6dc0ad3bcacb04350698e6352b7193fd64fe4496a85748de78c0a280165fcba7

Analysis

max time kernel
1033s
max time network
1037s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-08-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Subtitle/[Kaze-Yuuki] Amagami SS - 01.ps1
Size

117KB
MD5

32d44ebf3cf1ff583a2059bd989e86c8
SHA1

a8d1b147c88af4dc4201fa76f081ecb598f5ed04
SHA256

e1d0df048604cac1eb8118a516a320ac42382706c918dc59578b5c37f3e8db81
SHA512

65de4ea6751de0d7cbcedae427ec8024d07f9b44f9edb0872024ccada19e1f1752ee0a2cb53ce9af7efa12660a50c64d15532aa28ebd6630c9aa1d5ada413715
SSDEEP

3072:rf9JbxgboyDuR8CSfiTuw/6xlEZt7UWkWnNBCPbyKENACNSUSd/TCxWKjbvZriCq:rf9JbxgboyDuR8CSfiTuw/6xlEZt7UWM

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
996	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4200	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
996	powershell.exe
996	powershell.exe
1328	msedge.exe
1328	msedge.exe
2904	msedge.exe
2904	msedge.exe
4760	msedge.exe
4760	msedge.exe
3752	identity_helper.exe
3752	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	POWERPNT.EXE

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4200	POWERPNT.EXE
4200	POWERPNT.EXE
4200	POWERPNT.EXE
4200	POWERPNT.EXE
4200	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2076	1328	msedge.exe	97
PID 1328 wrote to memory of 2076	1328	msedge.exe	97
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 4612	1328	msedge.exe	98
PID 1328 wrote to memory of 2904	1328	msedge.exe	99
PID 1328 wrote to memory of 2904	1328	msedge.exe	99
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100
PID 1328 wrote to memory of 3996	1328	msedge.exe	100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Subtitle\[Kaze-Yuuki] Amagami SS - 01.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff0fdc3cb8,0x7fff0fdc3cc8,0x7fff0fdc3cd8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,5815317389767308675,6118588906614917385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
241b071340ccea7e21eb5dfb92baeb9b

SHA1
4a1fb2310e4cc290425de1b72e274993ef6b9038

SHA256
cb4b1c031c345eaf6914299e8ad471dd47a1b71ecb2b5af30f97249b003afb85

SHA512
874c09ed60db074faac2ae52c15f3484d576fec28c4b9950c03ab5d139dcbed471c92084d5b96be205e94c5b150f3b18c2312e5b29ceaba32d4bd586418c0633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9a4e4702edd97965b33a5d811e91e07

SHA1
55fe5f2755471c7bfc8cb9aa99945a49b45f96cd

SHA256
518d69bbc9bd68aadb594d73f3542a04a4f8d8ea161f4b0e6710b811432d976d

SHA512
2c0de6d54600e26be619c6792289f885f206f0b7bb3174adc9c2827ea1cc0e4a4d010856e44a6032269fc31075658d6aff40b1afa5219b54d6120b4e27731838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d44fb4af90c3816d980b1e68512e8c2

SHA1
f7376cc03a14d950034c7fcf1e0bf99501f179c2

SHA256
5ad127776aacc0fe6b3d0e960b43823bcb514bb1f9c30f7b84a29b07aaab700d

SHA512
654adc127c77329dfd6dc977c5a30002fc7dd09d69625536d38190a0213abe1566657e899065ccf1d0484941fd6f35e9554d327554e8179f636d917f8952471f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa1583318cf3f83eb67e93f13c52b7ea

SHA1
59490a5dd584cc6ac9f99babdadc42af32e03efe

SHA256
ee7bee17dc2dd1f1c97fba1a5dff222caae7eef833666e88930e653ed4aba8f1

SHA512
c49fb50c804abe063d8859a9a82e8d1e91ed17f3efa18a8aae84937c48e81680941e7833bd196354b9afc0751d363c3a5c33147e3707de82aaf2c79a0354207d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
567e9eb7efa1a03dcfecc2244bbde62c

SHA1
e78f944ef38fc1c854c13034a3de621ce1c4dba5

SHA256
d19af597925b93574b27ddbd5f7c2eefce9e3ec42b89d1bf77e96ce4ac9bb573

SHA512
1322b7b12d1f6d412af3fc33578aa6202d6dd65d31251b9d08015def95ed8967d6af136fa3e52db29b60de2776b18591c3fe796ad16e2748c1e4a77e16b45ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pymxi4ls.hnm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/996-0-0x00007FFF035A3000-0x00007FFF035A5000-memory.dmp

Filesize
8KB

Download
memory/996-15-0x00007FFF035A0000-0x00007FFF04062000-memory.dmp

Filesize
10.8MB

Download
memory/996-12-0x00007FFF035A0000-0x00007FFF04062000-memory.dmp

Filesize
10.8MB

Download
memory/996-11-0x00007FFF035A0000-0x00007FFF04062000-memory.dmp

Filesize
10.8MB

Download
memory/996-10-0x00007FFF035A0000-0x00007FFF04062000-memory.dmp

Filesize
10.8MB

Download
memory/996-1-0x00000234D0820000-0x00000234D0842000-memory.dmp

Filesize
136KB

Download
memory/4200-38-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-441-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-37-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-40-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-39-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-29-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-36-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-35-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-34-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-32-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-31-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-28-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-22-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-30-0x00007FFEE19F0000-0x00007FFEE1A00000-memory.dmp

Filesize
64KB

Download
memory/4200-442-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-33-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-440-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-439-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-443-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-27-0x00007FFEE19F0000-0x00007FFEE1A00000-memory.dmp

Filesize
64KB

Download
memory/4200-23-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-25-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-26-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-24-0x00007FFF243E0000-0x00007FFF245E9000-memory.dmp

Filesize
2.0MB

Download
memory/4200-19-0x00007FFF24483000-0x00007FFF24484000-memory.dmp

Filesize
4KB

Download
memory/4200-20-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-21-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-18-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-17-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download
memory/4200-16-0x00007FFEE4470000-0x00007FFEE4480000-memory.dmp

Filesize
64KB

Download