hxxps://rb[.]gy/ehjv9

Resubmissions

01/06/2023, 12:34

230601-pr879sec35 4

01/06/2023, 12:31

230601-pqdd7sef4z 4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/ehjv9

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2a24638a-2a38-4225-9e3a-efd1513bbd58.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230601143210.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
4788	msedge.exe
4788	msedge.exe
2152	msedge.exe
2152	msedge.exe
3068	identity_helper.exe
3068	identity_helper.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3248	2152	msedge.exe	86
PID 2152 wrote to memory of 3248	2152	msedge.exe	86
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 3196	2152	msedge.exe	87
PID 2152 wrote to memory of 4788	2152	msedge.exe	88
PID 2152 wrote to memory of 4788	2152	msedge.exe	88
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90
PID 2152 wrote to memory of 1588	2152	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://rb.gy/ehjv9
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://rb.gy/ehjv9
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb9a8746f8,0x7ffb9a874708,0x7ffb9a874718
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff710de5460,0x7ff710de5470,0x7ff710de5480
    3⤵
    PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16063212098803689030,1106629142557181525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
360B

MD5
fe2c3553378b107104f5c3f9b58c6c5b

SHA1
f36c562d4bf14c2b6757db4467985d8557dd2354

SHA256
30699ceb0facda624dab2d5ab3bcbecf8012a2b7eb50f7ca91a427b9d587f3f2

SHA512
6de9fea385fcd6c6dda31ca164b88266ddcdce50b2a9a8f74f5f5e37f806e8e270f9bd265635803c35766686b92a2c3e9b13a3e6d826f91d5b98777045920e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9cb37f323baa59a99525f32182d0229b

SHA1
902a84017be49211c31288d8d09ec822ad9e5eaa

SHA256
27f08e163147ed638a03f956ed7e1b3489e192c35774eda288ff6b7808e66310

SHA512
29939a678de069d5b52b027bf115ef5b019872dfc2cd07843b15cf9bea650ecf13d44978d58b473c9bab15ec3bfe6475bcea07817689a550b0ab4994294e1afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d01ed10355124b35f81089592a3ef3c4

SHA1
eceadc6a4748baf48e0a848fcf53f2234e3cbaa5

SHA256
0f2bf23d26de40092931009e9e27497759832a06c0d65bad22416a509906dea4

SHA512
8ae595d7d23bbbaa6005b87108b09a438d5106c2d05da43ccceda195207857b794e0afce40b3c1448e820202ea3254338697f59148207734e401fc773248d66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
d795888753bb29cc15f818c123944d98

SHA1
7cfb29e21cc6e7f6d6e026a131ebd823128fbde7

SHA256
cc67b499539b18f6c4afce05fcad9c00c264793aca78a9b2dc61e2ef18fe31cd

SHA512
b1930d488fa342886ae1657c20452ea06d5d4772b143c92428aeab589377b0684d18811aa3c0cb8b304cb61db443afa69417d8d0ce5f87c469e66b0a76e266f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8350b34e3177b5f023896ab1f75e5afc

SHA1
c98ec062d53095bab0b5fa9f36a1004e0f8cc6a0

SHA256
0f8ef02fec13d32b9a513a9c703b36146d0812722eaa5e2ccfffad50d4e43ff4

SHA512
e0cdea4b7a7ff5ea701357dbf62bd3886a8e10a66d7a7284291162173dd2623b53de8eb5ab4d2bfb28296edf100c0981125d5c291eeab1efa52b0361123e090b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
b6391b279cb2276c7a566eb4c33b15aa

SHA1
fb2efcd185d9eaefb06428974eb0bbe9a365425d

SHA256
42c41d3e66c552d026141115ec3d916d7826bbf534d72020905094c1af314c79

SHA512
1c81681c61f92ca915547a8ee23ac534c795ff7c2b04fdfbab11aca862f10dc37c9c8863a23d893fe6a0c03f4ab4ba329eda0fdb9ede67e8bbc8d8fd84a271ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae9decc48e9fd8bcf79aa2b0c331fbd4

SHA1
cd4e072b1139d2dbfe6d0a9fdeb32e7a67947b6c

SHA256
a388dded5966deb00b46e0511d8dbd03a8414a9b9efaf9d701e357fdf1745f0b

SHA512
41d82392ba51b07b74eebd2792f84422f0507094fe14335a889c14138d754714f45464a5c5a5c8117e944c2b74e054790fc1056987cfba2cf22d7245e6f0bb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5f2197b8f5ee30bdbbffc3c6b2184a6

SHA1
2290f2e2720bafc9c3ed55ab926aac28cd4d7eb6

SHA256
8691a19023b7e36415bb8f67d70546ad5155e4bf342c99acc346362fdd7fec92

SHA512
18672e09bd140482da24bd6db43c499ad2e07a914bbc794fffe7f7c48535ec714d8de83a92b3578378c23f7e05693adaa48f8c3da7c8cb625fb5351468a59c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5355f32f9c07b7845cabaad9820c612

SHA1
90140a3af05013759d268dd76d6f3a3f70758ffd

SHA256
c8cb06870ad8db9037807ee25ade9b966cf4fbe9b7b2a6dfbf8f2cd2c29cbc01

SHA512
7305fd3826514bdd39c27ccb03d994e5107de0da7a37bcf61d36d1a627d94f295140e41d559cd73c764c86006d8f6f9252d6e031fabf5cea5c6f5f9ffcb567ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5abf05b4c02d2b2eb5b6b6cbb8664a36

SHA1
8d640889c5ceefae487d9acf96605d5c05ebc2b6

SHA256
43d4e23d1bfc2258eec3c866c852cd525e8a73cf38acf4032dc4580b0a334c31

SHA512
d0965ce21c04101d7ad3b7f5215fa750a8b6e8d2d315a306169fd49fb69984ed1e34b0bd2039fc50722a5eb33644f965e46af77881156c4880266156a6810cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
0ae71a582daeba1e1e3bcef3a20b6c8b

SHA1
db9ef7203bcdc7856cf55b73aa27f5190fabae2b

SHA256
b310843af9da494328f9820d6d437ac0f30548cf91cd0ed35741db09ffbc2f70

SHA512
7f250ec5e2e8ae1b47e1ae1f8c6ce9162db233d5a277f1ba0974b6f06f507bf166db8dd3e588bb0d5d3b40a241388b40aa63f009ae6f3dcd56fbb2608010de5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe575dfe.TMP

Filesize
372B

MD5
cedf2fe473bdad6142f5b4d0fac82109

SHA1
fb4344a33ced0edbe578c9267b4c073ef1378053

SHA256
2c1488561feca2b84ed3b0f4af9e1368eb95eed681b7f0e438ef759745b2c3c6

SHA512
de8e005a3ebdcd2e47ab93d19179da150ed98814529acf1c1a08a2b3cce19645175a747f02f3ea29e214acf45765ce3e06301feb8bd8a18e2659e45d72aab21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dee2b33a-7483-4d4f-a7b5-ca370a8077d9.tmp

Filesize
539B

MD5
295fce8a2ac3a18c9773afde0b912ec3

SHA1
42cfe8521f54c986040a8f4dbd2196d13338f964

SHA256
41f29eda2385b7f9c3d9af829d772e943f492fd16ea2fd2c6caa663acbe758ee

SHA512
3802d8c7d190f7c0edaf81fb36fa940094cdbdbd09787a49da57bbaa4b6525f3356dd832b5a33aaef2a31a03e5d67c18960dac8bd7cf01c428aef090e1642182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
648638098f87e15f064407833d50cef6

SHA1
c85a3bd393f4fc9bcf13ec7b13f170fe2e679f25

SHA256
e92b2da7127c9fc16c619ee55d9cf96ba32ccbcf3898ac37c88f80e96170eb4a

SHA512
e058189da2e6927a397e5b7b976caf088bf499f8b8a34f0542f6708ea3e26e829b8959a7ade20ca52147e76ed27a135c810b554dad81f2a003842fa6901f1197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
10f7c70a8f589100e64444fe6f7a685f

SHA1
5a33bb64c98e1329b9375b59abf844dcda3a3375

SHA256
94b39230cef9a3e69568260d117c10cb4bd57cc09a64cf9a16dabef16090ebbf

SHA512
09af658eec259a3b16f496b9dfb20a587b76cd7b26db9cd86dafd477791924148c86b312ea9dc40509530a7d78c82c1e782ab9c88173a19094e69bc3a460b18d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3x2l5rqy.hnv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
aee06f27791fb3509f587a4ea0316da9

SHA1
156413bc7c4d11ed24fe224a559a8805d8e7bd23

SHA256
70fd7afa94b51fd1b698d9c877b819467781ba3e5dec5261c020b96d295e6957

SHA512
d196d9d776d8fe63323bfcec04c2d147b3fdaa983f384a7893c2a2b1b2a2d992d85bb085183366519f7b02584c94627e478270c001f64605b60eaf36ff6e104d

Download Submit
memory/4928-133-0x00000131728D0000-0x00000131728E0000-memory.dmp

Filesize
64KB

Download
memory/4928-144-0x0000013172890000-0x00000131728B2000-memory.dmp

Filesize
136KB

Download
memory/4928-134-0x00000131728D0000-0x00000131728E0000-memory.dmp

Filesize
64KB

Download