7320eab8b9a92ee7bc3c7bfde46bb686f1dd184b1ef43fb2e0dd3d9beca7ed7e

Analysis

max time kernel
48s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

super-mario-64-233473.html
Size

53KB
MD5

68c7b84c01efb674653b05bad7f7b60f
SHA1

4ba49381ccd54b6ce1132d3f69e44970a9619b9a
SHA256

7320eab8b9a92ee7bc3c7bfde46bb686f1dd184b1ef43fb2e0dd3d9beca7ed7e
SHA512

788d2bec15bbf8d33d8cbef21c67fee9ecfdfc4c0571d5fe62211db684091c5fd8c4310280cd0a9d7d2025a85060852789a8b60c5dc0c8f9d8e6822e506974e8
SSDEEP

768:LW05vhnqg8F0nUWbu1xHnFV2wSuEg6AF8Ufrt:LW05vceU3xHFVTS1Sxrt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
3532	msedge.exe
3532	msedge.exe
1208	identity_helper.exe
1208	identity_helper.exe
2820	msedge.exe
2820	msedge.exe
5288	sdiagnhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5288	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
1416	msdt.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2376	3532	msedge.exe	76
PID 3532 wrote to memory of 2376	3532	msedge.exe	76
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 4280	3532	msedge.exe	77
PID 3532 wrote to memory of 2160	3532	msedge.exe	78
PID 3532 wrote to memory of 2160	3532	msedge.exe	78
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79
PID 3532 wrote to memory of 4148	3532	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\super-mario-64-233473.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb3eea3cb8,0x7ffb3eea3cc8,0x7ffb3eea3cd8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:2016
- C:\Windows\system32\msdt.exe
  -modal "393306" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFC8AF.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,5663699608255164153,14560307389202825505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:6136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:5452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061303.000\NetworkDiagnostics.debugreport.xml

Filesize
69KB

MD5
adc70d3bae945726364396a8ec21a844

SHA1
35d12a440248ed8e24b681588029a70ff78cc120

SHA256
024253ab7446c6667ccd4dc43feddc730a308f95f88132bda9f7800a0c0bba7b

SHA512
543cf14f59f9a4f5d3e3acc202d1b4590bf17275543a55ae9b118b17c2707f2b66bd5181796cbbaa6cff3234d096a23846ff5b3639c4546257aebedb4cc81c26

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061303.000\results.xsl

Filesize
47KB

MD5
90df783c6d95859f3a420cb6af1bafe1

SHA1
3fe1e63ca5efc0822fc3a4ae862557238aa22f78

SHA256
06db605b5969c93747313e6409ea84bdd8b7e1731b7e6e3656329d77bcf51093

SHA512
e5dcbb7d8f42eabf42966fccee11c3d3e3f965ecc7a4d9e4ecd0382a31c4e8afea931564b1c6931f6d7e6b3650dc01a4a1971e317dab6c1f03932c6b6b7d399f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ffe9c80c42150d0bd237b5ec5b3754c

SHA1
b0c1bd832065b1e210a1988b1da79134e1e1edcd

SHA256
3c228f1ed9b56e4d91fd46fcaeca36571b14eddcd8b941227a176479f9465077

SHA512
585a804310f26eb031b92054de86e8a481a4c7a0b8e804a5ddac08ea99f7eac363bdbca1b0fdb3015ebb4db82b5defc84e56d581cd251af8430cc407b6e9620a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
102cc8ede1dc36116bba9b037fa74506

SHA1
567d98dd53c3def818b5d2c2773d8a1cb676078b

SHA256
ced358a0afefe6c3c96de300e59643b2cebe259750b5efebc4ed621cbde2b767

SHA512
df851542f447eebff631cbbd8caa2f57161e5ca582d89e05c011c0e2cbf225d49a2f0e083f422e5d91fcfab1152e66ad0191ec76085f38bc5ef39adcf8d630ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a5fe71aa6d13f2099f77386da0ebfda9

SHA1
a6522bcf857b3950fe5eb6a764a139c7811cbdf0

SHA256
5d6a5444c1a5bd08bee3cc57f276b089f53ae6794e9a67610012e935b5452040

SHA512
4527983273b8df14dcb316acf646e97fbba6a4757635cd985ebd9004e2189ab3800e27adc174282dab7af331221686f9d396a7b20ae68b1f9824bd1c8e0510cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1341c15f84051ffe5314dc7efae578fa

SHA1
165679f68d8962ea702d1d1b7d0c0dc7734b0c5a

SHA256
f8d482c65ff3371ef434cf2268874502e3340286f31fdcdf60cb278e89dcf666

SHA512
4e69891f381e4c94950488977649a352eba85ab5d187f4fbf9b1cd074d4a394c2cdfe702d1212d7195e5d3b5f2a352c93066f2934f917dc9d91dad82aff6e222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9ec0b5bf7ad6ddd5fafd49c599b8cf56

SHA1
8ed03f809f7353a166ecf66cfbbf2c13fb26890f

SHA256
a4ca49fbf97c2e672e18472b6bb350f1d07954692732f534ed349e3cfe168724

SHA512
70724e340990be23407ee64af2de6fc43554c70e8fc2077d77832ed4c043055232d4aa88905b1d9659144c7dbc5cd603e703eb7caa29f8bd9e3fd791e1329d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDFC8AF.tmp

Filesize
3KB

MD5
f348f450b26690881a39134fffdafe10

SHA1
05f492655446fcafb5c6f0384aabb6ffabd473b6

SHA256
2420386576fb900a6defd521a99af225f873b72b8b17e34f1c6dc44cccf0fcf2

SHA512
8cbfc223771f7dde1a2a8ad85595f9f78f4575ff660fc3907d1e0c2feb87680fea8a1d9548bf3b2c996254b06d2bf70e8ebc3c743c969662f90e460f9c8c7779

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yo1tseae.ltj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\TEMP\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\NetworkDiagnosticsTroubleshoot.ps1

Filesize
25KB

MD5
d0cfc204ca3968b891f7ce0dccfb2eda

SHA1
56dad1716554d8dc573d0ea391f808e7857b2206

SHA256
e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a

SHA512
4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c

Download Submit
C:\Windows\TEMP\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\UtilityFunctions.ps1

Filesize
53KB

MD5
c912faa190464ce7dec867464c35a8dc

SHA1
d1c6482dad37720db6bdc594c4757914d1b1dd70

SHA256
3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201

SHA512
5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a

Download Submit
C:\Windows\TEMP\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\en-US\LocalizationData.psd1

Filesize
5KB

MD5
91f545459be2ff513b8d98c7831b8e54

SHA1
499e4aa76fc21540796c75ba5a6a47980ff1bc21

SHA256
1ccd68e58ead16d22a6385bb6bce0e2377ed573387bdafac3f72b62264d238ff

SHA512
469571a337120885ee57e0c73a3954d0280fa813e11709ee792285c046f6ddaf9be5583e475e627ea5f34e8e6fb723a4681289312f0e51dc8e9894492407b911

Download Submit
C:\Windows\Temp\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\DiagPackage.dll

Filesize
488KB

MD5
ec287e627bf07521b8b443e5d7836c92

SHA1
02595dde2bd98326d8608ee3ddabc481ddc39c3d

SHA256
35fa9f66ed386ee70cb28ec6e03a3b4848e3ae11c8375ba3b17b26d35bd5f694

SHA512
8465ae3ca6a4355888eecedda59d83806faf2682431f571185c31fb8a745f2ef4b26479f07aaf2693cd83f2d0526a1897a11c90a1f484a72f1e5965b72de9903

Download Submit
C:\Windows\Temp\SDIAG_c460b23d-1c7f-441c-857a-f5cb8700a9ab\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44b3399345bc836153df1024fa0a81e1

SHA1
ce979bfdc914c284a9a15c4d0f9f18db4d984cdd

SHA256
502abf2efedb7f76147a95dc0755723a070cdc3b2381f1860313fd5f01c4fb4d

SHA512
a49ba1a579eedca2356f8a4df94b1c273e483ceace93c617cddee77f66e90682836c77cea58047320b2c2f1d0e23ee7efa3d8af71e8ee864faef7e68f233bec4

Download Submit
memory/5288-438-0x000001AFAE130000-0x000001AFAE152000-memory.dmp

Filesize
136KB

Download