hxxp://FBI[.]gov

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://FBI.gov

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c07b85d8-7443-4d7f-a73b-723f96788135.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230416235925.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1516	powershell.exe
1516	powershell.exe
4552	msedge.exe
4552	msedge.exe
2204	msedge.exe
2204	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 208	2204	msedge.exe	86
PID 2204 wrote to memory of 208	2204	msedge.exe	86
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 2716	2204	msedge.exe	87
PID 2204 wrote to memory of 4552	2204	msedge.exe	88
PID 2204 wrote to memory of 4552	2204	msedge.exe	88
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89
PID 2204 wrote to memory of 2012	2204	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://FBI.gov
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://FBI.gov
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe6fd046f8,0x7ffe6fd04708,0x7ffe6fd04718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d2dc5460,0x7ff6d2dc5470,0x7ff6d2dc5480
    3⤵
    PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1092202525807185541,8296864684627892357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
968d38b69665c57839ee6a0bb32c3f7b

SHA1
fdaad3aa7ddaa62625539cd6fb0f94465110ee04

SHA256
b011a18edae2d670e94245df21ad25199c817d4e3280e94a4962abcb4f245fc6

SHA512
988023d1c855b5a22ce3f9c37b79e2aa04fe7a22a8db39563a6f943907a2da09a0a3524c005f1dc57cf69cbbbeb8a5d65cfea5016ceadcbd9506882f5918b2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5f445a3a97f126484a77664e15b0efb7

SHA1
08cd577e3cd913a3c8c8739b982f52aaf38a0145

SHA256
89229e944c2bdde11c3fe15411f0a41323fdb61b5e0a73ab37fd9a060119feeb

SHA512
46bf8f5bafa25d3bd0ff7f3b2de9c708e9d4f672c6f33c9a648bf8456cc714ab4c2a1581d31c9fbdf67ed7d6434236502b1f163068af0830392b8ddeff7add1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
bb138a120b361829e86d4df13a6c5b74

SHA1
d0c50cf438e688cb937850215318326ca8b43815

SHA256
6bb8a37e5813e069901de9d20ecef337f49b29f8340dbb6d12fd7a0bd823d074

SHA512
26b7ee15752ffa656bd3029b4ca6244eef7a3916bb7ce6cb23412ee0a9422d53b26c86ec62e179d557c23d8c756a6a4d748a891b0a3e6a29a2c6ce9af8066493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d12fcdf125b1530016d1ff7c2b25748c

SHA1
df70882c8c5db008439253232d582d3b78120397

SHA256
ab86f734cea71be2f69db1c66e48a4328961bab74e5518c7876da62ecabfe31b

SHA512
cec1d907d2dcb3bbf12ad61a863def86f82b72dd81a9a7a17bb2c8981686f8bd420efd2a9b725f0927e2d28d6d8b345890a26aae77abb2bb3a44b4426f4fa857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
eacdc8558f9742be27fad097b086edef

SHA1
80c1b45c784011d73c15cfc233789d681c4fe00f

SHA256
875467ee7f1ff5b4f130593ef22e8dbbc1e7d62651ead715f346656f32adaa92

SHA512
9f2d5ad81ba2e0083ea465e2a1351603de6f6ebdb1d9c102cc059347a24078791d7705af8f8c1fbcc480d5631e93604a8ef55333f6d97e89b6c3d0fb1a4b2d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f17c385a26b73c91cd2ffad3b492e694

SHA1
724d7c4ad46e0a773c495779b4a6657677e5a25b

SHA256
828863e2035405a9d00fbfa9a8c73efdcc34a602b127475c05d0fb538bdecaef

SHA512
a6ca615bf38bd54e421812480487a12d77138f41f6276a6b34294ab893c5606a83c828575c8261b761b2b79a0548ba8f752448a199734c3c814d67601fff44ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
268d4f8cb81f6ffa1390d866b1b4f1e5

SHA1
b59e06b46aa323cf15ca931ec0672bcec122eac4

SHA256
6f3537505ac238b36345a7fa51000cf4eb9e86bf8904fc3029e28c9de70f4d3f

SHA512
be377174b93b14bb89979b88332b7aafc65f34d9a0cf43665d15fbfe4a38bfabd5b4ebe6c5f131e39f95cd8b0e0afd6b13cc19eaec35f8735bf1446bb70b0e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
7122eb33325ee24eb9664ac8c924be36

SHA1
538448a65bc5887128dd5534728e7c1598f38fad

SHA256
c29f7f1329f8e974e87d8235277bc3e8008670ad413cbb6f46b667433fb40e1f

SHA512
7acc14a76b78b27dd2b8d363f7e62378cbefc266d53124c386848c41f7b83bc4724ab7af9c5dba2822b4d2083db20aa2a8d74d26ecf95ae367e834545df4d33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3428d8743b6a6e1cd18846c649297949

SHA1
75ae0994447e647639893adf9d88ccba2868ce60

SHA256
860883af274e4c0043e13048ed7e1e77d67ac6371980d54ce743a4ee2f6debaf

SHA512
c1c3d5e445501e4ef2b7036251debc32440356144dc260190eb762901753074dc0f86412f5f1cee69e51c1261867e7e4b4954a82b004bd6f37d3c9748f84b4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwx5ygw4.04d.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
83e3ad3b21be30c057d6fcb69cfd38b3

SHA1
4dc2df5aeb103fe266ab02d5a14260a3fbcde862

SHA256
9240140131cfd6e22370e399fa5811781227cc9776694d1d47e2eb5ec65681f1

SHA512
ba07050b264cb61e8c6d29fd5577b9161d8ffd5d31bb3293b660fdffa5a0cbbe596343301c52cb0f79dd5463b360a1cac1439505a43e399b17aadaa249897fa7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e1f35ed0a2ee6876c0b967b4ff6dac13

SHA1
5f204d22b9c1364b0ec539702c8224649d7fb1ec

SHA256
3fc11fed36788f4a04f8760bb604c6f67dd07c294077e7f99411d2857db78f91

SHA512
408e936c29e023185981eb9162f5728413eaf855fff480ca74ed48367d5ad7f58af3d69ba5a19d82b3eeca68ce3be68ddcb6f6954913506f145dadb70529a699

Download Submit
memory/1516-145-0x00000246325D0000-0x00000246325E0000-memory.dmp

Filesize
64KB

Download
memory/1516-143-0x00000246325D0000-0x00000246325E0000-memory.dmp

Filesize
64KB

Download
memory/1516-144-0x00000246325D0000-0x00000246325E0000-memory.dmp

Filesize
64KB

Download
memory/1516-134-0x0000024619EB0000-0x0000024619ED2000-memory.dmp

Filesize
136KB

Download