Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1788s
  • max time network
    1742s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2024, 01:49

General

  • Target

    download.png

  • Size

    4KB

  • MD5

    3b69ff080e0ddcd80ff1f31e061ca191

  • SHA1

    d122a11505bee65798edc23736f112f4f51600c5

  • SHA256

    cfb20eeabc9018b31deb0edb5d4236cfab2c948b71931ef12e3510b71c66f81e

  • SHA512

    d07b77ce08930b1433d47d5ada664b0ea9570a9b26101995adc740a3248299ccf268563e7ac5cd01ef81c5b424dd1eff7510fa89186ee4b2752d4a2a3c7c6e6d

  • SSDEEP

    96:Ah6XXl+tQXWyJ5TajKHvwTlaG0V55iK+D6gXisSCQ/RAm:9X1sifDaeHYTlaG0LPI9Sbem

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\download.png
    1⤵
      PID:800
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff876d746f8,0x7ff876d74708,0x7ff876d74718
        2⤵
          PID:2088
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10746469433969785296,2012196200736136615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
          2⤵
            PID:5272
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10746469433969785296,2012196200736136615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5304
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff876d746f8,0x7ff876d74708,0x7ff876d74718
            2⤵
              PID:1888
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,16420407252113840006,12140852738688081847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5320
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16420407252113840006,12140852738688081847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
              2⤵
                PID:5312
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff876d746f8,0x7ff876d74708,0x7ff876d74718
                2⤵
                  PID:3652
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4456
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                  2⤵
                    PID:3996
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
                    2⤵
                      PID:1508
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                      2⤵
                        PID:2396
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                        2⤵
                          PID:3388
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                          2⤵
                            PID:5692
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
                            2⤵
                              PID:5780
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                              2⤵
                                PID:5788
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
                                2⤵
                                  PID:5796
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                  2⤵
                                    PID:5540
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
                                    2⤵
                                      PID:5504
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
                                      2⤵
                                        PID:5828
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5816
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
                                        2⤵
                                          PID:412
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                                          2⤵
                                            PID:640
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4816 /prefetch:8
                                            2⤵
                                              PID:440
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3664 /prefetch:8
                                              2⤵
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5012
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                              2⤵
                                                PID:2068
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                                2⤵
                                                  PID:2472
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                                  2⤵
                                                    PID:5848
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                                                    2⤵
                                                      PID:1636
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                                      2⤵
                                                        PID:5200
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                                        2⤵
                                                          PID:5208
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1
                                                          2⤵
                                                            PID:2244
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
                                                            2⤵
                                                              PID:5532
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
                                                              2⤵
                                                                PID:5600
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
                                                                2⤵
                                                                  PID:4904
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11307816967024879217,12153889509156094939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6752 /prefetch:2
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4460
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5616
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:5652
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:6120
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:3044

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        576c26ee6b9afa995256adb0bf1921c9

                                                                        SHA1

                                                                        5409d75623f25059fe79a8e86139c854c834c6a0

                                                                        SHA256

                                                                        188d83fc73f8001fc0eac076d6859074000c57e1e33a65c83c73b4dab185f81e

                                                                        SHA512

                                                                        b9dbadb0f522eedb2bf28385f3ff41476caeedc048bc02988356b336e5cf526394a04b3bca5b3397af5dde4482e2851c18eca8aeaaf417a7536e7ea7718f9043

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        011193d03a2492ca44f9a78bdfb8caa5

                                                                        SHA1

                                                                        71c9ead344657b55b635898851385b5de45c7604

                                                                        SHA256

                                                                        d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

                                                                        SHA512

                                                                        239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

                                                                        Filesize

                                                                        201KB

                                                                        MD5

                                                                        e3038f6bc551682771347013cf7e4e4f

                                                                        SHA1

                                                                        f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                        SHA256

                                                                        6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                        SHA512

                                                                        4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

                                                                        Filesize

                                                                        317KB

                                                                        MD5

                                                                        c66d2a55b276b77c4e3fcb75ae05f373

                                                                        SHA1

                                                                        a39f00d3bbc28016979d8eff3f0c8f7403f497d6

                                                                        SHA256

                                                                        2fa0fcf964ca84d153e246654562ad2c2d75a6dda4e661b257a5debaaf74f7b8

                                                                        SHA512

                                                                        65986ee09b0f69ffc135f795af002b2e890581d76482194f9c019dc321cde74e00a3e89683892a87b0eb3cbcd26b2b63388bd40daa1df2cbd34287ed6c658c25

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        c9dc8e7d0cfbdd9c788fc9c8b2371e68

                                                                        SHA1

                                                                        6d2f319d64e3b19959d0b2d6e1c45e44652e3266

                                                                        SHA256

                                                                        f84137ffc491d203a58b7498a355094f363ce33624a4b8ba3a5038ca32f9d3dd

                                                                        SHA512

                                                                        a43fcc37f3adeb8e0a19b127b1ebc57c2362bec3f05b7d3a7351769c2618b89513498208e7ab5b24511751a03fbbddd95facef91dbd6e4db935daab574da44f9

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        5533835e170d72b88806fc0aec0bac9c

                                                                        SHA1

                                                                        4ed976f8ee7e4844b1b8a26c99c6fa0f62ccaaad

                                                                        SHA256

                                                                        4b7b4680dab7ee333354fde2d982be815021d6557059f7952ab1c2d96651a92b

                                                                        SHA512

                                                                        508375cfc9bb834cd28b06e8fea0d845c76c2562532e30ede7747ba18ca3a2801cd18de775f7fc9ba5cea904f59f191a073125e92ad66503d1914cd00569e0ce

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        2777596eb7a2a194d4e14723c60baa33

                                                                        SHA1

                                                                        401e84ac4a86b16f7153e8354c34f702fc2ba495

                                                                        SHA256

                                                                        b9e49f0ea8fa36718769a31b8ba9903cb9d8d512826022527133426236143083

                                                                        SHA512

                                                                        a75cd3819337fd52cc700f20456b7e311fc077dd7bdd89b8c989dbf169149e27ec868d9d9784d0111b91cb827e16f6f9d874e3e5f14c11c063383b83e019bcd3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        01af286670287a10958c2f7a0eba1b38

                                                                        SHA1

                                                                        172bf5d5ce436d5eec0e95c9aa1126ff2262b818

                                                                        SHA256

                                                                        220db60c9c9f34dc9cb4cc4d8fe7dad34d6da80ddefa26af92446eba55805dd3

                                                                        SHA512

                                                                        d8d19abcc29ea74667a9ec0dfe6be3b55c8c98315f24f8a6b6ff6060b706e925120716aae598cf6b8e40e1c6b564a06a16b537e162560e842f8dcb1c520a0aa1

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        fc0d4833c42be73035042370bac609e1

                                                                        SHA1

                                                                        2817dcf5132551dc8057c4875d73e0f3d783c139

                                                                        SHA256

                                                                        0857ccb3c1f9c414c236181cc7c76c4981bd31446623030278340bbb3cdead38

                                                                        SHA512

                                                                        bb89b2cb455fc4bd05073b72a1983c8b2674f76871c182b55fa3b294bdc7d042f73a960ccad6724d8d26715de91bb8b78b6a99b7285393c5103aac35255a1345

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        111B

                                                                        MD5

                                                                        285252a2f6327d41eab203dc2f402c67

                                                                        SHA1

                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                        SHA256

                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                        SHA512

                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        2b8ab2e767267759f9466d9de29b67d6

                                                                        SHA1

                                                                        2f5c9807a06e5e4dc0fa05ccc3307ff4ba396e2b

                                                                        SHA256

                                                                        ed548805f13ac11a924a80ec3fea79cfe045ca1143e77219c572b48b3ac7b024

                                                                        SHA512

                                                                        d863b6bf582926a0ee70a3d304eaa9f4037cb0c63835ff1b7aca73422a3033edf72e9ba9b95e36826ad4272d89b5908950c78996cb15a7666af0e2932edbfa4f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        23dfb97d3453c352e108b92f7b19ba28

                                                                        SHA1

                                                                        b6ac4ff6b6c2d0b1a57bdb9c9a46cd7f7375e37f

                                                                        SHA256

                                                                        4d142d67a67b7a3643617651d699ec4cb0e5f15d33c89cf58d793b89e57cffb6

                                                                        SHA512

                                                                        dbf9991faf588215845275ba1eed0cbd05272242f1146bd326c7a49d895b53ca89fe95cc38ceffae3e6da251247488a1cc9c98e956a663019b8d543459813e43

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        18476d7fbf2a7cea0d0ddf48a9a469d2

                                                                        SHA1

                                                                        a0803cf0b4cf639b1cb9cf1b800d3886989839a3

                                                                        SHA256

                                                                        33bf86f9487c01a0b7cb5b4a75b1e754e326dee72939880c6dcbae23e77188ce

                                                                        SHA512

                                                                        7adafbb1b8fd3220afbe5aa5fd8d1cb8835116843e0d327d56927487fc71d449a0b791282240d58522867d852c876ea3634bcbb7773076715873deeec0695b0c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        6059f35073882bc83c08467bebfd4248

                                                                        SHA1

                                                                        7c2d7e2333af4575280e35d1da04595b5dc313c1

                                                                        SHA256

                                                                        2286faac46fdc7cf4fc0de4cdad2d31bae9a1e130bd1ae3fc5651b181918506b

                                                                        SHA512

                                                                        d617ff4de4aef230ad6294244c929b278d817bb4963ed5a81930ce681d0f185c3a1f172ca8e7998cde578960c6b2ab0ff28bd58e57591f00febde9307661b506

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        c3d03bf1232272a256bbc18c25f3ddc5

                                                                        SHA1

                                                                        2766b5f9eaa2a38835c074ee396d7ad2c38c26d1

                                                                        SHA256

                                                                        c0571ff7f0609d34998ff74872fbb834c2c4c4275e7afb382c6c3b78d05a648b

                                                                        SHA512

                                                                        285d5c1c26aaa9151c0d488da65d61cd3cc1f4cbeb70d1fa5566540b7a9e95b8c58b278fdfc34da08168847dcf1c3f0c0b6eb80cad286c2c44a848aac0a0e61d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        6b88037e8fb01484f8c96162742f0f6c

                                                                        SHA1

                                                                        78706e0d35625a66b4a59ace247c6fda30940a8d

                                                                        SHA256

                                                                        16322289e74e6f26957bac97814fc11fa57e238c93ff82812d32b1a81fd6ef11

                                                                        SHA512

                                                                        9845109e97cd207ca9e1bb17a807ae43b85f8c2c8f0bba166e8459dd8488f29c643fd89774c0d0bd496ac17dadd55585167c6770f217b4d16faab226c3b27bdf

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        6b5b23e875a292ae46f50c5068dd8e22

                                                                        SHA1

                                                                        4beb7fbc3c932bd65c2e4ee01abf2de8662462e8

                                                                        SHA256

                                                                        e62008b16a80577255356aa837015e9db4cd52e08c66de447de1de96adb471de

                                                                        SHA512

                                                                        c328f776f70730fa8525d0c25b1d5ad09ee6b7954423979fd05644094982fda57ec9934cd96abc1995386ae0fe542c1fb06cea85b76ee6a61e91e87008b46af7

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        56bd8807fbf57e97c10d05f4e36f3ee1

                                                                        SHA1

                                                                        499aa698b7925ee38f36c854bf94827cb21421a8

                                                                        SHA256

                                                                        8b37e425e7f8012f45296e547ea646d9b290e9d0a371f9ca859bc01bc45ba35c

                                                                        SHA512

                                                                        cfdb71c46cdcc048523233004331bb4bba9e9ba928ad0482e60636e552a6ede103ca801c4d23afc43bb49b3187c147249b226cbe658768ec71763edf148f4688

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        c608e6bbabd37d9dc8868a9597028278

                                                                        SHA1

                                                                        b28ebbe8c1705a1a1579d7e5a79489e33a7b173b

                                                                        SHA256

                                                                        83ad633fbec15523b542475f99281b4a0dcef7db0551948ae891d8bdf4791a25

                                                                        SHA512

                                                                        5c78b3c6704da51fff0657177ff0101fba445ec1758b8cc79be91f894d4e51f73f08502c38726d9fb380dbdd3602b41d2a384ac8a84a677f7543bd47bfa922b2

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        0a88c981f2427f64aee644bdbd1c03ed

                                                                        SHA1

                                                                        4b8c26bf4861305476c96f83090550f3e88c2858

                                                                        SHA256

                                                                        4ddb5f19d3cc680af707955d9a779e9c1d82aa7842f5da9b22e3c002a0e54324

                                                                        SHA512

                                                                        da9f0419b3f256e0dcf75d7256fec88013c8d97eb63a48c9239ec5a89b63bdf86e4a3e4316d8ee401ac46d7a2c0cb357ab3a6ec2ebb233199145fe5c2cb915c7

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        8c0010f3e6e9f075d8cecec1294bfc20

                                                                        SHA1

                                                                        bbbecff66007495c70a5b7f1f316c46ba6976ac7

                                                                        SHA256

                                                                        d6c844e293679bb52a9ff9ad2ce3f484927b7bc0831e0d37eb24b82db80c9801

                                                                        SHA512

                                                                        e29688f2139cb6be44309fb185c925d1acd3833c08c7c797b88d1eb31ba52f85fd828c5e8aca79b8637fd486080220b02650160313a486976dd27fbf6881bae1

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        523a6ffd1b94dd285b72e32a1a427b44

                                                                        SHA1

                                                                        a0e5a9d995a29851a62d0eef129d150d025448b3

                                                                        SHA256

                                                                        38bd5bd3e5a752b43edfeded9bd8c4d0a4967464cbb3dc8aacc8ad1315dbedb6

                                                                        SHA512

                                                                        9cf94630d741f50165a9ba73a1e0417490952e04fbf137c2e50774dfbfdb68624890b8a0eadd500c6ab2440496a379cf977d48d6f4ff1002fe51d8ab5464e6db

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        ce94ce349345149aa2b48757bfda87f2

                                                                        SHA1

                                                                        5c5d68385557ce90b42ac6baedbd1ce80fd23341

                                                                        SHA256

                                                                        7656b6075a7b61afb3fa3d02a036a549e5be16f813b23df45eadefa72794dcdb

                                                                        SHA512

                                                                        126f6fa9e9f3f9ea145021fd484a46fbb49ff0b099451f87ad54b0c1a0b7072ffdd4c95893d2e6e56338015dd4eeb2b586e343e8dc4171668e4f3385856db44c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                        Filesize

                                                                        24KB

                                                                        MD5

                                                                        f5b764fa779a5880b1fbe26496fe2448

                                                                        SHA1

                                                                        aa46339e9208e7218fb66b15e62324eb1c0722e8

                                                                        SHA256

                                                                        97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

                                                                        SHA512

                                                                        5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        872B

                                                                        MD5

                                                                        460f4a7ecb24667d15788e0685fe7a74

                                                                        SHA1

                                                                        e7642076677f628791ad8114cdee9f7a85d1d89c

                                                                        SHA256

                                                                        7623506e8dad1ce396bc709c4ee2f64d6f494dbadf4a02a761a7f6590c4f75da

                                                                        SHA512

                                                                        4724119982662a0d318ab6e5d368d54190ea851f0dc12b90ea99fbf07c4465876e76f5d873dbd6b393bcd5fce9660ea4cfc707015d9c96c3f8e21ef8cf350b2e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        1a14032f43b756649db24552ecdaf5b6

                                                                        SHA1

                                                                        96d43a6813767bfaf497f33326aba956eab937e4

                                                                        SHA256

                                                                        3ca978eea609af4941429a0a82ef1d8b46b7beb102008f453f1a9089bd40d247

                                                                        SHA512

                                                                        09a4cb956b01879aea192adb8a6df5c20f34b1b65de688b4da1b0e3d39a3ee8eaa2c539d9597e4bc53ff4ba67d984e1c4c55cc8dfcb1ca4bdf2b8f63f3f11895

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        0b5354c81631234b9d494475d63150bd

                                                                        SHA1

                                                                        360cf8055ab168ffa38a984c52b9a7365acca3b6

                                                                        SHA256

                                                                        8b0f441d778b80aba7a650ca129980021314518edda9a1d144240400bfa48c84

                                                                        SHA512

                                                                        d5ad4b0f0dcaedbab8d54dbaccbe7768940cd244351124b738ed97c9c688889a6f699b8c3a9271b379925ae05c10df4b43e99fba9bcfe8f95e11ef618490bb0f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594982.TMP

                                                                        Filesize

                                                                        536B

                                                                        MD5

                                                                        cec18ad00e66635a93824b761f0ddb63

                                                                        SHA1

                                                                        841866ae84641671ff09046b621f56a48568b3c4

                                                                        SHA256

                                                                        d4c50aa5b75efab713351a89ca809216d426d4d4bcf53f866ab5959f7db89cf3

                                                                        SHA512

                                                                        fec837c8b8783ab49914831c3e41fc0e1be74bc356cb8a4ae7ef2eb8375e2c1b66ea59c9d7652d767267094683d372711fab1956d296a3ab89a8f9de69c59400

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        fdb21d0bec7d645f61e47255678e1287

                                                                        SHA1

                                                                        fe57bcb63a45c591a412732537216d76372cbeb7

                                                                        SHA256

                                                                        e05b4abcced76de1142299933f979bda05f06866d90887cf8d88236d98a04fa0

                                                                        SHA512

                                                                        a63282b7b80851734fe31d9aa5aaf33dbf5c6eca19e286d277c7a5e8cf86b55720f60be1fb532f7c7180d43240d7aeacfb11b1976b13ae1bccfb95918228727d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        c67feb96b849263180c5f961c0c8dfb7

                                                                        SHA1

                                                                        4e410d35c990086d5e67f70429029b5b9a48f4a3

                                                                        SHA256

                                                                        5be40537bdc2ea57974b1f9a6e5a8b993cd2258370d82e7b30918c19959d8365

                                                                        SHA512

                                                                        9705f1d98a9489f85d3e88e7f669c25dfbf2a532a83ab63255824868391d22ebfa73696a8c6e88869907867c06876a2f0a65228abb8dc27437235e70eff8cbfe

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        acd8bbbb5de569da5af2aa33e9e13a49

                                                                        SHA1

                                                                        cfab7f7e68c0a752ddbeaa586f27a5f024c6d586

                                                                        SHA256

                                                                        b549c9b69dde9827b2883b747eb1ad08fcf90b06638ac508e7134450bdbf5b97

                                                                        SHA512

                                                                        9e240b0f7b58bf569dd60c02702d1d5166fece0b4cc4a32092438943acaaa7879b54c40d7d38420a259841fcedeeec2b83d47049c48c3d0aa584fdc69b429b3f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        a8227080dd6e45a2471aa4ff7c7df0e7

                                                                        SHA1

                                                                        566e9583f06060922073c3a80347d74f59380425

                                                                        SHA256

                                                                        ef76183993a8428c8d97a2d8cb15c2b2d205fe7c50490a252402fdd6a8219c43

                                                                        SHA512

                                                                        6dfc28b1e8475eef1e1125a5142a8212fbac99ca49487b918a60610f6cc34d0708b61178ade30bba5e970f6eac7d221be456faa67a080a1519a0da091144dd86

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                        Filesize

                                                                        2B

                                                                        MD5

                                                                        f3b25701fe362ec84616a93a45ce9998

                                                                        SHA1

                                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                        SHA256

                                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                        SHA512

                                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84