hxxps://github[.]com/TheysR/WorldCheck-SIC-Processing/blob/master/Special%20Interest%20Categories_Tagging%20Guidelines%20(v4)%2028%20Sep%202021[.]docx

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/TheysR/WorldCheck-SIC-Processing/blob/master/Special%20Interest%20Categories_Tagging%20Guidelines%20(v4)%2028%20Sep%202021.docx

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
107	raw.githubusercontent.com
103	raw.githubusercontent.com
104	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4020	WINWORD.EXE
4020	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
4980	msedge.exe
4980	msedge.exe
2468	identity_helper.exe
2468	identity_helper.exe
6132	msedge.exe
6132	msedge.exe
6836	msedge.exe
6836	msedge.exe
6836	msedge.exe
6836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE
4020	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1884	4980	msedge.exe	87
PID 4980 wrote to memory of 1884	4980	msedge.exe	87
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 1768	4980	msedge.exe	88
PID 4980 wrote to memory of 2492	4980	msedge.exe	89
PID 4980 wrote to memory of 2492	4980	msedge.exe	89
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90
PID 4980 wrote to memory of 4524	4980	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/TheysR/WorldCheck-SIC-Processing/blob/master/Special%20Interest%20Categories_Tagging%20Guidelines%20(v4)%2028%20Sep%202021.docx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93e8946f8,0x7ff93e894708,0x7ff93e894718
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6132
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Special Interest Categories_Tagging Guidelines (v4) 28 Sep 2021.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7532385227652315791,16974790157940550725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ff9923d60f1c26b000705ed1ceb17aea

SHA1
9bd03c4c5a36f410f4313de1ab88ec778edf05ab

SHA256
d58154d7d9f0fc278e6e8df4fc6e37f523d55d2b3a9262c7e3aee59be510f3c1

SHA512
138c41df13e172b97d441956a2f1bf605b69e76ad255144a7f160341629a5db889f0dbc1ca3123b4e414255e7b6d13d2c5227d8ff07d1eaeb9f02b1de21279f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
aa12a4329040c53e6405bf8207db6ced

SHA1
2406f046273132d2af136cdc4baa12e464a6a8d4

SHA256
dcadc13ede2a08e68bc2db48026d84d4d9e5e9b47866c3d3585a60f231d54feb

SHA512
2a94e26ab14748bc723b359c48c7b685a3fe2ecbc2ed558b87106cafff1573b14067c5e43138f3d2902dd084e404dfc236a70765c1cf5cf08c467f657a796297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6dc8672489d1d530e4f63a15723805b

SHA1
566df13460fa4889f46c9c2528d7c2f7ce685c5e

SHA256
fc0b3604a7c37e7840ca64491c7835d5268b06822fbd9fbe539580715e2e79c4

SHA512
585a1a56eb9a1ba845269ea7ba78eff2af955947f469e8d9dddae25c751ed08be33e6deac8c8f698083d00b0284aca16df9a6d0784c79b39b6ad192cff7b36ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a88197f472db9a2d92e5892e6b76e167

SHA1
3d36277c91eced5b96e32ce36933d6fbeb154d22

SHA256
f568242b6663e0c1d88bf7a26ed5f263311c150a3d4b4fff00fccf3d389c932e

SHA512
c3636bab98a687f1a785cfb112912af4a988c33ca3510c656d2c1ffb785c80006f82353d2dd2c3174b85c05f224b5b94c49a8e252bef3022c3610763b579c909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d43020d802c9f4cf9e13c2cb524d8c81

SHA1
dbc684e44eae211607708cd48cdefd202cab6fc8

SHA256
1487b8c39b03aae72b6375e7253bbc87289ede0a6d54322c08e2faf26b4d0d83

SHA512
0a7c32124744cd70813a9a4572e7401339a960278de69beac65c21d3853dc86dab60f8bace2a6b68f3544d9e501c3e64dd5c8a371ad99f3e7cf46463d33c6e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
fa852d0765f759033ee5fc0f6934caff

SHA1
165626f009ff6c61511b4c68ebe87af9b374d11f

SHA256
53b9fce4008f4e85bfa40f551a2b360d0eca6934c65905ee3cacc4b3c3f39a72

SHA512
e11d10480c8b0b8c3371c07dd10fc41da3c117e1e2eb4a59e6c6f8e5806f95f0ef08ccbb7676ee9b97eec20bab0c2e3e5595b416404a5ed968af024d25a3cf37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579124.TMP

Filesize
706B

MD5
71eb9d031af40dc52dcefc10c22edb42

SHA1
f4c55a887346411e7d43b96bc6162178f0576b5e

SHA256
d6897fddc40570852601d019e5436901f8eb9d3124579d2b4a4cf67f03fb59ff

SHA512
259eda15a9573eb27e9df59616f43001aecb9244bc80c6e066be43ed1365c4d5ef262b7dbb2c4cc1b846eb666c980c0ea799ee14b437c3192038a94d6b6e3951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9012c34a8a820d9e894a3261ed3cc227

SHA1
d5f16be203d1158a5198a178b5f34400875dfa28

SHA256
5f220a483dd144d7927f9ae2c850dbe4c8a4c268c0a60f56f008f495bf03fe33

SHA512
51b1089db5d733bbe12ba46979119e248636b762f59ec5118f26655a689964aaf06e7d87876a95780969104585fcc30034c9888eeb60930e95de1c73403167e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6a5622cf97bb0cf7733f8d644dfada0

SHA1
0da6efac9f509201c0015168a6b384a06d0d1772

SHA256
4a27ec5e2eb57535c3ddf53869d6a4dea74b1502292df13a57b74c36bff558fc

SHA512
7a84a87c05c96addbcf180bac5da9b72d6f181def874ad107f5414ade73af995f4df07c8ed1ca46138a508fa69ef9680a54721a7060156edf19ff8918c357229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
1bd8336dde5bf759b646e8e625cac5cd

SHA1
1b2018fb8c123621839165ba9a785cfc1a8b4f8c

SHA256
d75716c2bcf98956390074df7cdfc13c9f20c121f60d6644726438f39ab1c50e

SHA512
6242ccb0534823b437d8e8bf2509828d09c2a93144a537fb573758445b392b61ce37670678a6ef8efd0d763f306295606831ffa3265b44903390e0f90246654a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDCF1B.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
335B

MD5
a5b9817829a7ad80164e55de96f361ae

SHA1
efaf8700447bc33bef85df8cd000d9037c5491d9

SHA256
90a90c2938dbbab27ae6497e9d2abc7bc7099fc8b094cbc2f97a535c313b39d8

SHA512
8f52ea770b9be852f9fbabbd125c9d2e72b1c134b3e763c6da811476b61a2fc57c7e65eea8098be6be16e2b953ea3aaea18e46dadaabe7d1851c049f0cc5b479

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
592738c8c262e387254f668e2e8e716a

SHA1
4eb49e66ed5a18ebaf35e2ae4e266a7baec1a59c

SHA256
f9a089b3275dc41459a6f53b544ff3437feb051cbbb7139247e1c7f0820cf13d

SHA512
d67883c4484752b20125cb36351b9d55f504c77ed6cfb67f5f8546fcea423163c6956c0ff3fa4689e5e3c209d8ddd96bab09eab89d1c8a27128ebc7c85268865

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
7f04d64a6db60cab5efc430c4040e8d5

SHA1
7ca44fc25cbe00011e6e4a5c03eb049bcebddba9

SHA256
6edaa05f7957118863678c03bb30e55e91cd9a804411c0ff7a873fdfb912958c

SHA512
28df3510b4fb3a0ce9ceeb16dfdced69cc293b423be2aca1d4cce28884905e8bab8b9a1a36cace0fbfd7eb90e54d86a94680de1a20c1c6e620672a636883cedb

Download Submit
C:\Users\Admin\Downloads\Special Interest Categories_Tagging Guidelines (v4) 28 Sep 2021.docx

Filesize
233KB

MD5
fe842b4d59bc281856be36f2de1708af

SHA1
21e6ff7f4bc7df322fa56789e31ff66e7b09d99d

SHA256
1d9112bafd3d7e20239ebcd3d06f15c7437a0bbb071ec1cbbca47a81247f746c

SHA512
dea970cd0ff7f07203bdcb369058b59189a2d5e5afce1b8cc1f5f433d2a2bb4f8d2b539dc7ebd4ad02ec031f996d25bb430ce940563b55dbb51a6b9ec82bc915

Download Submit
memory/4020-175-0x00007FF91BDF0000-0x00007FF91BE00000-memory.dmp

Filesize
64KB

Download
memory/4020-187-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-188-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-189-0x00007FF919970000-0x00007FF919980000-memory.dmp

Filesize
64KB

Download
memory/4020-190-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-191-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-192-0x00007FF919970000-0x00007FF919980000-memory.dmp

Filesize
64KB

Download
memory/4020-193-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-186-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-185-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-184-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-183-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-182-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-181-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-180-0x00007FF91BDF0000-0x00007FF91BE00000-memory.dmp

Filesize
64KB

Download
memory/4020-178-0x00007FF91BDF0000-0x00007FF91BE00000-memory.dmp

Filesize
64KB

Download
memory/4020-179-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-177-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-176-0x00007FF91BDF0000-0x00007FF91BE00000-memory.dmp

Filesize
64KB

Download
memory/4020-769-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

Filesize
2.0MB

Download
memory/4020-174-0x00007FF91BDF0000-0x00007FF91BE00000-memory.dmp

Filesize
64KB

Download