hxxps://drive[.]google[.]com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Analysis

max time kernel
58s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Score

6^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4012	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3532	powershell.exe
424	powershell.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5268	timeout.exe
1604	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 30403.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
4008	msedge.exe
4008	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
944	msedge.exe
944	msedge.exe
4012	powershell.exe
4012	powershell.exe
3532	powershell.exe
3532	powershell.exe
424	powershell.exe
424	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	424	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4468	4008	msedge.exe	83
PID 4008 wrote to memory of 4468	4008	msedge.exe	83
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 5916	4008	msedge.exe	85
PID 4008 wrote to memory of 3820	4008	msedge.exe	86
PID 4008 wrote to memory of 3820	4008	msedge.exe	86
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87
PID 4008 wrote to memory of 5608	4008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad99d46f8,0x7ffad99d4708,0x7ffad99d4718
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,11951065409157584167,3339463703941928664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Honored_Tweaks_1.bat"
1⤵
PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\Downloads\Honored_Tweaks_1.bat' am_admin
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Honored_Tweaks_1.bat" am_admin
    3⤵
    PID:1564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('MAKE A RESTORE POINT BEFORE DOING ANY TWEAKS, DOWNLOAD RESCOUSES EVERY TIME I UPDATE THE PACK/FIRST TIME DOING IT', 'Honored Tweaker', 'OK', [System.Windows.Forms.MessageBoxIcon]::Information);}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('USE THE TWEAKER IN FULL SCREEN', 'Honored Tweaker', 'OK', [System.Windows.Forms.MessageBoxIcon]::Information);}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:424
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5816
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:5268
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:2396
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4320
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3604
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3760
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2300
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:1080
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5204
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b55d2d2ff2a4d5d7eeaff5ebb96f3b4a

SHA1
12d94b9e84142b10d6347a2ff3b634a20f692c7a

SHA256
3d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776

SHA512
4dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94c981336abc388ca817dab46e7fc547

SHA1
2d0f8d89a31adb0aad5c599a195ff40ecf4b161f

SHA256
4d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2

SHA512
f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
83a069262f4a17a91c52ae8086b632b7

SHA1
215abc2afb57807ed891d9941334b3d3957228f9

SHA256
fad1853ba86cb04c1c719fcb3c21a5630732f3e923b790b2c5e915ee476e09ea

SHA512
a61940b45354b462b2282a5d10838cfe3490e810cef250f85530f3e936119c97029db9669f8066f639c654d8ebbc781c38faf401c67254a941fa8ba888585eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
036a2b53842d44eca42057441a9ee44f

SHA1
b6454171728baa7717372eb6bf3792d07a214382

SHA256
9a9e2885d065668b0b1bc62560e60e22da3907b3eda081c52948b9749aca1db3

SHA512
5610545355ed2310c02477e2628a9b91b974bb8382552f0224e80f1595bc0b09f6ca1313ef8a542db77576bbe8648177d910b834fdb84c2d9b9d42c572e70587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d06547e0e390df3bcc3dfa3903481925

SHA1
ab4779301192bdc003841e4a689ad9b60efcd61a

SHA256
c9bcb4f8d21bf2f479aa826179c823dfa587db3656d0f35003ee9c594ee0055c

SHA512
4081011ec0c3dab97a50bcc1d62d1eba916bd146c760a85ac6398a1476b41a9351cba153d766a48ba171cb68dc667660b3601f7d870e05ccec196557054790e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a5b22cedf84fe99241c877078042122a

SHA1
53b4c68017ac7ad4d2e4eae2658a1d50ca0b072d

SHA256
5f5a546cf02eaa1e5aee476fcf6a54db205d629de7a2bf1a806065dbb35b8e43

SHA512
6c71780acec59695ac7267d9406ed7b6188ee95cff3bcfb80717b05417f60224fe4e15a754775fdaaaad823e392c22e38797b14599bd565bf109b4f165b876db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23a407993157012ed8383b2554483f05

SHA1
42861c81591c84e1e8d91c45d66c35397ac305f1

SHA256
62cb7eeb9f603a26839bfb1b1d6baac50523e4cdcc55b49af5660914e271713f

SHA512
b2dff9f96a55db527b4d58e5036af6ca173537953aac90d54d12498153cc837e03ed37cee61d4f273ce04fa915c07ee633877cc8047b742918e568598e4d4027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65f5aa4451d9525fe06f994e8f4d609a

SHA1
1f2dd7bd6e7d4429383f65138108e38e0e953d34

SHA256
f38c904e858c1fd21d236fc5ebb14d9a46ffed112a468040a5125fd19ea0be0c

SHA512
d71bbe2184d19b4abe731e6c1292674ed5860c3513d43dd53188ca4caf48f7595417a604004f33fe1df35a368f1c4ae1127584ecccbc68290b51c03232840c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74cb698f44e09b8cc446f8545efbd35e

SHA1
75e1199fd3bcd1ce8c0e1e1a7e1cc4b2808bdd3e

SHA256
b46cf0092385c5a4a5c1455c76fbc349aab36de82784ff44fbaf7612ea3cd7db

SHA512
1ffa33abd190b29d78310bcc8258191f616ceca3b557fdf1676e6b7f9d54e9b9f3453bd0e50b4a799586d264dda2d4867a2e376fceb2b90a82797cbc1fec7bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
224dcf4c17389871fa59fe45c7acd94a

SHA1
d02998277a18745bc5a5209d80a4d5c5077772ff

SHA256
c10c307786cba93488fb258b288490207e01024028a4340eab17f0c0b23dbb0e

SHA512
8e30a4a06f9a06dd2556ee9125e9dc9effcc1cbb3ce6ff9fabee383db8e4fdbe7f638ea71d5a42d6722748543c8f2a4399baefdd2a2cc20e531c966b29f32e10

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbcyqoeh.tu3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 30403.crdownload

Filesize
100KB

MD5
002f84ea9760e4fdb4a61d515a578566

SHA1
cf2b6c06302032ea79685f4bdab974e6a3ca947f

SHA256
5b3a0e9c29be3bd7c2f4051722be188e87138e418b454d99282e03e22c98b75f

SHA512
acb204395fe9210363f89e110d8c9544b8da30d892677c76a181c62968948a63a77e7ef82cc6f46f12840a499ab490543c4ef7cedf1cac3affa3e68038c60c4d

Download Submit
memory/4012-234-0x000002DA76950000-0x000002DA76972000-memory.dmp

Filesize
136KB

Download