dd3bd66ab94b92b2ed1e4b7bb0229098c2fe0f61bc085a8a288d95bb758e40c4

Analysis

max time kernel
166s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

commands.ps1
Size

418B
MD5

97290ff755649e9b1c2f3b5d03d76e87
SHA1

5801590111460f6ff6939ed7389719b0b1b40b8f
SHA256

dd3bd66ab94b92b2ed1e4b7bb0229098c2fe0f61bc085a8a288d95bb758e40c4
SHA512

8d4af2f1f19fb27c3fdaa173b364b39648b48a012876d6cd8af6fa3aad24696e7a62c321bc074737159a00baeb7a5cda0aa1ccafa41ab971eab0e94b29ca041a

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
22	1724	powershell.exe
85	1724	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\r = "C:\\a\\r.exe"	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1724	powershell.exe
1724	powershell.exe
2588	msedge.exe
2588	msedge.exe
1480	msedge.exe
1480	msedge.exe
2616	identity_helper.exe
2616	identity_helper.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1480	1724	powershell.exe	88
PID 1724 wrote to memory of 1480	1724	powershell.exe	88
PID 1480 wrote to memory of 4676	1480	msedge.exe	90
PID 1480 wrote to memory of 4676	1480	msedge.exe	90
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 3404	1480	msedge.exe	91
PID 1480 wrote to memory of 2588	1480	msedge.exe	92
PID 1480 wrote to memory of 2588	1480	msedge.exe	92
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93
PID 1480 wrote to memory of 3544	1480	msedge.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\commands.ps1
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure-online.site/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0xfc,0x138,0x7ffa633946f8,0x7ffa63394708,0x7ffa63394718
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8290083410849114143,11368239665742528619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3684 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70788d33-ca57-4483-aefd-4cc96ae1fbd4.tmp

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36e880a153003c1941b2014226e7e270

SHA1
aadd481da65a668fd7d067873062f5caa05f3efd

SHA256
a283b806870608cd054e618e61cdbeaf81651e1ade2ca3706a48d531729db92b

SHA512
6134ff5dc0123d0b783e55353511c269218c2a21662266702950e8413b3e8010ce4d8d50bf44e3156210c3fa3b16bc5cf6768d2a2aca9fd0fbfb17fac8b3e165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c667d0446f9957e7d349f45597561c59

SHA1
62bd53bdad16146f08fad7cdb10d159e66b0b1cb

SHA256
f519ab503c91633976a5f0935716decc04d199dba23ed38486643bead7e66aea

SHA512
5c151ec258996fd228966495623f0452ecd8942b29682954101a3c409c3f6d9765327e61a1f3fee7b101e5742864067f1e81522b692fe838360598cb09c05449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73f92fa58f40a794906b116e05d957de

SHA1
d345b86d1d55f629ab3b6ede6664b2235da94f56

SHA256
319e0bf17d3ecc93cef31071575c2a642c03c4fd52765ba56791f76d21c61178

SHA512
0ad3f0ea70a29b0d53db2a10640db11bdde261bbbca4e89e00abe80de21eb1b182c6bd2331a45dbbde0d9c00046fb46b44681fe9dc7c529c39064f13b5e36c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
918b2048dfc96aa261792fb2bf1c8df5

SHA1
6c5d92b2181084d981db02dde9fade2d7d157263

SHA256
f6aa2b399b52be9ac3106906d03aa5f48cfe483e3315ca3112c82b07b2e5a708

SHA512
c0f1cbee7827d803de9e8d5eb8fa1e24edfecc757de8cd94692e057bd3497586793fb08360ef82cf41f2ef64614276fa6acf6f3fafa9f3015d5ebcb322f34b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkn5l3a3.aq0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1724-13-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-62-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-63-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-64-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-61-0x00007FFA6D480000-0x00007FFA6DF41000-memory.dmp

Filesize
10.8MB

Download
memory/1724-12-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-11-0x0000029FCF6B0000-0x0000029FCF6C0000-memory.dmp

Filesize
64KB

Download
memory/1724-10-0x00007FFA6D480000-0x00007FFA6DF41000-memory.dmp

Filesize
10.8MB

Download
memory/1724-9-0x0000029FCF670000-0x0000029FCF692000-memory.dmp

Filesize
136KB

Download
memory/1724-135-0x00007FFA6D480000-0x00007FFA6DF41000-memory.dmp

Filesize
10.8MB

Download