hxxps://github[.]com/cryptwareapps/Malware-Database/blob/main/Malware/Trojan/MEMZ[.]exe

Resubmissions

01/06/2023, 10:02

230601-l23axsea9s 8

01/06/2023, 10:02

230601-l2xqfaea8z 1

01/06/2023, 10:00

230601-l1xdaadf35 1

01/06/2023, 09:57

230601-ly19fsdf23 8

Analysis

max time kernel
88s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/cryptwareapps/Malware-Database/blob/main/Malware/Trojan/MEMZ.exe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1188	powershell.exe
1188	powershell.exe
4364	msedge.exe
4364	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	powershell.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2220	1220	msedge.exe	85
PID 1220 wrote to memory of 2220	1220	msedge.exe	85
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 1456	1220	msedge.exe	86
PID 1220 wrote to memory of 4364	1220	msedge.exe	87
PID 1220 wrote to memory of 4364	1220	msedge.exe	87
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89
PID 1220 wrote to memory of 3456	1220	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://github.com/cryptwareapps/Malware-Database/blob/main/Malware/Trojan/MEMZ.exe
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://github.com/cryptwareapps/Malware-Database/blob/main/Malware/Trojan/MEMZ.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8fae646f8,0x7ff8fae64708,0x7ff8fae64718
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10445221505439944778,13314824133418828781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
9c8986ed822970db61bd568abe3d8836

SHA1
902aedafa99747424fa51b2bf489ce66d18429bd

SHA256
747d935db548ef5554c8ee9eeaf0e01dceed8b53a1df2d4f127bab5bbc247754

SHA512
bd3fcc6594551fc4e70bad0c3fef510cbd4237359c5122102569a523373e2f78284d94b83e660874b9d6e0e065ef026006c0d868075aa362fef9bc9c670d2063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
443B

MD5
dd087a5ac3198949975315a40097fe83

SHA1
a997f992a4e90cd7ed202b2314bbc20475d21be6

SHA256
61688241be8f6f603975784dab916cb5bba4c080fa8d1320db5938ff22401b60

SHA512
b88fdda767b7be0ee24743f3e288c8042c64df371d3e419cd2ecde31dc5bb20bf47e22d9bfa18b3f06c6e4faa2badf1300b4f0594da7ebe7abf7895244b9cc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
606de9f9575c03c3314ced82bdacfc7d

SHA1
0c4cae1010dc5675fd3e31c88a79dfe6707d7e05

SHA256
c03eb2978c2737e377384536cac820fe45ed5d21bb85bc9ffbf52fbe135c40cd

SHA512
91be934363856d184d50d6855ad8b61a421bd8266158a0ae508d686c0b052a6ee8c9045bb055f6177c832d25b13b1591e07046bc802708dc023298a47cae8351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
1a9e7b72f3ce725b16f4d869090f6683

SHA1
17d1e2486d62fb3804f0fbd34a8055472a64e533

SHA256
5af13efa5ecfabaa005366749b302c840b36e64f540c78adf0e358bd970cfc60

SHA512
febf131afcef8b9a0644347d86dafed263f9929ba3bd43ce41cff9ec5d8415db2717ed7a631095134b54da5c08f75785e40d5e1813430d114ad3ca0739b732ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd5458fa7403b29fcb775b005e2a21e1

SHA1
9f32200a2f5e485498a9822325c571b7ebbc2882

SHA256
b011e530e94c99ff9ae52bd16a5983343f1a42637d34d721bdc21b9599d5b9f8

SHA512
701648dad770a4526c6c23da0184c69a8320b46d4dc93e4585508a929738660c36d14ddde4fe5a09879976d1b58e5348fceae178392374b5b23f2f2e9dd89bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a49d4d6b26cddce0cb6725397d73b66

SHA1
44efbb85603b44c906ffdd93b98cfcbfd010aac8

SHA256
cd927dcf54481e2df468188484fbeb0a74963a18119246053c097e931a9418f2

SHA512
65c4b5ce05eee6eabb48d85c22a82d2abff84d9dd29e394c6d498bf545c0974ec08040a0e18dc23cb05b4ade20f5d2d1d4e16abebcc0bcc3e1470eaee414e52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
599be9d0c7c7ded08eb94fd776841be0

SHA1
b8f81af3f2ca595d5a6f15f30804b82ca3e42eb5

SHA256
0e55843f09013d21908be7ee765cb87178ee7f1ea7d7cbb76c226232538908d5

SHA512
a4da7df999929404ffbb9292626ebed57c0a91c13dec19a960a6eb132b189d2164a7794b4ee831c4bfccacc0794e03d2fc9807a4448477ec0b67fa10a2e96204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a63b71d98ba4e9c389e0af169b66bdfe

SHA1
bcc52add850b5e87b00b608df5e7a53ce325d18e

SHA256
c1d6f7948a0e9513626755db1b9c3d2887871fc9e399f04af086516f95edd0e3

SHA512
b0c73c73374101b582855fad898826462a8769925d204721eb687c126de0958bf4a8e9ab9f6515360a847b32a906840ebd45b31804dcbb178b1b03bc216f279a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5736cf.TMP

Filesize
203B

MD5
6dd644fc31ad6363edfecf570a024207

SHA1
1fe44670b00ae4a48b08a51ca07d90ac42c21291

SHA256
8b451135a610c4ab4f29bd5de41db459fc495358831fa4dfb75441d81334fcbe

SHA512
77a9733ac4bcb5d76469718a5d908dc1ebee813a319b6dc5028b3ddd38e109acdef65e6d245154bc970bedd09dd7929e25a27a73818714e8e68e1a7d93b3aa8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ad815c50c6d1ccbb4971a31abf81ba50

SHA1
911987edb53afa5987ffa1a9d27f5592b576d791

SHA256
d4a87c215db4ccc9d076e6f6c3ee5bf3a75a6a73b03d31726e925412a0453230

SHA512
44a4a10a46844a9f10aee44ac302cb2d4a556d526e524994863eb132d99b1a2204fbd78e412dd01d82da6c6671999f9e3d1a3131e0885dc04034bbe8f67d0348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
80399202289a969d5168ee523685d3ac

SHA1
724fedfeb7be8d18bc8c6b08ab2b5f3571b21152

SHA256
13a220558ca09de3995b4946f2ab5651b99b4f9a8cca1f2a8cead0cd1d5cedc1

SHA512
a6d5c284ba54a05315be6fcf6e1b5406c950aee06d31d21e6c68a4c722d398cd83c72e915576f5bbf7fb9cfbd55cfe4d10623059e9d0db6cb28c1d8d14dab092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
9188d308f94b22afe01f6d8a77b33045

SHA1
70d0bf8ca6e088a49048eeda716644228fa88003

SHA256
0ba66dafb74a4bd3bd8d7e30af4f9bbb5087a2d981a23a798692b95c41f3638b

SHA512
f107602b7488048041e6c83ada37e0d5abe2d21f0f234a64212b31f3ee1154a722e2ea15a93c3ad03918952615fd1a9660a1d84570efe9c7e4ddf1a41615add7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvci32w3.ebn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1188-143-0x00000225EBBC0000-0x00000225EBBD0000-memory.dmp

Filesize
64KB

Download
memory/1188-145-0x00000225EBBC0000-0x00000225EBBD0000-memory.dmp

Filesize
64KB

Download
memory/1188-144-0x00000225EBBC0000-0x00000225EBBD0000-memory.dmp

Filesize
64KB

Download
memory/1188-142-0x00000225EB6A0000-0x00000225EB6C2000-memory.dmp

Filesize
136KB

Download