hxxp://libertader[.]org/ymkhmhvc

Analysis

max time kernel
56s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://libertader.org/ymkhmhvc

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8b312c31-7e69-4187-8606-bb7987f0cf69.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230614065731.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4380	powershell.exe
4380	powershell.exe
3396	msedge.exe
3396	msedge.exe
2596	msedge.exe
2596	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 652	2596	msedge.exe	86
PID 2596 wrote to memory of 652	2596	msedge.exe	86
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 1456	2596	msedge.exe	87
PID 2596 wrote to memory of 3396	2596	msedge.exe	88
PID 2596 wrote to memory of 3396	2596	msedge.exe	88
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90
PID 2596 wrote to memory of 1532	2596	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://libertader.org/ymkhmhvc
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://libertader.org/ymkhmhvc
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc4bd146f8,0x7ffc4bd14708,0x7ffc4bd14718
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xc8,0xc0,0xbc,0x140,0xb8,0x7ff69ef95460,0x7ff69ef95470,0x7ff69ef95480
    3⤵
    PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14907812097747992661,11744368341407482540,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
2564fd8f8e6ac884eeaa493641af2d21

SHA1
4369576c7392d123089ea6b4875056f52a38aca8

SHA256
e44c925f76edfe2aca8beecd02daabc356c545d085d5878a4057fb8f7230d937

SHA512
727102af3f4bb50470f004e6f74778c43183aaa338ba169ef678d6d54d948c90edbdb1515eaa56ef555cd29372332d99a360ef3a10f0d33b9b7bfbde5cbd4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5227949992601eca32b16a2107165b2c

SHA1
aa3c27b79903a655dbd7aaeaf71811ebc097e349

SHA256
3b59a09ac75af3df3d0346b91685663e6ac72283c73f15633fda51e8295a7e69

SHA512
82238e0968567fc61dbe1dda253fbd65cc9076f5cc23ba5039b88bb1af31e63c832d3d997dd733b389623ce224f22c5076c479a73547067617bc6714f6b59d86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cfc519bbc2fb59012c189b4b62c07cc8

SHA1
70266f7bae28463a7806856258b73be8e6c55f77

SHA256
b91094c551431eedc0869759d66b226fa6dce7d42c602a5cec9f130a29860319

SHA512
a518af82c5920cd188812e574a66ae68cf47d471a34112ced6394e17c651aa4852f3b2a02d838f9a68a9cb78cdfe6a024fec3ef300a1f9e5395671ed5cf0a13b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27568527ff2f97d58818c31725cfaedd

SHA1
347423c78d35ef35d0c135f0a29cd7fdfc0a65e2

SHA256
8f05bb8955c4567e48fff1e1b7c0e74a1480bb91b40caa878042ba8910cedf90

SHA512
c2e8fa558f80cd1fc5c8400421f0f6eb407cf1218567b7da5735b24db2e15fd5580bb9808f1ada2e43869e837ece5a6dbeeda143512d67d57e2a8d795440851b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8a7cabd7ebc821dd277b76f49092d0bf

SHA1
4ddcdd8f05b045eadc7469d83cf7745b6f54fff9

SHA256
a11a587a81c5c94db12de75e68aab4b7fee63e848ebe59d61221c45df081d8d6

SHA512
5d06fde984fc150c344f144064d3f77478708ceb96574681c0d5d7db37da8c1193b971a0ddc15f9f1baa8faf5080ebcf7f7647e2231e37224f3273d96604ecb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fc6e60419f0b514d37ff6fc174d08494

SHA1
1aadde434476c8335378ae42edab29b33779bad5

SHA256
4c7545237810aa48fdf8260220f5e0bb2aa5f782f3a8e037b734bb6f1927a473

SHA512
fa542bd2ddeccab9ceffdff496bbd64308a2fe843b5c402b732abdf778ad01340559c448af5ebedb5e63ee7271c199ce4e2f925e2910a4fd50de88a3e7d7b4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c17ecff6c5df35d2c5f1689bf5c45353

SHA1
955ee7d5be2f2abd39ae5f53a2116aff847b0537

SHA256
5958e0c53ccfb1438687feee24ecc44d8c721c8b324cbde4532674b3abc6c45e

SHA512
7a6932dc9e407629cd5c6da88b1062fc19f0262111bba7f8430d046617f5cff4c21153a388055831dd45c485b5638d1c6f81070b4022cf20e9ca2b5820e37c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5aa1y32.kcz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
59f1d36cece1343296eaa9a69b654c04

SHA1
64ede0c7303d8ce03a12f45fc1bf844c47f183b1

SHA256
bf2320344871504160b68d7f36692c1550665bcfb41fadace32a486147ac26ee

SHA512
864102f27d385de22eb2070150612d89089b18f81cca9c56a46fab6386e7e4cf889555450f53404db832dd505156672166405aaff148a325e7be9659006e01e7

Download Submit
memory/4380-145-0x0000014FF2A10000-0x0000014FF2A20000-memory.dmp

Filesize
64KB

Download
memory/4380-144-0x0000014FF2A10000-0x0000014FF2A20000-memory.dmp

Filesize
64KB

Download
memory/4380-143-0x0000014FF2A10000-0x0000014FF2A20000-memory.dmp

Filesize
64KB

Download
memory/4380-138-0x0000014FF29E0000-0x0000014FF2A02000-memory.dmp

Filesize
136KB

Download