Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    633s
  • max time network
    675s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/01/2024, 15:42

General

  • Target

    http://usimmigrationsupport.org

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://usimmigrationsupport.org
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddf463cb8,0x7ffddf463cc8,0x7ffddf463cd8
      2⤵
        PID:4184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        2⤵
          PID:2848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1416
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
          2⤵
            PID:912
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
            2⤵
              PID:660
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
              2⤵
                PID:4284
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                2⤵
                  PID:6016
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5324
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4540
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
                  2⤵
                    PID:4288
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                    2⤵
                      PID:4136
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                      2⤵
                        PID:5664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                        2⤵
                          PID:1676
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5340 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
                          2⤵
                            PID:4688
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
                            2⤵
                              PID:4860
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1096 /prefetch:1
                              2⤵
                                PID:1100
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13502789923253207970,11577292333911204221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
                                2⤵
                                  PID:6096
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3164
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:5296

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    0307d75488a9def144d0373178e421da

                                    SHA1

                                    1e4351dd4a29b6340913848163b4df62628ad06c

                                    SHA256

                                    9e1bd506806510408dcb9d5e1eab6672d905780282361f2b9974ab9a9ed1ab9e

                                    SHA512

                                    993dbb0491352352ca89542922df735fc7b3cc0d14a4790f106c25ee9fd616d0722151d05e045ed5863e56b128c3308a561b958bbf5fe3bb87498e8a6d12a50b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                    Filesize

                                    29KB

                                    MD5

                                    df3d714940aabe95750332c08fb9be5b

                                    SHA1

                                    5ddc8bc472391626ee50878d0192e2f061f8ebf7

                                    SHA256

                                    d7ef4abc3f9a0179739a981ddf0e8bc78261b3713c5eef5b517b59bb42f23cd9

                                    SHA512

                                    7371cd2a19f323194766e813b0df847cf72fa8aeca5d4270feb631a57e091a3b4270e744dbfb0136794b936df53763a83b3788e707884d6357aff7fe4c83f620

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                    Filesize

                                    133KB

                                    MD5

                                    c26d36108c63e6bee9a73da6fb32f7c3

                                    SHA1

                                    f4c1e48f8b868fa21830803166b089bf64bebe82

                                    SHA256

                                    773001c2eae356fc57984a3dc0334b10be8ea7a829932241ff4ea02ae6f4b8c7

                                    SHA512

                                    732f4badca50e7cc3af8234292c02afb80e9342801bbea390b03628e784dc7a5f080402519223b4589b20b1132d0b1e324ba03e653d72202ac5dd4f739a5ee7a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                    Filesize

                                    30KB

                                    MD5

                                    3532561b9c23cd402012b418717c3262

                                    SHA1

                                    07b6426c9ea6f722cfe7a5cfa5b79b872347e846

                                    SHA256

                                    a3421081499c110274ab607f277d322399bc05c6eaddedbccd86e0037bad4348

                                    SHA512

                                    ce21ce1f69ed1e496950fb5c34ef5577c78577709f5b3922bff2ce077df19c5a2c1a06df67a5e70115a95f3ded783225984c561a20a90dc5d2ae8fc599acb8bf

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                    Filesize

                                    115KB

                                    MD5

                                    920f3f580618b37f4c6d18ab49cc972b

                                    SHA1

                                    7b3b73c84e0ccfa88978b851ae8eb91ce3a86faf

                                    SHA256

                                    6f9e2d806526b0d2706a3782f61c4630ab92ae31b77e0b08dd0152d267179043

                                    SHA512

                                    9bb44abf75d0d6eea7f395457a0bd46de204b1c2fdfc3ea09598ee39452c5a5b4605435d5629b488bb62f4dcca7208ceaa6629095ae6da2dbe669dd24f69c8a6

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                    Filesize

                                    29KB

                                    MD5

                                    ae54e324e99578620b7822bbc7089b0f

                                    SHA1

                                    ea42dfc4acb5dd944d0d79f982b099e14f9b159a

                                    SHA256

                                    b38386eee05d6d65541f53757d7cf943313f09b4ab76ba5177ae2eaac68f3341

                                    SHA512

                                    82f1b83770279147373432cd3c73323cbb0b61b00d22bfc8a22e7afc3b21d95addf107b6f1dfc9c9a031143e8682808f07a37bb8a77f0fc348fdc4e0cab1ed97

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                    Filesize

                                    47KB

                                    MD5

                                    7cf2d6faabd48d1f8b8df4cd0697feea

                                    SHA1

                                    620a49c0917e13cdc949e55d644dd01335780006

                                    SHA256

                                    7abf9e3e7eb686e5b97d51e07266dfd51fba34bf96eac6bfbc71568ebdbaa4ef

                                    SHA512

                                    b6a55f028ee609efff641887cbf7eac23d20089e10d89f1551213f1b8adf083efb14eed1f8bbf3e5cc60a69fae8e1c558982bd59580634d0c8d48371c46f4094

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                    Filesize

                                    20KB

                                    MD5

                                    6d811a53f287366c23f884fda87fb589

                                    SHA1

                                    089b6a9b481367a9737cfe0fee1b302d1f6b8056

                                    SHA256

                                    d93d8cf04285dc2328f257770e9d1b8de96574b3110efeb396cb0793a5184fb6

                                    SHA512

                                    5f50120e6b5b83000577cdd28a926b0e9877ce92975f685ea7327bdbb21e1653c350ad22213518edea4c81322ecc8bd54f1ba00af691cffccc9bc3e1ec4a8936

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                    Filesize

                                    21KB

                                    MD5

                                    73aaa95eab3115ea5a1e5c1cf16ea645

                                    SHA1

                                    2f00c608a688cd2b2e6ad37637726b0e081da1c7

                                    SHA256

                                    2301bb030a2bcaa9c763cc4771bd717aac16709c29eaba00673fcbe7cdf99a59

                                    SHA512

                                    687974f4b96baea3f1c7aa31bf779e631165d0c928a0d006576034477f6de591b446d2683296ff3a52bed9450c43d6284f1c660e860db23465fe499b9fc3a42f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                    Filesize

                                    105KB

                                    MD5

                                    38dec8690f60df0605208c0a5d40a4d5

                                    SHA1

                                    c4c32ee99ed896ccb010e491477e906d59ce47d7

                                    SHA256

                                    ba06f938006df480d00cb77b7c5c09c93d3df801c7a4ef987a1642ae92adffcd

                                    SHA512

                                    e023fc7823b7ad51da835744b726333a72117f826a95b74385eb4bb96e2788bb06bf44b81d4cc9b17ae32c82c347e978f4f6b373265c1821344d048f0d741098

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                    Filesize

                                    54KB

                                    MD5

                                    b5b65e8d827e4f11693892e7feb156a1

                                    SHA1

                                    fddc96526258868bb76635dfa27cec4ef9f9d6a5

                                    SHA256

                                    ebd14c53121608126d07641bd0b4602fc2401dc3cac521408535d9c3b2ed0441

                                    SHA512

                                    d8b6090d75e58948944ba7be529495762e72a13343d31c84b6322af2e2be02e931c07a7fb589132e3714b3313039dbfa35d261bf7cdfe34b8b1a0feedb2c426e

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                    Filesize

                                    28KB

                                    MD5

                                    c31bc9f38b87ae799ceee49915236be4

                                    SHA1

                                    66d0e245a36181e58d6621a1282c1fe06c6a6756

                                    SHA256

                                    eab402f5cfedd26d0b26bb5964883616b21407a7ce244598c94d7f8d25c86aba

                                    SHA512

                                    79ccf2b23ebea04847a2ed1d489da65806084f2455e8e9853745bbcf2fa942bd73aec7ab67ec0789bdc5d6a666f71466684d20c02a2b3d8284d13f1b60cc326d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    360B

                                    MD5

                                    1088ffb12b9b10579a55cb399cb6bac6

                                    SHA1

                                    bd72abf785fdab9f30f2bb09e36bf9223802bffe

                                    SHA256

                                    4753167b02287f1a3ef0c368953b1fddae92aa0a4669315a471bf31b66e9d309

                                    SHA512

                                    082b83924e5cb219d5f53c6666de167646940df21d9394953e722c97f3b0bd4edd19e978e9cb9dd6cbb6f951044398ba4987daa427f5d45f4b7e7f5abd64131f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    696B

                                    MD5

                                    113e70f4e37a6756950a381f0a2e95cb

                                    SHA1

                                    91e4c713951f9de2271c7b24f21f4cf987fe3bcf

                                    SHA256

                                    cd3f4d5f891461cf567e5619604d798eb7a95e379d23d2932e1f7825010b4cef

                                    SHA512

                                    1945a852cecc0cfe1aeec7f011dac7ba2f4ea275a33275c790cbfff2ac9685821f8e46e1b7b8e1bc950b6659594d90a7a9c320e1c6e6acdf01286296cf6faa9c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    840B

                                    MD5

                                    de07c370fa733746661f5f3f2bd8e85e

                                    SHA1

                                    2f0c13870f8b20407d7fa677e891eaeb9af85319

                                    SHA256

                                    1f9d0b9f0719601ddd5a79827371d28855c5bb2291caeb2b659a34b83695f35b

                                    SHA512

                                    475a7f2c03b64a6f048d4028c678de8b37759b9bf6a76962fb5a511a9f09e5110e306cac54334181879be1db1be6251bb7d27b22377919ae7fc6c958ce01a302

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    288B

                                    MD5

                                    524500c132d3b872f566939bd7956b63

                                    SHA1

                                    49e5c36282fd73dce3adc6e9072e139052237419

                                    SHA256

                                    1fefbc6ce4ff1a47ffa1a9dc4cfe9e03f4b53436433c13dee4f2a020e8bbbdf7

                                    SHA512

                                    8f8f151d54febdf1697cd7e9961a29a1f1beca34dc9abbd75e1b71e34d6837c82bf744e165a483278d22a21f4bc6cc820fa6b7a99c72b38daeba620b9b85ec75

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    98b4a0bab341fa02aa356e2380a64800

                                    SHA1

                                    754f9214ae32a38a2807ebb432675b498f40a2a9

                                    SHA256

                                    6989538cab15d272244993c240e44a9c290d0127c8c78b77fa1c88e09f7a6f2e

                                    SHA512

                                    624211dffec3835e20fbbc1086e53ff7a6bbbf75cc2d6fbbc76e16c49a0ea7f1cbda2e3ff41dee08085d4d1e1316b2d049034ff8a9d2997de4e6df14e557a08f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    111B

                                    MD5

                                    285252a2f6327d41eab203dc2f402c67

                                    SHA1

                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                    SHA256

                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                    SHA512

                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    111B

                                    MD5

                                    807419ca9a4734feaf8d8563a003b048

                                    SHA1

                                    a723c7d60a65886ffa068711f1e900ccc85922a6

                                    SHA256

                                    aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                    SHA512

                                    f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    45723aaa6a4bc54f16b2fe180ea3de4f

                                    SHA1

                                    2205fa472ed8497b36f843dc18a4317169d9362d

                                    SHA256

                                    634be4826532cd108190c5dc6d3221f8bdb0d39225cc86c8fcb59603d3c64f3f

                                    SHA512

                                    22d34bccdef597a9de6daa102574b17515767166b278816dc32c49fff08c966fce95c028e1a7edf279fe23c83e638d3f52cd97d479cc782408b41fcc6c054a93

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    b33319052defb207755cf45f30eff90c

                                    SHA1

                                    d30f90856e1a9be7b2872e8590cc7ad716503fd1

                                    SHA256

                                    652780b1dcdd21f7e875716878c144741410d91190e4451deeff44585ab1b4dd

                                    SHA512

                                    f5db19165ddc5fb9a2edb90fbbe83b8056630406a911de3a9126861bf23a21156b0c32959b61b8ad28d12d14f6d6728a3ef1d6168e0c333f5e5787b3479ff97b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    17db010110ff8182572bf797f0b5a49a

                                    SHA1

                                    3301fbc0063945b7db2ed7f6d92bdaac14fe3cf7

                                    SHA256

                                    a7610817fc24c6decfc15023282655920999b339422e5e4e3d6a39a70e5d345e

                                    SHA512

                                    1b968f3f4baf37733fdf0bceabaea3d5e7cc89d6f77f73c9d9203fcc8fc96b99176e718d46e2625d47b0ba1f70d0cd7f36c01265e4166c963293d360ff9ebf99

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    23f3b0ad56b9f9750d86c8a0307a2370

                                    SHA1

                                    80bf6b8eaebbde9a5c636d93967c3755123ceb03

                                    SHA256

                                    ba160949c1c0d3c199813fb47710bbdaa4311dbe655adff6fbb00bb068f4acc5

                                    SHA512

                                    45ff4bf108aa0014fec4c4b44ae7b7ea79c9df03b184465c6227db09691a1259c58c2a7980bf7108fc784af6ca66a30ab5b517b978b434816c6df60e5cc4143e

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    681efaa1c302c09f56b4a380857fc36c

                                    SHA1

                                    cfb7155efcf51e329e0173801e28e97ced5b3a3c

                                    SHA256

                                    bdb8f549709d52684f75ac033d4a203573d02f49ed54682c87ddf076503f599c

                                    SHA512

                                    c0b0cf75bc2e1862d00cb76cebe3317dd89ce367d82112896476a6e5aae42d19dfc4844e15e55fca110703e2a15c908a7fd9800f9cf8f5d745248eaeec079514

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    832343348157205181b3b13ee3303f3a

                                    SHA1

                                    7aa7004b14c84ec96c9909e194770c5301cc069a

                                    SHA256

                                    5685c63604c12dcc876e57c0dbae53345766b2a05d14dc9d77bb9ab8cedbff84

                                    SHA512

                                    64ad0276eaa4e10de64da6faf0bc0d3397d4c17bca6b48b0bf2f320ab309f7c2e193c877e62eaa71bade9834f92cc7c6e49a92d2daf064e4b6313f79c1170526

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    1f0d5926f77aec9a76263352a485cbaa

                                    SHA1

                                    d30d64572d1e90e59e8a8a05325fb296ff9b88e7

                                    SHA256

                                    c3e2269f64c31b8c0034110898a562807a77457c6baa1170152b3012ecca5696

                                    SHA512

                                    6fb7fc45034a165fde0351b656d4990a8968d03da6d519f86e258b3163af60ce1757129bf1f93722c92c7ceddfbcc652e2b82e8a473591cab794bfa3f00b11e6

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    3ee5eea28e14ad8c905b54ec90854239

                                    SHA1

                                    83dfa6edbba1b41cae07306f679e0150bca11955

                                    SHA256

                                    cc18495bcf807215b0b350a203e731a8f9ae9287fb1299bcdfe8e9fc03c0486a

                                    SHA512

                                    d50c18aed4b8164ae54ba6ca4b70afac460484bc891b65fbde47c7a37165f6029f4671886e0402bdc190634d22a514c9eaa9bc6776fba0c6d888f1d15928faa4

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    2bbd43f2e9418d124d55f214fbf4b47a

                                    SHA1

                                    2a8a1d0a91e58574668b49eaa7662bf2ad6ed6e4

                                    SHA256

                                    717efc066b36dd9c15b358fe7e7ee0969585ea948ce55592014bf73254670d3a

                                    SHA512

                                    cd149237105ee64a51be9c1e3e3aa271edeab270bc7a2135a1df8481c72f077c5f673f9e5c2c0c6c234a24e0e282c790bb77a5a0b52943a384059a3b920e22c1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    74574be8dc64bc4938cc769853df5515

                                    SHA1

                                    6e2534f5f50ee74c6ab9e2148dc7faa072f4989c

                                    SHA256

                                    088a457a3fc1e629126c3978657e97d18a96b57cab403ac503eeb752438eff1a

                                    SHA512

                                    1cad9cf8a6ffff39ec2f2c9bf29a9b34b55d41c1429e436c086287b14d90696f50e0e9f13f29a4f112253fb5f32b6a4e5f2182e900fa4e39dfce681a485d3bc0

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    f453a0bf7b77458035fb1448503d3702

                                    SHA1

                                    86ee146eb786a599f7062b7510a092e559125657

                                    SHA256

                                    aebcca895d2de5430daa5a46e6d28cc036932dbd892e411c2e9eb0e63e18270c

                                    SHA512

                                    a8aa9af4249592e3522cfec6396a33e4a993a3658cac45404a1212effb84b0a10ee3bdcc233eb10832f73e510a76954b1665c838df0118eb041f910c524aaabb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    633bffc59274e2a69dfedc7639d993f5

                                    SHA1

                                    f1c5384f26a6b84c688cf9d4de4436edee3e78f6

                                    SHA256

                                    06885a056fb98326f41a59926fb64f66d44b80b63176c9d5dcb4708635fdb956

                                    SHA512

                                    35b4a9577c5d5a10f7a52604969fc30c269e4e53b13e61d59b8657be0b0b5a882cd278310f31bf8a7b2b09b4cbcc491fbee42f300ebea747413321c0a19a86b1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    355aa0c9488a9ce5c9f97490f52d5bfb

                                    SHA1

                                    32540aa77e1501e91c500736f588ebd4be1de287

                                    SHA256

                                    5708900a20f82f5684f665a988b4e3005bd454feb942cc7a8d8eed2803abcf7a

                                    SHA512

                                    9f6052f20b4ab08f4fe183e734f8f6b4784f9402912fceb9dec23eb82caaf2093cd9d3a50bc0b252c18ffeb23d5fe53c07ec225fba0972040a3edfe0d7f0c524

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    283acd1f85910c582c811cdb7ea4c32c

                                    SHA1

                                    8886916f4761a2ae115051b00b1569c9e18107d8

                                    SHA256

                                    fe43da59d30b3f4d1f05f9f552af352f30b33dcd033c3c2b7dc4e2632c240aa0

                                    SHA512

                                    84fff52f5aa2a909b2d4d8fdde36c1e6a9f63b69fcf5c01668d4b83764c07254691f33d78a76bd2a368f4c11efb86ed8bfce64de0860c33c1bcf45fac77a8bbf

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    7788d8092e7c042ca7ece53c1228bf21

                                    SHA1

                                    21e8e67b87077163ad04ed8a1335178e2eee93de

                                    SHA256

                                    62cdd3cd92571adae395e692408df68601603619ad16cd6eeaa5dddcd2b639dd

                                    SHA512

                                    02ce3a56377ab427dd3467e0a77b4dc9f18ce09069b72948009604451241f73fcf4623c893a76bd4dcfdcac48258702e08e816302306f0d278e6809e609408be

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    36a513c84a6a6e681ada30ae56730f54

                                    SHA1

                                    cac9a4f444dd0981452ac9ca768b53965735d06f

                                    SHA256

                                    af5deb3866d3d4f2136b31324c94b41b4fadb9bd09cf9c5b431ed04a6f08ba43

                                    SHA512

                                    66fc34f7dac9399e4291e24ec24e42a78390ffa2bd410d30ef58d807ca5900cba77e04e8df788a8744f556eb69aa900c497cfd0fe5a287c0a0f7fd06f2c32ca6

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                    Filesize

                                    25KB

                                    MD5

                                    0ace84d2f56d99d6b3318537be8d125b

                                    SHA1

                                    7af20fccd1505637d77a87fec53a4fd8a6f4583b

                                    SHA256

                                    db39a394c432581c6cf5b2d164407cb27af4d998bdf437ca43be05714dd95aa6

                                    SHA512

                                    4317898393123fde58a8604cf19d1156c21e67af8fb152c05a41ac10ae6e26dfd88b856c058a64f57d47be023d7530980f7caeb359e7ffd60a59b83fb3ab0a2e

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    538B

                                    MD5

                                    346edaa9cec21be0c6be17eecc795988

                                    SHA1

                                    a7a01d1425ec3f4785e1951035a96b1cfcd06ee2

                                    SHA256

                                    00c752b308daa78dd794738359b0b7fc43fce51948676259f4850dd16ab858f0

                                    SHA512

                                    b14a376126a12730ac3437a2766f408b46a2ced9ecfe294e765188660f748fff83053d96144ee7fee2322b7421e0cfed5f467752a5fccbc0f7c08ab2eec4425a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    705B

                                    MD5

                                    ebf6b02bf34fffedaac4e712d04a4e01

                                    SHA1

                                    f354a702a1662971330daad864f3abf869b7bb3e

                                    SHA256

                                    8ed4c0e2ccdec19baeebd933e71ca2805c7cae6b68f25c760332ae7ad2caceda

                                    SHA512

                                    939ef5510041f4b8f3b47bd988995d1b08f27a45942c7d7f10ae0127656029c38a2c233b4847d47e9896307a885407ad183f8e654a6daadbfb7fdad7a0058b54

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    872B

                                    MD5

                                    87572a742670a55c2ed6310c3b6f62ec

                                    SHA1

                                    81d32da28ae667d0ee753f43a9e15f6b97c584a2

                                    SHA256

                                    8ec5559195a23bfb2972c1ca836485e2f3d49472ceff85e4a0bcc76dc9dd4776

                                    SHA512

                                    a28997a7fef974ba96153a7c71cb62fe47f6b155bbeb26c25219c866873e08a1a74dc4f1512a6c50abd7402103562305ee568c4d7a1847b2f67db8835c2a3780

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    c8ae6f6b7310b8328f2e66b92feef59b

                                    SHA1

                                    3da510b24960960e7f495916a000c54db0e69dbc

                                    SHA256

                                    008901402c225825be349642b8c68a68ae3a3cd53069233b080b15349a80140c

                                    SHA512

                                    6a5b96a031fc04fa8c04e9000f6d2d246d943e01e570f6a729c4c5799aca150763a6b9c7015f638822297ebb3c29957c13c013ba43416d007a58dc326f2f81b1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    dfb3b9c705a04f4170da5ab8853c1636

                                    SHA1

                                    41bc6b6bf10e2d4d91e10cae4549944a409b0669

                                    SHA256

                                    b513b45ca77200e8cd4beb84d2e290392a633c907d292060291d38d9f027cd61

                                    SHA512

                                    6379e52ec1fa9dd40307a1c4dd3ea3553a9945663a4eb52e603944d76c137d0ece7b9eceb0514b69f67b9dd38ff61d2d493f0855c35e32b8e41853a8f19f0c44

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    fd4e9596993c3f24710b318f6a109c79

                                    SHA1

                                    338c820b0015c84e9df6ab6bc681e0a9150758ee

                                    SHA256

                                    9cbb7ed4281dbc5060b972820d803bbdf948d50a4531dc36e502773ab51d5cd4

                                    SHA512

                                    e483cfc0e00bf8d49a229affdd5f2fd721becdbafe495300ac9e7453b18cbee73033aa2484457f8a142ef4fce731e77b77880fdc7e8595bec238fe6b8b4267e5

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    872B

                                    MD5

                                    e7d3dcf49a565f966d0458b34231152e

                                    SHA1

                                    c73c7106fca4c541f298d24ec568261da899a80e

                                    SHA256

                                    b005ed8359eb4f30432791cfafe24aab539a130e5174db7a60ad2c3333711592

                                    SHA512

                                    33ea1de8bcdf11e4e938fe04718cc1db8e28114d692de72e0e545812af66954d787788059ce001a520cbb2a8bc44977c75289219be717ae8633b404f49747db9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59e073.TMP

                                    Filesize

                                    371B

                                    MD5

                                    3c464ef2a1580c176e5468bbea379724

                                    SHA1

                                    67702e70e3ec14079201e046935066d59f8048d4

                                    SHA256

                                    13c83ca6d190ba913df8bf4315e329a4b32d2748c66fb822ed8a3789a0bd1b16

                                    SHA512

                                    d3e4255f343aaf4445f91da358fafba4c95b157c2c93c1cc9c1a5d0695cd36781d3cc9a745315e82c7ad63f588595ec463b86b5bf44a4cee39b1c0c244b07293

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    4018e8e1a2621fe2b986469fc40781f8

                                    SHA1

                                    fc1b23a5f3ad466ba66319c181cf25643db5fc18

                                    SHA256

                                    2d7337a7b61da153c1f193b008ef05c2ebc036cec5ddf8084e2579ecbdaea6d8

                                    SHA512

                                    91b5b1ede43a4b7b8e1215786dfe80ed08718d35866e73283fd47000de921085b937b8d626452a16a9f420de436a2cafa1c1b464a868fa16b3c279ea3e1189fb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    06ee7b87e0d195e22cea17812f60bc38

                                    SHA1

                                    a30f8a91cdbfd45ba51756044e08ff3054bbca73

                                    SHA256

                                    c15cdccde34c08a7f31e3c435469a6d7f0884acd94d368f51b3f7dbe052bdf92

                                    SHA512

                                    3f491f957f4d350029c05105f8d2baa86da5e4e646a2fd5cb587cb800a5a80e48ce10baaa82b530db44cc561b7aa226d93005f05492ac8368d4ecc8c505dc49b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    478ead706bee911bbccab5b70a801c47

                                    SHA1

                                    2b5b1c2b1c40a13d163d269c94c069f09fb075a3

                                    SHA256

                                    3e4856aef2445202e99814b889f59371452a142c70cda4231a0f571d77513855

                                    SHA512

                                    dfe77b25f5697d153d86b6f67417e2c2023f2d224fa9bb5cff783c0a61f75ee34b98966cb6696a33d84232c82dd61653117ebd35b4f38661b2f8eeaf4709e0a0

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    0ceb6ea0d953ecfdb6a66e3787256358

                                    SHA1

                                    ea8400390612a636fc90dca75b09b763b80f0089

                                    SHA256

                                    675ea718e33a9cf83c0ee05935ecc619a1ff1ebea2546fe719e66c6d5161bd66

                                    SHA512

                                    23853a4e2add62754d0be34a73a8f0fb720a76c9d6fecf5ea741eaf88fd2ec46e49cd7ab9f31278267cafd79c9932743f8433b70504e3d2d0dd28de73765e065

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    c7b12b274c6da8f6804002ed861dcd71

                                    SHA1

                                    2e9aa122008bba39893a4190d5806bb347612fc7

                                    SHA256

                                    adbdecc75eb84f1c870c6aa0fd9a16a6b4d099d27fffd53c14cd3938058f07ec

                                    SHA512

                                    3056768170159c88e79d7de880cfe2e8612a93abc70e1fccf34891d8fa6527cfac65754ed90ca23a72bef1c16fc41ee85f912c27fe6fac29c2f9fc8339e216fe

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de29af9a-ba76-4698-9f36-6f57869cf8d2.tmp

                                    Filesize

                                    3KB

                                    MD5

                                    7bd05a3847e36be6829eef8fdab4f930

                                    SHA1

                                    c037dca83e8cb345d11e710a51ea85b23e2824d6

                                    SHA256

                                    1392068199e6a1961fb8458fb47c5dd0ea88bbf97214dc0edcd2e42b1b9e338c

                                    SHA512

                                    f5db2bbc034ed95931bf1ec45b5ccba25e8e0edc37177a63d9ed5b553f87efce4f0be65ac8ef78d1b077b5200d8b4f035e54fba43c0be783c113277c48523342