12d8bccc8b4bf05902c0b015095db69b07dd859b577e9aa806201a082a8244ee

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXMPremiumTweaker.bat
Size

669KB
MD5

a907bfcab8903b37d8595377c3e268ed
SHA1

e521540a3bffd5567d83782628b3de6173cb9364
SHA256

12d8bccc8b4bf05902c0b015095db69b07dd859b577e9aa806201a082a8244ee
SHA512

bb122cd94abfe6b43b2bd86852b37212b0d6096385bad85fea47d0aa3d80ada43c8e62735db1a5561c25ad9c23a4f8681933197dcf0495e1b182061181650905
SSDEEP

3072:WDGzQbmbkAqA2xH7VkKEn14IZVvisLur+K3:WDGiVNEn14IZVvisL43

Score

10^/10

evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2260	powershell.exe
4808	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2260	powershell.exe
2260	powershell.exe
4808	powershell.exe
4808	powershell.exe
1804	msedge.exe
1804	msedge.exe
676	msedge.exe
676	msedge.exe
4800	identity_helper.exe
4800	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe
Token: SeUndockPrivilege	2588	WMIC.exe
Token: SeManageVolumePrivilege	2588	WMIC.exe
Token: 33	2588	WMIC.exe
Token: 34	2588	WMIC.exe
Token: 35	2588	WMIC.exe
Token: 36	2588	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe
Token: SeUndockPrivilege	2588	WMIC.exe
Token: SeManageVolumePrivilege	2588	WMIC.exe
Token: 33	2588	WMIC.exe
Token: 34	2588	WMIC.exe
Token: 35	2588	WMIC.exe
Token: 36	2588	WMIC.exe
Token: SeDebugPrivilege	4808	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4000	700	cmd.exe	84
PID 700 wrote to memory of 4000	700	cmd.exe	84
PID 700 wrote to memory of 1960	700	cmd.exe	85
PID 700 wrote to memory of 1960	700	cmd.exe	85
PID 700 wrote to memory of 3608	700	cmd.exe	86
PID 700 wrote to memory of 3608	700	cmd.exe	86
PID 700 wrote to memory of 2260	700	cmd.exe	87
PID 700 wrote to memory of 2260	700	cmd.exe	87
PID 700 wrote to memory of 5084	700	cmd.exe	92
PID 700 wrote to memory of 5084	700	cmd.exe	92
PID 700 wrote to memory of 2996	700	cmd.exe	93
PID 700 wrote to memory of 2996	700	cmd.exe	93
PID 700 wrote to memory of 3872	700	cmd.exe	95
PID 700 wrote to memory of 3872	700	cmd.exe	95
PID 3872 wrote to memory of 2588	3872	cmd.exe	96
PID 3872 wrote to memory of 2588	3872	cmd.exe	96
PID 3872 wrote to memory of 4536	3872	cmd.exe	97
PID 3872 wrote to memory of 4536	3872	cmd.exe	97
PID 700 wrote to memory of 4876	700	cmd.exe	98
PID 700 wrote to memory of 4876	700	cmd.exe	98
PID 700 wrote to memory of 3200	700	cmd.exe	99
PID 700 wrote to memory of 3200	700	cmd.exe	99
PID 700 wrote to memory of 660	700	cmd.exe	100
PID 700 wrote to memory of 660	700	cmd.exe	100
PID 700 wrote to memory of 4808	700	cmd.exe	101
PID 700 wrote to memory of 4808	700	cmd.exe	101
PID 700 wrote to memory of 616	700	cmd.exe	102
PID 700 wrote to memory of 616	700	cmd.exe	102
PID 676 wrote to memory of 4844	676	msedge.exe	116
PID 676 wrote to memory of 4844	676	msedge.exe	116
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117
PID 676 wrote to memory of 3800	676	msedge.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweaker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:4000
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:1960
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:5084
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:4536
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4876
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3200
- C:\Windows\system32\curl.exe
  curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\nvidiaProfileInspector.zip" "https://github.com/Orbmu2k/nvidiaProfileInspector/releases/latest/download/nvidiaProfileInspector.zip"
  2⤵
  PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\nvidiaProfileInspector.zip' -DestinationPath 'C:\Exm\NvidiaProfileInspector\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffec35946f8,0x7ffec3594708,0x7ffec3594718
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8356412260083413524,7061675349344841223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64ecb66395ac8d70118eddb8850d4c2e

SHA1
bf552ffb0bf515bce86c53bcfc08f5d06e15bf0f

SHA256
8f6230873ce83363b98c9eff7f5a29e0d56460e3d71ce9ef54c5a1886ea722fd

SHA512
f99c4db8c435687964a16d5651b7a556b416edb7d1441d5b7eeb2e33d7d873570e9c8cd741fbea7b8e5545bbdf71a71622f1eaa80886f4f2c9d19e357ea51259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ec773d9266779c04c39a9c581da4257

SHA1
aebc977389b31bf12d883a844beab9d7f7a19af1

SHA256
2955349662eb5975ecdc3b53ea507fbd37bd01bb5b48e6276e491bb0a9077ce8

SHA512
1b5dd5d4895f19e8f9050cbc475a51a882baa8dd848951ddb83bcfe428ff9f550dfefee4a84dcdb7be6baf6e46808d9f8137a380f359b65bd5a02efe10b5ab40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a30a2ef6281590f790a2a7706b3153bf

SHA1
1da649eb9cd97b7be94efab012576e96ca905682

SHA256
047f50df761ae0bae68b43757db3bbe660cecb7b7ca8e710b10a4fc65d10b709

SHA512
2ac35c557e45ef993d886cb1c1d2e552e1f322207125e92bea8f368577d423350a46638bd7606cac674b618465c05f1efd1db6ef876cebf5e95dbb7bd7b99ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1a11402783a8686e08f8fa987dd07bca

SHA1
580df3865059f4e2d8be10644590317336d146ce

SHA256
9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

SHA512
5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cluoqijp.15p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2260-15-0x00007FFEC3EE0000-0x00007FFEC49A1000-memory.dmp

Filesize
10.8MB

Download
memory/2260-12-0x00007FFEC3EE0000-0x00007FFEC49A1000-memory.dmp

Filesize
10.8MB

Download
memory/2260-11-0x00007FFEC3EE0000-0x00007FFEC49A1000-memory.dmp

Filesize
10.8MB

Download
memory/2260-10-0x0000021C1CBC0000-0x0000021C1CBE2000-memory.dmp

Filesize
136KB

Download
memory/2260-0-0x00007FFEC3EE3000-0x00007FFEC3EE5000-memory.dmp

Filesize
8KB

Download