355693445a

SHA1
c2f43818577a94603536c017047ff815bd96b8f9

SHA256
f11d320ad647a154e2b31ea3e31572327032daf39900b95de781ec7864967ea7

SHA512
025b1acfca05f4094887bdebff5266af6a9cfe3da16a94396565f006a22d8ec87a9c1607781696e2953074fec9cb1ac3f2d3e367a85b782a759c942d0d98dc62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f48245c072366d718f5d2a49f8ef949d

SHA1
19c9bb14f1e6010bfa63ae4c8b234461d07a6237

SHA256
752e05803fab508347fa4a4048ac34c053531c5acfea072a8e0ea53deca7abb0

SHA512
bba233821416462627b5b96daaca3edc33c3b2248acb6f2493d758df0180b51a8dc4146b2efc47f4c10a3102f694e508bf9d81da0054428bd28402c5a7092337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0622128f7600e7caa328476c9d88328a

SHA1
df44bfe0d6d8b723d1937e04b255c77bbc486591

SHA256
e366593ec45669bae63d68d9763913a19731bbffadddc112212cfef9a10a08ee

SHA512
8575c37bdc53132c547df2a743d04712f2aa357f40816ada457e1a08a1360f0d87056a127af2fb768431f11dd6f65a592b2a02726c05d982bfffb26c17819185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24a442def3ffbb06d7bdb7b1ab63cc63

SHA1
83f61695ad1da2f09334c2511d2bc98cd47dce58

SHA256
f5eef62f602ccffd58981ed90cb02a9620234df43430889a74be6a981b81f780

SHA512
851968764c2a137857c875e410cdeb5da5f1621f7ba415348490aa61e547215f5b2051a6313a0cbf5e27857cd62cda2d6e5ce88ab08c08401cfdc9dc25bf3a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e79203d0f70092bf25058099947d5c6

SHA1
20d5e2bd3a2ef807207bc3981bd5494c34839c0e

SHA256
decca6fa6de1f0dcc2b46a7c45e62d1754fda43b509d92393c628d56930851a6

SHA512
b06c5cb26083e2ef7a407be262f37d83d9fee4788e30a94ce258639f7c1fb2ccb4e37ca9b77e4fb30c0fa0a9e80f94a5b9719efd2499c87deafc87d260eb0568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e5128aa8f3dcc179e8854fcb5e80ac8f

SHA1
a6e15ff92f62ce2c8600511a687381e1664450b3

SHA256
cccb2dbe37922f820b081435ee927b2c53fadb1a0b9158965809673307f5e711

SHA512
17e5749360532daa149c48ceb16c2fe5e1fd9b995f09694aabdcab2bea7b144c685b6698e5149bef4539d59c283c3132c201820e8587c706df54849cf44f493e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe570484.TMP

Filesize
872B

MD5
f7103774de03531013f796900f5ae3c2

SHA1
0403377b728efa31d3123b588adbf6979bb9a309

SHA256
644a672dd679b497ac57ab33753dbea392aae0ef02c70645124c1c145101ad82

SHA512
cfcd03ec42af35fb5ff598971fc116ed00532a4a729ddfd3830a7e3f4526b48d384f4be6824ea8c3d0bed70abf0e7c2c411fc886b1560b93ec6296563e3a2795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b729f3ea82e1af078131c87d973fb545

SHA1
6f8c137f7cef0e5cf9e689046443629e4f6d5563

SHA256
224730970ea4c1869cf9e5929714faa5d5b21fcf83c02ef075e80baa410e5c98

SHA512
718403da62de59e74ac9f55c78b2185afe2431b0927e48bc2f1f9c92e3c87bc968a5463c6f27fde44abe0a6e3be3bed220bddd42ca3b24ef8724e4ecaf517249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
33cd5f51780c0e3ce4e3615e00d44cab

SHA1
255881d14a36c746469a64b2c6a4458aa34e4e3d

SHA256
3af78883747801f755007c71091b07394e3c31e9731e8db6b5dea75b597ba1ed

SHA512
79c9a25af9b1b288f19b0ef7e48c8a6d80e6cff4632db09639c91d66e883320d38f1aa5ac7ea0ec529919952d0487027a1157aed99d348c1f73a993d61a1348b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cw4houwn.um2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
af7d7cabf11ba91ff12e3b00e6ab361f

SHA1
181436c8894e2bc0c12f0d52232ca2b11cd780a2

SHA256
1d4df96abc2a1b9e739938cedae3953f69dbf3920f37a988125fe3b03d00a920

SHA512
660786939dfc7415a060455d86c47790f5f72d2518a9b7451c7f4df5b36888357697ad36ab6083a20afc345124a06e45d20db1e14a1741614cc5e516cb8d940b

Download Submit
memory/1356-144-0x0000011BCC120000-0x0000011BCC130000-memory.dmp

Filesize
64KB

Download
memory/1356-143-0x0000011BCC120000-0x0000011BCC130000-memory.dmp

Filesize
64KB

Download
memory/1356-142-0x0000011BCC0B0000-0x0000011BCC0D2000-memory.dmp

Filesize
136KB

Download
memory/1356-145-0x0000011BCC120000-0x0000011BCC130000-memory.dmp

Filesize
64KB

Download