5a66afaa754bde91bec568e8b20fc3552a240017feff412f6f8cbfe3c0793ecb

Analysis

max time kernel
545s
max time network
492s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Straya_Ultimate_without_scripts.bat
Size

223KB
MD5

884f7c61acb34c7e1821874eeb0d4726
SHA1

4712bb387eb3b4a4f140039db1472c8a366b0809
SHA256

5a66afaa754bde91bec568e8b20fc3552a240017feff412f6f8cbfe3c0793ecb
SHA512

d9e37b7df6b72b490c1f6a51c627a4c019cc49e7eecd2a68bec6672802bb5f29c3df8525f0b339a8b5aa3659ecd106b8061a56e60fe9ab0fa988419ff5ecf78e
SSDEEP

768:NPgO+jjTtGiZQpZHSV6PkXl1/XAx5frBaRyCJnJzQltusqsqynwt50PRAbF/b2Ar:NPgb6SZYmNqYV+pHDL0gNAc3tFOF

Score

10^/10

discovery evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	discord.com
27	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3996	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{866446CF-02AC-4EAE-83C8-DCEC0944F5F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4616	powershell.exe
4616	powershell.exe
4616	powershell.exe
3536	msedge.exe
3536	msedge.exe
2168	msedge.exe
2168	msedge.exe
3848	msedge.exe
3848	msedge.exe
2876	identity_helper.exe
2876	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4616	2172	cmd.exe	85
PID 2172 wrote to memory of 4616	2172	cmd.exe	85
PID 2172 wrote to memory of 3268	2172	cmd.exe	89
PID 2172 wrote to memory of 3268	2172	cmd.exe	89
PID 2172 wrote to memory of 3996	2172	cmd.exe	90
PID 2172 wrote to memory of 3996	2172	cmd.exe	90
PID 2172 wrote to memory of 372	2172	cmd.exe	91
PID 2172 wrote to memory of 372	2172	cmd.exe	91
PID 2172 wrote to memory of 2168	2172	cmd.exe	93
PID 2172 wrote to memory of 2168	2172	cmd.exe	93
PID 2172 wrote to memory of 736	2172	cmd.exe	96
PID 2172 wrote to memory of 736	2172	cmd.exe	96
PID 2168 wrote to memory of 4752	2168	msedge.exe	97
PID 2168 wrote to memory of 4752	2168	msedge.exe	97
PID 2172 wrote to memory of 2020	2172	cmd.exe	98
PID 2172 wrote to memory of 2020	2172	cmd.exe	98
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 4052	2168	msedge.exe	99
PID 2168 wrote to memory of 3536	2168	msedge.exe	100
PID 2168 wrote to memory of 3536	2168	msedge.exe	100
PID 2168 wrote to memory of 1000	2168	msedge.exe	101
PID 2168 wrote to memory of 1000	2168	msedge.exe	101
PID 2168 wrote to memory of 1000	2168	msedge.exe	101
PID 2168 wrote to memory of 1000	2168	msedge.exe	101
PID 2168 wrote to memory of 1000	2168	msedge.exe	101
PID 2168 wrote to memory of 1000	2168	msedge.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Straya_Ultimate_without_scripts.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Set-ExecutionPolicy Unrestricted"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:3268
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3996
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/stservices
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc084f46f8,0x7ffc084f4708,0x7ffc084f4718
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4076 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13728147688008577845,15571967333024168725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2160
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:736
- C:\Windows\system32\mode.com
  mode 158,40
  2⤵
  PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
02a6c526b883cf5f07621885bd320d70

SHA1
f5baabfc4d548ab7c86ad3883cef88ecd3a27d34

SHA256
2e0b0aa5d47ab372168db132e1a62f84eda42e05a0ad676238e40c0913c07c9a

SHA512
ccf005f7740e3ff5df8b46ddbc021f743c0bd946c67da12ce5a2eee85b96aa5feb3477981e127c3969b583df7abf48107a27ef0d8ff40f5e9e2ce7ea07583fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
323B

MD5
a5a1149047729a493b1a2a65063c39ba

SHA1
8f1f45cb0c0772dcd05795734cbf408636fb9fb9

SHA256
e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006

SHA512
8ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91c7ffd3c0d0a0dd85dd8e301aa1e964

SHA1
6f4004e1dca61af9062394919192e0a5f4be7f35

SHA256
974811c731a1c675b3db8a7c42977204497a50dacef1e92c9229f755f45773e0

SHA512
ea87931bea53db6ec543af04338173adc57ab503d737861105f36193739114ac2ef0b26ca40d7194b99a2fbd68c5df76e577ce99d80e420233e9fa1f9e5414d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
645716b6425da064e0a1d212c3055bff

SHA1
e1bfb6c6e2362fa11d75167de01954d96530567c

SHA256
7d751c1fdb0006da89c7ed22a7dcfa769d2b2dfc53c9c4a0d3e6a8909973998d

SHA512
e77009ec3e8ae3db53619a76606e96d3b8a3ff75e20e085fccca8f55f6c0a2b7f65c2e06dafaf91aa9f8444a4a045e1db9bad172bb4e0408593c991a77a2953f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b7377e2aea19a8be0ada92c4f1bbf32

SHA1
72b812608b8858a45ad8d41c27b598e79b90704e

SHA256
67b7ffa3b3138884641ad73f5816b706b1cd744796906d7b58eed9c32b06e45d

SHA512
d484c31841fb38343e46827265c878d4adb9f08eb057019bf7fea7b69ed794ddbb0ac630a17c7c78a1a15a319761f4741040ee9537019100565902cd1f22c3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vdqd3bgj.j5i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4616-15-0x00007FFC07F10000-0x00007FFC089D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-12-0x00007FFC07F10000-0x00007FFC089D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-0-0x00007FFC07F13000-0x00007FFC07F15000-memory.dmp

Filesize
8KB

Download
memory/4616-11-0x00007FFC07F10000-0x00007FFC089D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-10-0x0000025CEE790000-0x0000025CEE7B2000-memory.dmp

Filesize
136KB

Download