hxxp://woofworlds[.]com

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://woofworlds.com

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6c4463d7-ebc4-4659-9d6d-bc1fa43b4fda.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230601194910.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
1892	msedge.exe
1892	msedge.exe
720	msedge.exe
720	msedge.exe
3244	identity_helper.exe
3244	identity_helper.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 2304	720	msedge.exe	81
PID 720 wrote to memory of 2304	720	msedge.exe	81
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 5032	720	msedge.exe	82
PID 720 wrote to memory of 1892	720	msedge.exe	83
PID 720 wrote to memory of 1892	720	msedge.exe	83
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84
PID 720 wrote to memory of 2408	720	msedge.exe	84

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://woofworlds.com
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://woofworlds.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb17f046f8,0x7ffb17f04708,0x7ffb17f04718
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6a60d5460,0x7ff6a60d5470,0x7ff6a60d5480
    3⤵
    PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11817622795235803387,118871232913160581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83732add-6b10-497f-9687-dd2cb077eddc.tmp

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
1ae2762f991edfe9c5df1c1ae1fb4685

SHA1
e9d833d32f378c600f746def63a85524e0dd8e73

SHA256
cd65b9c36b9e938ef630ce194ed974f5103fb6e70e455181d497b2265706910f

SHA512
3cc4b526a6ffcd545cb6586e20dc235c71053ebd3ae3274479087da80aa1148e849f420320b9413ee52fc0e50af96993c889a5763c5e7c27fb01015d9415697c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a2b4181117aa706284a915a207eed327

SHA1
754ba7ea94dbe45084409062db462fd8dbf2a414

SHA256
10b533c56fa12ed1e8d4897befc6c6c3e728328f07be536ad96ae85a7c90f32b

SHA512
f369f05c99c1ef6454126efc6fa0140dacb36851c4ee167c5071384562c2a8a7299c88d52bdd78e2b11df1daa9a5a5655560e444a5200b48c639fb95f2916ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f5213a65a0859fe24f2c99ca0d62c8e8

SHA1
9fbd59e10affe508f88a017538148e9e896ee127

SHA256
fdc6de2cbf10fee84859a7f17e84504d3483d2583a6c466af74131bd5f118f5e

SHA512
7e107be2d15dde2ba24a9c05183e614832ace7b3c460ec170d1eb5bea73457133bc6994a36f602985b259074cd4738435a93cc598e81b96b9d682dc58819d070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f593959d8188bb0091fc03947ce9d7a3

SHA1
c006961b399d2459709ad260b956a5e89009cbda

SHA256
a02d2ae2facc396277427a10c885da1a16be2f73f4c6f2515f19aae62e316959

SHA512
a67a90fb2242d121b95a180b4242d359eacdb672b55215946bf6375e41dbf90db8c3605b6236bdbfcf82db00ebafc77e6812d113f1524af54158b1fc50f48487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81fd89f23b994b962b09d20bef130caf

SHA1
7ebe712fc1046bcc4daeff91bb6a9240bc3322f1

SHA256
066bcc4f47ab4b3ffb68244e7d0e492129c3e661bbf8ad3466acfedacc635ef1

SHA512
80378082ca690fc09bd2abd8172af2f4be40e8987ad6fd15d6e3c9e9cbafd6709923256c06e02c138ca13452f05df76cf3ddcfab5ea58a5d96d43dc36a946d6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d2260812d24bf37ce437026573983458

SHA1
6c2fd690c7ea90215b979253160a4129c0fe5685

SHA256
e0d549ba2e391b80915411a24ae66a9e5b9ddcf2b33831f34be1f61e89a5dd87

SHA512
bace9b123434307fe86be42d335a6aae39d9a28c14a294565b05b9bb7a363acd40a629ee4ecbfd701c360ed18f93e32327d9d55c9c58bc4a4dfbebd45b98c92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55ae47260bcad74b4a45d6f2b0969ed4

SHA1
ea6859a84dce7554d8a69cd5ad21f0203e1b3a7b

SHA256
a719d23b4c45ab056f13de596f3934339313417d05969d200b93cf252fdaf2fa

SHA512
2ecbfd7828a2ed66926bb04ab31ce87fcfbc2f960792c84d368608a72fcfee2f53b0205a5cfb4291d4b6aa226a3b51df6e31f61a22f52182ef4aede892a6cd2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e79203d0f70092bf25058099947d5c6

SHA1
20d5e2bd3a2ef807207bc3981bd5494c34839c0e

SHA256
decca6fa6de1f0dcc2b46a7c45e62d1754fda43b509d92393c628d56930851a6

SHA512
b06c5cb26083e2ef7a407be262f37d83d9fee4788e30a94ce258639f7c1fb2ccb4e37ca9b77e4fb30c0fa0a9e80f94a5b9719efd2499c87deafc87d260eb0568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9901b3f4df94cb9ef4445648c127132

SHA1
9222272927c2da612687b59f7508655e11afff3f

SHA256
90b3be6e8b29dd8ae4504e9bd54a25a4284cf1063bb2984e67913c055f97a23a

SHA512
9706fd6ed417a2da804fda1321ec28e557294e4deab83f3bb5e5688603eccafeaa8d4f07544f1ff2aa68416989362990e4632da938fb99a789bf93936a7a416b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
66e2b5ec817b9465f4fa46ca33717fa3

SHA1
17d855c3b950ed30adfd031559cf247a5c171a6c

SHA256
5de25c3570958b4b53de45b0f8b37969d680824477eb608f87def058dc658a51

SHA512
baf74b5492e605ad987cae8cc8584a3cf8d7a52c76ff178cf5801b62dd44c232e41946c1b56f928d647eebd1c80caff66340688704a65d9912b5af2ab3316cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56e68c.TMP

Filesize
1KB

MD5
9dac8983c3b0272a00232d5cff7cc1c6

SHA1
59092abefb7043233e4900075d08a2b2332bb378

SHA256
f19ae0d7d6277f67ce6ae232e67d2669027b5334666c22543386500708b7d863

SHA512
fe692c8701466fe0b50679c7146f014ca7404513d0f1175d81b1b4832c1441fdfb043963d7809b22b7dc6d3042c6b3dfd3e58250bd958894d89503b20d219147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
6afc84ebc229f2cc3ab46f2670488f07

SHA1
6503e9b2b2a65401d27026befd644811c65318f5

SHA256
787b08b8107fee49a3fa9ee574414709c11d586e0b28a2f0cd4151ce25257ff7

SHA512
fc283b3f55bc5ed583ce1cd9b1943032c3b422cbe76bc63bef6467f3d1f84b40f161b20e765bf8017324bade3c234a27d0ca75122fd74c72df16b5acbfc135fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
521a6741a57430c79bad263d6b35e2d4

SHA1
320570acad8526d9fbbc21b649a1820c7f81969e

SHA256
1a920738518b8de8d1ff8c199fa928e24e195b9276464fca18344ef703b16eaf

SHA512
07e94aa7aec3c438072806cf5b659f22acf8e0570d3c3a7a3e9194ebe7321785ec1917043bc73869ea593b5435b766f09769af70b7c90a946bc8a99d052f374f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1hfpugt.5lw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
74a6ae73e3560f3476c0aed4d491732b

SHA1
af994ca47134c06a229974c775fc923894852fd0

SHA256
492b7a45829c8f3b5e39f14e3293d290cff3c99594b26a8656cf10ff0643d3fb

SHA512
83b44bf7356a875a502c00879f3fbc7ca8daaefef0044d1e9f2ae0e901fdecc19810c1395100a9de479e38614bc3f6f70f81adf6d728784aac090478b0b4a6ed

Download Submit
memory/4420-143-0x000001CCE2AF0000-0x000001CCE2B00000-memory.dmp

Filesize
64KB

Download
memory/4420-138-0x000001CCE2B30000-0x000001CCE2B52000-memory.dmp

Filesize
136KB

Download
memory/4420-144-0x000001CCE2AF0000-0x000001CCE2B00000-memory.dmp

Filesize
64KB

Download