hxxps://hostavica[.]com/

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hostavica.com/

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6d29df73-8564-41a6-a1c6-6d0281cda0b6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230604122437.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2128	powershell.exe
2128	powershell.exe
1620	msedge.exe
1620	msedge.exe
4496	msedge.exe
4496	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3740	4496	msedge.exe	86
PID 4496 wrote to memory of 3740	4496	msedge.exe	86
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1880	4496	msedge.exe	87
PID 4496 wrote to memory of 1620	4496	msedge.exe	88
PID 4496 wrote to memory of 1620	4496	msedge.exe	88
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89
PID 4496 wrote to memory of 3396	4496	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://hostavica.com/
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://hostavica.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf92e46f8,0x7ffbf92e4708,0x7ffbf92e4718
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6b7955460,0x7ff6b7955470,0x7ff6b7955480
    3⤵
    PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1356,5707654414326575171,14268991471619820270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0a5abf48f0abb52dd1de0a4d2d04ffb7

SHA1
9ce815a53d22efc2312fa3bed33ec60b7a6f62ca

SHA256
890b5e8a24d35a0e705196d984cfe26a42ce38469401dc588e82dee288923d80

SHA512
d31196ffc37980a37e2c821991e7336e6a41d8c8b3666a8e1efbbb08ec3d00cb1163e060018e8f64415471a51e96eae1d8eebf206fbfc961080919a834310571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56e14c.TMP

Filesize
48B

MD5
a7fab36983a4504ee60153f568d05849

SHA1
31e56b55428671c121286ffc3fd5295a8c6bbea4

SHA256
f616fae35d6710ee20fe27ba95aeef6f2d1c19a20249f119ecb0498ad6e22f22

SHA512
dff2c5e16cfccb0969f6e478dcce4d4ad94102b32aa0f537bcca6afd9cd4fe2b17f6848ead91619ce0ff9c33d4dc3e296e4851b41a16e7f44ed419b868b0835a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
1703c344e7f90631badc374900865cac

SHA1
2356ef16f974bb1ca7b52dbe272b6e034041ddae

SHA256
053fd57174db673d0ecab9087c9c6b859fdd6efb8201ccc44393b7654750ef68

SHA512
468cd6e8d0e80a5e20c0aa3b4ec1cf648008264856d199d6c1f8c2cfbb35033eda21bc94211540d43093cc6439c54122f5de81c8247115fcc28577bf3e46e77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ecd0ef949aae4f90009e6fa209be0753

SHA1
89de0d24013150a16e1c5bce803de63ed67df7e8

SHA256
33c685e1242f3c72416533833db2b5271cb1cc8fe4f2e51f4f0fc34445650ef4

SHA512
651dc5a3b5c3cb30b8cb6adfcc7bc0f8081d23e478b2d0610c7b0cb3fcbe41768d66cda82338b52f5a06fb142bdbe8a99906b4a952f13c472334c5e7c8cc623d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
944601864c93782369de901875ba3e08

SHA1
ec64a84f1e0c247c3829c88640308af3d581a840

SHA256
ce4c88fd57fe4668ef0a22352bf38c89b110ee505a89c2c71266df334c458c7e

SHA512
0f496583dc048942532aa912cc4e7262647670ebec6398585f48974f1b2b5a109682826ef7ea11b50505a52cab17d5a64cff32e1e113e58bf5aaf21baa4d2c20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a198ae336b7183355517b58d6207763c

SHA1
e993015a5d2cea93f9a1b2757b157da1d6d3d07e

SHA256
0a99eb5916d381b4dd12647629cf76d763c93e41a0ad9c6c4a911fc0884bc4e8

SHA512
4182611b5dbafa3cd1d2806d8f073914721945697382ae98da24ccfd881d4330ca43e0cccee28d0ff12bcb1066f9d34b691ddd4b5123f992160bffba86217204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b55d2d6c6fb19a9ff3dac76913a6ad7

SHA1
2eb5972d210dad31a10bb3c41e779c4f357fc711

SHA256
b10e269bbb47a95d425f423c7d43ef3e5b27b3c78a201cf998a913b373e77add

SHA512
080d271b297839885ad1590a5693f13de54e13fbe0688396f3692f3ee0c0203dc3ca6c670d6e2c1d0ad0d2c1015f14a12821a2e1c2ae95106f48650333bb1edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fea82c96ae758ff475709fff1de3e59d

SHA1
20ce062bb5bbe2363e07bd025b409fbc0f17e733

SHA256
7c76223440d1dd2ca986c48477fbf673cc4db022b154ac3f0dfd93cb25be8927

SHA512
07ee5e62caa3930e8caa156e2cb2fce28bb4bb4d1c748c84bbd084387dc1c52bf3cc480b34d274656d461027c21abed5bbde5da26eed539691b0807b1a4a91ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9486f07c09348075ebc0c136d2c2a7c1

SHA1
03a1af74654d25136121915e004cc82f5bf2ecb9

SHA256
1eb99031b4303ddd73f2c01b33bce8337dc9d581683a6e3a83b1ff7c64d10c1a

SHA512
60ec84ce1f228fa2a0d5a7513efa63c49d9cd91e63b05e20dd76201744e152f28ed901f6f665217a9110827bda8451dcb1a0def880c813098c31c5c91303db76

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xiotww3.xvh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5cbec8044d750aeceb69f73f43fdfe7c

SHA1
9923728ad2d8f59ff9ef7359a1e46b3240043abd

SHA256
d274e851b8c9fa2697c0268ee12e1e52c3374d076948cc47061e867135932feb

SHA512
926c3a71264841b19410dc92beb4e23fbb12688191ee698e4c1dd333da1e4f9f498ea4069ecb6df3a24257c487d9939ec726c6383a24c72d7c11344f47e2801c

Download Submit
memory/2128-144-0x000001BB8FBF0000-0x000001BB8FC00000-memory.dmp

Filesize
64KB

Download
memory/2128-145-0x000001BB8FBF0000-0x000001BB8FC00000-memory.dmp

Filesize
64KB

Download
memory/2128-143-0x000001BB8FBF0000-0x000001BB8FC00000-memory.dmp

Filesize
64KB

Download
memory/2128-142-0x000001BBABAD0000-0x000001BBABAF2000-memory.dmp

Filesize
136KB

Download