hxxps://appfbxppehosted[.]s3[.]us-east-2[.]amazonaws[.]com/ppe[.]html#lkoessler@franketobeyjones[.]com

Analysis

max time kernel
73s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://appfbxppehosted.s3.us-east-2.amazonaws.com/ppe.html#[email protected]

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f5a2073c-2f29-48d0-95d8-6d972cd8db55.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230525021053.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4112	powershell.exe
4112	powershell.exe
5088	msedge.exe
5088	msedge.exe
2076	msedge.exe
2076	msedge.exe
1428	identity_helper.exe
1428	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4788	2076	msedge.exe	88
PID 2076 wrote to memory of 4788	2076	msedge.exe	88
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 4412	2076	msedge.exe	89
PID 2076 wrote to memory of 5088	2076	msedge.exe	90
PID 2076 wrote to memory of 5088	2076	msedge.exe	90
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91
PID 2076 wrote to memory of 2188	2076	msedge.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://appfbxppehosted.s3.us-east-2.amazonaws.com/ppe.html#[email protected]
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://appfbxppehosted.s3.us-east-2.amazonaws.com/ppe.html#[email protected]
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff04f46f8,0x7ffff04f4708,0x7ffff04f4718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff672705460,0x7ff672705470,0x7ff672705480
    3⤵
    PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4482448984732105976,12174962722474824608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f20acfe7d5a3020278403477694dc1af

SHA1
74efc1410758b111a3cf6cb71ed772dbfbccd945

SHA256
715e320aa37d21102a480378964d73f60a9d459f90aff9426017a3fd1191e2cf

SHA512
15d54c7862bfcf7c73318a35460195751a75ce627bcac1d9c6a2c939d2129ffe38de84996a00eefdc31e8716c51c7e68ffc2829e975d6bb5194e1562c04a62ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
244B

MD5
2968be26a1abf40cd0132749db56d0ef

SHA1
0e7cf31af2028cbfdbcbe180d50db992478a8c78

SHA256
0337c1617a620a966bf9b2375b3e3c5c0ea9cbabadd5bf7d613cb7fedb9aa686

SHA512
58df8a46083756ef7b8222857e8e1552d305390709a402ff1d6e018762609826c19c788334887ad5f5f4e191fffd191f93dac8cc20ba86ab0903c799e47bafd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
44b2a6b75352d739b729ec2b31566e04

SHA1
d2a987f06ee4757a05a8fbafe06371fa306cf68a

SHA256
cf42db5dfeb6411819607c0027eb7aec0dea42aff4cd2ca84d1aa287271a239c

SHA512
1dce998c615c31b4102992b8543c9396c4d4383501552ed0c5f689fe6e5b53f28d737caabeaf275da2cf5d3b9b1f8708099b62b2d2c2e1ccc395ec9b5774a3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03bb440d6adc156191681bd49dca3762

SHA1
a11a9931842d2f8f634bb14c258b9091fdedb7dd

SHA256
6b41284e8a76b6d197a33c21a115bd67d26fdc413df078f9d55d4b2dfbce1b4d

SHA512
844fab30ee6ad9773d25ed4dd11b3167d3f80c1a7a8165991d841f785466761559ce8c4adc59456b44686a97f75072b50d303d5c2d13b8a21fe629a12b9dff72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e9b66657b745407432f2b120458614f

SHA1
864a6e0fed2de845959dd0a5f471aab8c2bec61c

SHA256
bdb46d08e66622c33274d0b8d7d7a0727194e430f1b4574603300d5f7527c2cf

SHA512
ec5b3a3afeb3f8a58cf9b00455ab5865d86d4879006a0aef0f6664282eba9ef1bfcb256c8ff4c71711ea6cc5bb49775b768e741be66d921deb07968e335d0a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
4b801b80650a764e7a8c505db6382816

SHA1
3c668d38909811cce386e6ccef4c29b46d3bc478

SHA256
ec458c554bf246eb79c5017cda5e6c500821cad56c3f4c51f419a98fe3994377

SHA512
a9bcbf961eea995798af6f0d328f90aa6aaafcd089d9df881fb44c1b6cb080dc7cf6db7dcb606eee2fe2e1529676fa6932d93233d2d9434831757e4c921fbf8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe575285.TMP

Filesize
204B

MD5
c33408fa93e03d0855e9b3930feac491

SHA1
7c21dfb925029b975da331d4387f55a8e1a8604a

SHA256
61f69a999cd949fed44a5f1e7793884d0e99ba1b8a4cc7845bffe17925066056

SHA512
97e282cbc4d19ae87d6372d83302251fe3b565e2adcd4e55aee0e6fbd352129f73ecec708ab24157fab606816558d75d494eeee89e9394bb5e02e4461d690d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
7cf7c62442a7ed6af66aeeb4aec89bbb

SHA1
7c1a9996a7cdb68c9e45349b5983dda6dd44aa68

SHA256
e3f4d1a73ee17b796b07f5581f992ea47fef8712f3b9cc0d9bbb0539560e39df

SHA512
c96be56801b56ca85349ff8c69ce90fb65e7f9cbeb50060ead91f1ed62f9683500a2e19f93fbfebe2ceb8ee0bdd0e0f96714c44b6fad56b86d71bb074205a12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0355d666b96c779a7917d4f3ea01e667

SHA1
bebe2c15b8dcc4261080c3b7f41aa463e8670e84

SHA256
74937a7d1258501c2542607fd3060178b02da60b541ce724f6c68436eab81d08

SHA512
386eadebf3fc908c0447616a7643123de27314eb523f5cc2636ebf2c63e509abc8a6ef51c27e1d33d2d195c06414a8d93f71ca83d986bbba5edac34651e06874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2fe4491dc64c89faa8e555d5aefda6cf

SHA1
d0df4c5586b21a6b6191e077823f65ae9fc5f362

SHA256
71663b25336e4ca34fecc56d2edbdfcfa4a177d712d17ce2f263138c0f1ae67d

SHA512
11a617f9904cdb54e60a72605798936e17364a31129db67878eaa00d54c58d4cd5ce018b20dd368bd2f3cc26e50c4fa5fbdc3ad25ffd1bbad977be27b1ba804b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
331e38bf221916c09f5a75f0d32bb420

SHA1
8956edd437f87e84f304a3c870cd7d53ce694899

SHA256
dabe08562bfc24585391899e0f5bf8cf0ab29da30c3d8ee614732ff900c79c34

SHA512
55db710593241c71db81c0319691662953dfeb9c1f775bfc932c424b8003dd8478b55eb01320409e669dcdb3c90aff3c2c4acf8efa7c014bcc425a83d88e5724

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0da1jyj1.f40.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
7d204e20b7c9f407c17278b8dd817efb

SHA1
866a3722172ccc90d8dd567f7540a928bd40d6dc

SHA256
f61677e3f017dfc9c5db137e0d75162a608efd82b1f774a79aa8907cd6fab6e9

SHA512
b77794a37fe3dfcf76c1426844e2547bbc1061673812e8de80215e85e05a26600db9f0ef55adbc9fc21ff69096c41834e644efbba8a78f5a84a742aacfed7bf5

Download Submit
memory/4112-145-0x000002692C500000-0x000002692C510000-memory.dmp

Filesize
64KB

Download
memory/4112-143-0x000002692C500000-0x000002692C510000-memory.dmp

Filesize
64KB

Download
memory/4112-144-0x000002692C500000-0x000002692C510000-memory.dmp

Filesize
64KB

Download
memory/4112-142-0x000002692C680000-0x000002692C6A2000-memory.dmp

Filesize
136KB

Download