Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2023, 02:11

General

  • Target

    1312-97-0x0000000000270000-0x00000000002A0000-memory.exe

  • Size

    192KB

  • MD5

    210acfbebe73480cd1d5df6564618ab8

  • SHA1

    b10897e8d9ee1cec2ff55d11768c709a77cb326f

  • SHA256

    c6af29a06b2276173fc80a0b71f3c5400dc89c243c516ca598c71db41c8ad9d9

  • SHA512

    daf1eb0607edbbe5645cfe65ab9ebec16975596130bab4f3803c789f3e0e6e0d8a0e741f7808fe975fe090e7887d5087a87fba1096642bb292197cabafa27e03

  • SSDEEP

    1536:fhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRe8e8h3:flEebE6Cyk9i5/uGxNMS3azNJ8e8h3

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1312-97-0x0000000000270000-0x00000000002A0000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1312-97-0x0000000000270000-0x00000000002A0000-memory.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      2⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe455546f8,0x7ffe45554708,0x7ffe45554718
        3⤵
          PID:4044
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2408
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
          3⤵
            PID:1896
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
            3⤵
              PID:3736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
              3⤵
                PID:1900
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
                3⤵
                  PID:4648
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
                  3⤵
                    PID:5048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                    3⤵
                      PID:3808
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                      3⤵
                        PID:4812
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
                        3⤵
                          PID:4012
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                          3⤵
                            PID:1864
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                            3⤵
                              PID:4648
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                              3⤵
                              • Drops file in Program Files directory
                              PID:3916
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7039f5460,0x7ff7039f5470,0x7ff7039f5480
                                4⤵
                                  PID:4860
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4820
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
                                3⤵
                                  PID:4568
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                  3⤵
                                    PID:5016
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4504
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
                                  2⤵
                                    PID:4168
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe455546f8,0x7ffe45554708,0x7ffe45554718
                                      3⤵
                                        PID:2948
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1492

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      09932bc072dfd2591f537c31e7f7c5bc

                                      SHA1

                                      5992d292629688f3b98db35a6274f9b9ef8baef1

                                      SHA256

                                      41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

                                      SHA512

                                      0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      218e449501e9bc2755a9758e17de9cde

                                      SHA1

                                      b29d3810fddc119b996275825d0d6b6bfe00129f

                                      SHA256

                                      6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

                                      SHA512

                                      5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      218e449501e9bc2755a9758e17de9cde

                                      SHA1

                                      b29d3810fddc119b996275825d0d6b6bfe00129f

                                      SHA256

                                      6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

                                      SHA512

                                      5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      066e8a0872f382108700e7fad8e1e9b6

                                      SHA1

                                      787876f5ad5bba98fb2f24798215bf33abc1f0a0

                                      SHA256

                                      1f586616c41c6a19342b0c2d556aab0a5c03ab73640e193713f86cb319b09cd2

                                      SHA512

                                      3ca4a224bf32005bc84dc6b12b89a1895425aa8b43ea507ebb3a771fff42ea2937ab249b7f7fe9948f5aa31944f951deaccd5e54d0056f72b3cfe25c364a46fa

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      264B

                                      MD5

                                      cc801235a81c26e85fc29526d6d531c0

                                      SHA1

                                      16c6ac78a579886c2e0b9f06955ea53906c1af3e

                                      SHA256

                                      e5e10c542c3ed0ee54e974dcea4d303ebff3cf0c2502d6490041ae85c34f4a54

                                      SHA512

                                      155c26387ac1b6463763e3f4b57b72e98c21dc3e9f4b9b148de7818b896a75975a1b69d1268de06fd7bb3d9595f2a095c975140d0218b0b0b581dc99b0e5dfc4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe578bf4.TMP

                                      Filesize

                                      48B

                                      MD5

                                      16c6f2facd1a8176a60463f22533b2cf

                                      SHA1

                                      82c4809768ebe2774d354bdc3d9b0d2778368cfd

                                      SHA256

                                      2cd2bdf66f7040abbe5fe6e3166cd09e3be84de2ebd505b9fceaf6c30f9d42ac

                                      SHA512

                                      22d20de4ca960843842266ac62ac2c91b14dc816e127e04e91fc8451b10bf188ac703ab1ea82d59eed86fda821a44c69476f6affed5cf99443f64525b5af083a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                      Filesize

                                      70KB

                                      MD5

                                      e5e3377341056643b0494b6842c0b544

                                      SHA1

                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                      SHA256

                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                      SHA512

                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                                      Filesize

                                      2KB

                                      MD5

                                      5ffd39373be70a6e05107647e75f9271

                                      SHA1

                                      5a86978aa991a19b647fd9f76dd96272a661d336

                                      SHA256

                                      55f0f9a6068750ec589cb7e73b9662e9243208059c880402f50ee8ef5c0c7570

                                      SHA512

                                      7511f57d2b0835496de5a05b6509a7882a618470e6a0fc5802b88ec30462ad361682675b5d6d521eee01a9bff0611193b1b253f7f4c86e7b1a4eb8d39786beee

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      285252a2f6327d41eab203dc2f402c67

                                      SHA1

                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                      SHA256

                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                      SHA512

                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      346B

                                      MD5

                                      172a03f1e073cbc347cb5102d038fa13

                                      SHA1

                                      83a95a02491a4b046ea79fd04ccf6c5c24b29d60

                                      SHA256

                                      b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

                                      SHA512

                                      2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      4KB

                                      MD5

                                      1c220ab17f97dbbc9bb6088225a31c63

                                      SHA1

                                      39c869a9080886c93b4e7d075a54b2bdffbb4bf2

                                      SHA256

                                      8912b0709f3c59662791f338b68ac4643fa83e4fa3f34a22f666c588780e66cd

                                      SHA512

                                      54592081a9dd622f61e453ebd146921cd8bda19f58d144318077b77e799cba903254e8065cfff7a8127decd04c3636d21a2ad3aa607ec1d4fbf12f9abdfa4d96

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      77d33e02689f7910b202f32e95c197a7

                                      SHA1

                                      e7c794dad4e9510a2f439d22f689c260ac5cffa4

                                      SHA256

                                      78c05356f81b2348348e55d9493b82dff7eee664923f1e03a3f90753cb1b3b4f

                                      SHA512

                                      96c866ac16a0c93a1e71e6bf9420f7960dcaf4a0c8e0fd816668f2adddb3d5dc62068b10c70605bc87dcb54e79a1c80a2e82f04a125430b93b45bc71638d5f77

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      3e2d7e875b71c77e7c3b7f6373019b62

                                      SHA1

                                      e803c1e028e9fae9522646f6057bd6f8853b5d9d

                                      SHA256

                                      7af5b889035c284b1bff3d10f35f76007d88e6877c579540749708d8ba7fc8ff

                                      SHA512

                                      dac73e50ec6473073bad38b986f8912992020e286a8011e5e6ade0a16fddfc77615b2d72f16ebeae61d3c141d85e4327f6cde80246597997259f57f4d979ee02

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      06031cccee6e1ce17966c1b80f33d9ef

                                      SHA1

                                      8bde290327d41dc22ce2fa24bac69f4e849af953

                                      SHA256

                                      3f5e917be6bfc9311f21bd4a8e702938814a3da67c1220db142cc94976fa4c90

                                      SHA512

                                      1a8875afb7f567c16a1ea01318bd97a06dcffd7470fb80f154dbdc57487c1a50ab21127e8af433f2fb0b1e753813b24d789a4fdfd9992267ff75ef0b15fc7322

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      44cd4fa724374501adca73ffb091cdc1

                                      SHA1

                                      14bc6c4792b3bb6251e689c791c49a1b5a11653a

                                      SHA256

                                      3078de386831fd08b2ee7f7c0c2693daed7f685e02bf71a6a54bc3f4c1f658df

                                      SHA512

                                      2f4485d44043507714f85c959fc628969c51c7695adc75b17c4ddd99680171a964af2714bd25f69c21adfa7ddf8b042b81f54b02226de221bb944f8e823ae917

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      367B

                                      MD5

                                      f7b226bcf6a0409d16b00080af69668c

                                      SHA1

                                      8d0061594dce4451732f11ce852385b78b706f17

                                      SHA256

                                      e5017872d17c0f58564c39c85f5af3049afc7d38bcc8a3a0dda22b4818f3d8e2

                                      SHA512

                                      33d4cafdbd5a3eba890875adab6e6d1b71a1fc7028cd4b3743110a6e9a6e7b97bf14f21ff944db0a8ff4978533aa9117a9aac0abead195b693afc35a56dddd4e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5774f1.TMP

                                      Filesize

                                      367B

                                      MD5

                                      7d8e360be80d7a00dcc8894db7afd5ec

                                      SHA1

                                      00451304ffc24637d136c30e53b63d7407fd8a12

                                      SHA256

                                      86679e591c195211455416bdf804c4b49b632098228566ad78690a090ccb2a9b

                                      SHA512

                                      a3c32b037d99d9f501eab2b6255e58fc71e6e378c0428b03438510256343be611713d4533b8bc913507bd7b6a44d4f6f373314860df5a81473bc29b1009dcaec

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      9KB

                                      MD5

                                      b9b09ca72b315075eb5b402b4e4f2c25

                                      SHA1

                                      ed86b2cdfd3c9073daaa91fe3054ef088ee05043

                                      SHA256

                                      f8fbdd9cc0ab75783c275ae3deb6fe67448f48b01326b2eb5601e033896f3b7c

                                      SHA512

                                      fc0ccf5c773961f2d282d7683a1754ca52b9b0946dacb97daef7fa38567269d89ec36a10713410eac8c7e7fced398e118324ce3330c38a9f64dd7b387820dc9b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      13KB

                                      MD5

                                      9fdc7622ca238d9163890b354e1b6a41

                                      SHA1

                                      3cb4700f072bd183780721ab8d21ad402db6bb4d

                                      SHA256

                                      4e5a2a6de5fa023455c7855d63c59b3b6dda2dc37ef96343b5a6eb082d903939

                                      SHA512

                                      2b131e059f10095a1ffc6051050d6181df1fb041942a0a507bb28c57ded019d7ddfdafe1cd1b05fe8344238621bc9fcaf1c37ce871d0683d10435f9e043edbf0

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                      Filesize

                                      3KB

                                      MD5

                                      3a9c57ea0cd76fb31e40b3d2b2a79ff9

                                      SHA1

                                      23acd2d8a83121868ef1e8bffc29df18f799f61f

                                      SHA256

                                      8e2663ad72e0e84f7947741e1140fe25b845a150951b4a2958e2c688b30f475a

                                      SHA512

                                      85502c1e6e3dcda4751428f11ef1eb0bb12f089ec933a022b8a9f93763a5045525fbff27f164d468d659c179dc3afaa29e70b5dc6b365c3e9ff6d866cfc37d58