Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 15:13

General

  • Target

    install.msi

  • Size

    4.5MB

  • MD5

    b63bd820a14d8acfbda0eedd7a884268

  • SHA1

    207cbda7e194c02e076984b3ee8edde9475ae426

  • SHA256

    bc7cacf8352f528b20702cd768f57927f7b4c5b697f61942a8574eee9a7de050

  • SHA512

    c632b2a211f8a3e121c927e83a280db4a871d57764557d4b30e3a343ee018fac91a1d5eb9d53d5b61277fe8930c52850981de6fad104522c3e8afc33932999be

  • SSDEEP

    49152:I9ReWK9YwPhH9D+05jvLHd3P9zmH5HhvRaleHBG5q7vG6f4dCItiGS5oW8XlT45N:KmD+ypP0qlehb+Wai0V4BP

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Windows directory 21 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3244
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1144
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 28AE34A7D22E8C8934B36AE60B2C8254
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:3192
      • C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe
        "C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe"
        2⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3724
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\Required Application\GlobalInstaller.msi"
          3⤵
          • Enumerates connected drives
          • Suspicious use of FindShellTrayWindow
          PID:2860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_A8A.ps1 -paths 'C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs','C:\Users\Admin\AppData\Roaming\GlobalCo' -retry_count 10"
          3⤵
          • Blocklisted process makes network request
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1996
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:3916
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:1232
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4432
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:5396
      • C:\Windows\Installer\MSIF613.tmp
        "C:\Windows\Installer\MSIF613.tmp" https://typagesee.io/ty
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://typagesee.io/ty
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9da146f8,0x7ffa9da14708,0x7ffa9da14718
            4⤵
              PID:3228
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
              4⤵
                PID:3496
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5040
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
                4⤵
                  PID:5072
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                  4⤵
                    PID:3504
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                    4⤵
                      PID:1580
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                      4⤵
                        PID:2100
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                        4⤵
                          PID:1348
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                          4⤵
                            PID:3880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                            4⤵
                              PID:3284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
                              4⤵
                                PID:5352
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5384
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                4⤵
                                  PID:5616
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5168112647060608517,15421689851033195564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                                  4⤵
                                    PID:5608
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Checks SCSI registry key(s)
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2268
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1848
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3216

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Config.Msi\e57d9b9.rbs

                                  Filesize

                                  7KB

                                  MD5

                                  b4fda93f2adbe8638adf37d7195ccc67

                                  SHA1

                                  1ecba732a21ea3cd0c75d17d658d37952bad006d

                                  SHA256

                                  81a1a6891c78fe361f52c910f1165698db1d77e24944aa5ad3fb7d0425a218b2

                                  SHA512

                                  f02476fd9cd4fdfbce29f8697f7a67a9fdbbb8d5915b3b51d5e11d14d6dc19fd83452d83f9a2e6cdfc17d031616f83ab961d8aa25d7cc3f5ea2d1bebf262d4b6

                                • C:\Config.Msi\e57d9bb.rbs

                                  Filesize

                                  398B

                                  MD5

                                  7392336a6ec7cc869ba2703fa1e7265a

                                  SHA1

                                  fb291f2bfee55a8f47e3b7dc23d1b4996fc43543

                                  SHA256

                                  b121f398774f7e3db81716e2c589e65272abb762279c158f8c84a1a3c3a280b8

                                  SHA512

                                  fb73a9e4149f460369a77a76f7364267080cb2e06eacc5389392e63d190b102a4a1676c9e7fa05ce4949a55cb1debe4d2a50a5d286568ae6e061dadf251cf5f6

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                  Filesize

                                  1KB

                                  MD5

                                  a044ece54fe8f9b5fd71dbe1be02ed70

                                  SHA1

                                  60a726a2bbb13296d6258c7949fff5e861ab5ecb

                                  SHA256

                                  e9246604f91ddd4a6a221c8f0b8355ccb1b67e4b8ade2d59034bba005be55967

                                  SHA512

                                  38a760a0dc33873d06164f01a72bc7479d25ca01a43eb89a3fa528427651508709ed323a22443f5959fefc026208cb5f3d4e113943ae071173e64d32aa2065b5

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D2FED7667885036CFA51478CED551D86

                                  Filesize

                                  1KB

                                  MD5

                                  969587855b4a09b09388c8bf58e684c6

                                  SHA1

                                  efccfc06ef01086c5033c864f253906fc0eaec36

                                  SHA256

                                  52ed9025126bbb7401711c5e954ed184c443f592511c9253d1708f92aeb304e5

                                  SHA512

                                  7b6c64898a67a9aeccce9d2ad476581fd727ad22d6459ab401f85d6f4667170b361e9cbcc3ea5afa5ffb35c5a612b8b2edc8edf1b72d2d5eb17d503424ad5121

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

                                  Filesize

                                  1KB

                                  MD5

                                  ded61e000c9c152757aa4903e2b55b33

                                  SHA1

                                  4342c38a110a8e3f1e3c55ec83d732602a6d191c

                                  SHA256

                                  6edf9d14748a23dfeca8fe04d133eb5788951c0b40df307b013e938acf6ffb65

                                  SHA512

                                  a64e11d6238a10598c516dcb5deda0918fabbe496547c6b523113e0ff52b653274e973d0acfd1636329f1f06c20aecb9f421825a73c4715a098f4d79cac88a2f

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                  Filesize

                                  724B

                                  MD5

                                  8202a1cd02e7d69597995cabbe881a12

                                  SHA1

                                  8858d9d934b7aa9330ee73de6c476acf19929ff6

                                  SHA256

                                  58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                  SHA512

                                  97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                  Filesize

                                  410B

                                  MD5

                                  a0c2f4a8ddb452e84d5a0444574734d8

                                  SHA1

                                  b60b5a8dfa7e6c2d41f91c74495009f714e766ae

                                  SHA256

                                  805e39b363026727f1ff0d325605c31d908869d880a97c99fb5e6b1773cd5c83

                                  SHA512

                                  0e4d1826649764ede7b76b8ef93dba7aef9f72c75f79b2ddac3393f790cf45cd7c5572d4ca0ade396453cfe44f29e45ee47f116e32bfa370277f407dfc6260fc

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D2FED7667885036CFA51478CED551D86

                                  Filesize

                                  540B

                                  MD5

                                  427f8f28ff5a15550ac0cbefdb4c33ed

                                  SHA1

                                  38e0e443b0bafc5da8d5f409aaa741542749e12c

                                  SHA256

                                  6199ad4f4e9fc1106cdcab7bed18d098ccc9dbfb4b29099ce9e297968492c549

                                  SHA512

                                  7071a30907b42bc0d51fe107deab5ce6f3cccf2a14884a45d7c3778d057e9202cfa821d29247f4703a0aa4662a5f965f2a4a87d5ae0deff13fd184fc0b67b727

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

                                  Filesize

                                  536B

                                  MD5

                                  e7d7bc12be26011e5e6d87046a7048de

                                  SHA1

                                  585fd248ef185c7f3190abd0755f5b9de63e0f19

                                  SHA256

                                  8483f760a50261484abb95d54d18eab2f0e43fff64173867c3545b4c7492d221

                                  SHA512

                                  e8d28059f93e94b79cce46774c5e58a748f1bdc2eee428f62b1371a992f197b527db0ad6a398a79fd55eefd6d9046ce08346b5471c81747a3f8f73df5dd531b2

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                  Filesize

                                  392B

                                  MD5

                                  2ff89656d16398e45fee18f078196183

                                  SHA1

                                  b74942158530f9c44e0ebe8b89755ca1b974063c

                                  SHA256

                                  713c57abecf2b92e211c95d74aa103cfe39fe19a8ef7890ad71d0ad5dda81797

                                  SHA512

                                  4e0487b72864bf6029be08a03698eac114481bffe43ed2988b091b9c8d84b859b702e77e622d0db9eecec2670e9ec41cd5806cf0aeec6ebe952d24e9327f7d50

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  84381d71cf667d9a138ea03b3283aea5

                                  SHA1

                                  33dfc8a32806beaaafaec25850b217c856ce6c7b

                                  SHA256

                                  32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

                                  SHA512

                                  469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                  Filesize

                                  194KB

                                  MD5

                                  ac84f1282f8542dee07f8a1af421f2a7

                                  SHA1

                                  261885284826281a99ff982428a765be30de9029

                                  SHA256

                                  193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

                                  SHA512

                                  9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  120B

                                  MD5

                                  cfc8fc5970245045d8ed89d930f787db

                                  SHA1

                                  d39f2aa20d57c69d1839c7a204c27b0d122d5d58

                                  SHA256

                                  64b11771b92ccfcdc27372311987be432d1b2eb7c959f3bc8524dc86fd4b5b40

                                  SHA512

                                  09abc5eb4d10f488bfe890d452f401b960d654f68fb410d4c7bd2b1e047de513cec3b6abc3c8fdde9aa5981198eb302bcad0d1f1cf91ff2733422924c64f0060

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  b95e110bf1bb0aa18d1648f01c016668

                                  SHA1

                                  5e6527a4d9eb121a8eaa1403d07246b26a95a156

                                  SHA256

                                  4cd47f13c174eed5b41772555f1c64f5e3f6edf4254e956030864712302f1d35

                                  SHA512

                                  c112b18267c5a76fe7812b218b6b80a4bbde4eb567b8e7025aecb67c876c57e2c08d9ccaf8c6eeecec6ce650f42dea2dcd09a366a1b326013a3c20ff2b998c34

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  111B

                                  MD5

                                  285252a2f6327d41eab203dc2f402c67

                                  SHA1

                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                  SHA256

                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                  SHA512

                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  82b8fcbf2a02b53ea72b94c92b9199e3

                                  SHA1

                                  f46a8020b7e3ff76adff014930c10927a6a96860

                                  SHA256

                                  2b6775e47df0b59138cdf78c98acbb4e66eb43502777938f784bb3413fbc16ae

                                  SHA512

                                  7f793a4b51388df7b14425c50bdcd9bec51c3d63a2478db47cdf4d71fa92832678a22cb09d4e1d20e1ee1ead0f5a4cacd535765a68cd3ce023a436d09db1c128

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  74685cc2164589282aee9eded1282e65

                                  SHA1

                                  6675367b7d76f252cb2a22f382da43673c42e00b

                                  SHA256

                                  b84247f8baa0768e5e11719df7cc17eeee07119c16bad17ed83e6c5f74ae89a3

                                  SHA512

                                  92e330fbe988eaf739d733bb88b8f722976de8b49dffe7d31349c5e960cd98abd06d037e3bdbec849754fc1c6ddbbcb41ef95895106d32222ad972de583892a1

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                  Filesize

                                  24KB

                                  MD5

                                  35f77ec6332f541cd8469e0d77af0959

                                  SHA1

                                  abaec73284cee460025c6fcbe3b4d9b6c00f628c

                                  SHA256

                                  f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

                                  SHA512

                                  e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  4165582242c64dfee2c3ed0d5a665204

                                  SHA1

                                  e9bbb788b622f12bdabd023408370992b2fb7237

                                  SHA256

                                  a920751615c30bc46b22fd5d4dbef0d261dc87a5d0ca9e93db538f9afe9bd384

                                  SHA512

                                  875222cdd4a404bedb434e053e7cf63eaf08326a06bb7beec66f5b51143a516ec9c3873037bf7f9b417aa43807399fc5668ea5cd5b263023c78bf64620e9b079

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                  Filesize

                                  53KB

                                  MD5

                                  6003f7b0a2f53d8a46b5c37a443cac4e

                                  SHA1

                                  3c8f153c7982d71887f84f2b1a647560b14ede24

                                  SHA256

                                  0ad9f8a509084e8e77bd79cc1937a4755d64a813f0e0f51f494aa028fbd63624

                                  SHA512

                                  d3627c40c05271e863046c8923ac2d5445e5f840a99714ac20d03235b8a12b0455b70f6056f0b2f95a6adc3920a2e70a4bd329cb3364242bc112e70a664cece3

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztsahlud.gnl.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\Required Application\GlobalInstaller.msi

                                  Filesize

                                  6.9MB

                                  MD5

                                  eef59e4039662a174e6f265d77266141

                                  SHA1

                                  78a8e14ff5b364401c2be47273f31f9be4450578

                                  SHA256

                                  ede0ccb8d5257b4e6ba62e2282dfaf04f38f36e1f33f53de58581266d70ea516

                                  SHA512

                                  c4a0a7433ab9b8868348795331ba38d28700d07df89178f44f582677d98d55958cb6f53fb774215e43e64473ee973ef14707388dff03451aeac7642f0b2b2e4c

                                • C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe

                                  Filesize

                                  893KB

                                  MD5

                                  abd76ca201d9da05f75ee8efd6102262

                                  SHA1

                                  e8746e7fa1c011c1225877b0efa5f2e80941b6b4

                                  SHA256

                                  c3f6f44167c3888b98c7a9621caa81dc867fb99ccc91f8fc40163214444b86d5

                                  SHA512

                                  733f049a19f0d47b058c3d2b68ae834cb01fc399227712133aa2e01f7928aab09c60f0dcf19463101ad097b7a214b9a66088fc38849edddb77755116328d04f4

                                • C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.ini

                                  Filesize

                                  1KB

                                  MD5

                                  9e55e39b27c28455547d3da477a5c90c

                                  SHA1

                                  63f3c61a8c60e3d2e135402c666031511335072d

                                  SHA256

                                  d3497af972a0467a7ec866fe3d1e0cfd461adc8e46caec7fdd91258e7849b689

                                  SHA512

                                  73e6af779afaa4534a3d9de1056ba0860d9b059fcb0003316986f30816de718720d6b22f85c7587ac56abaffe6cc2fc39e021ac1483af0c59f394ebd3e58397d

                                • C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\file_deleter.ps1

                                  Filesize

                                  22KB

                                  MD5

                                  3e8a3a649d86c2e3950e01d5d29964e1

                                  SHA1

                                  17e06bf8ea31ecd2080b82c0c63a64ec75335e10

                                  SHA256

                                  551030656f5935f68edb8bf484a3bd3615abcc5db9fb380ffc7d130589308986

                                  SHA512

                                  92b0e8c4ddd34d264c8632165532ac67f35d47c21bcebbfd94b2a55c09a8db0bbaa59d8c4ae26f0eddac2ea3d33891dd083dc7da8c967ba63e190c434758501e

                                • C:\Windows\Installer\MSIDA72.tmp

                                  Filesize

                                  738KB

                                  MD5

                                  36cd2870d577ff917ba93c9f50f86374

                                  SHA1

                                  e51baf257f5a3c3cd7b68690e36945fa3284e710

                                  SHA256

                                  8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8

                                  SHA512

                                  426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda

                                • C:\Windows\Installer\MSIDF77.tmp

                                  Filesize

                                  1.1MB

                                  MD5

                                  7e4ef4bc701a5f46a1fee1a9fdc403f1

                                  SHA1

                                  ab00fc0985d7cae8ccfdae1cd4e687192f079d47

                                  SHA256

                                  34fe948e2b005a424f4e8aff9d9ef847d5623b99196fe5f5e9bff4983770d95a

                                  SHA512

                                  7f8013d024142377aad49fc2c5c30376a4b9dd6c732dbbe3d88d2377965ca9e544d7065c7ee5aa1bd9d29b51f19255335c7ac3f85b5079b1cad710dc74bb8748

                                • C:\Windows\Installer\MSIE0A1.tmp

                                  Filesize

                                  870KB

                                  MD5

                                  65b853552e16654c53ab4d16920a9182

                                  SHA1

                                  9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5

                                  SHA256

                                  80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f

                                  SHA512

                                  b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a

                                • C:\Windows\Installer\MSIE323.tmp

                                  Filesize

                                  576KB

                                  MD5

                                  bca598caafb17503d1e1b1c74f97dbd4

                                  SHA1

                                  37ee091b0f0e8df7ee4bdd133495115feed9fbd3

                                  SHA256

                                  45a4441c761b546a0a67b57cbf8e7e1fe3191e50e2a984be04598c56b8a7fef7

                                  SHA512

                                  c8b1db878e15f74d147cfaeab12c812276b8b14b38c360d2a9bd2fc9f50e85b852466ac1ed0115cb6e1cbc7eb499f807396424619d87054085aa1f98f44856b7

                                • C:\Windows\Installer\MSIE323.tmp

                                  Filesize

                                  524KB

                                  MD5

                                  ed5112a3f3a6ea1f0afa961ac0cd15df

                                  SHA1

                                  af0aa49d469402db226b11178958151e6a44a994

                                  SHA256

                                  b86045380871c19b084f651d0a391e66101e4d586b19831318f2dbc4caa9a4ab

                                  SHA512

                                  82291cc4418abdb6d5a4d6ba1e84bbe12ed6144347747ff0731f9a37ccb332755712d5b64e80efebf2e07a9a2372c4aae2138e372e83c63edff941203dff305e

                                • C:\Windows\Installer\MSIF613.tmp

                                  Filesize

                                  406KB

                                  MD5

                                  0dfa51216250ef1cf96878c6a2151404

                                  SHA1

                                  8f4a62c1722ba08deca4e6fed6ef91f9f7a02673

                                  SHA256

                                  387f2ce4a7d2f6cc82c9058c2a579518b9ec622264b8a72e125bde6797918b2e

                                  SHA512

                                  6e0d4f6237d593ec756216b17832eb2a21df7f9dce12d4dde689416934eac900939fc58eb3e1f181ba55e3e5a9de152ddc7bb3418d25097133a801c85141a026

                                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                  Filesize

                                  15.5MB

                                  MD5

                                  ef63d83363d3a6b5e5a08f00f0d208ec

                                  SHA1

                                  cbef7779290d6445dff9bf671330c0d252da5bae

                                  SHA256

                                  c7cbb14945659be1c25a3e76acc346a2dbeac88ad59a0bfb14efa0c57199c128

                                  SHA512

                                  92bd9e18dd8c9bb46c98b03516dc09d0e25548a2aac231982eac9cd47bec577a00500c7041e93686264f1ef150f8185cf84e512a20a77db6b67febbdc49bfe2b

                                • \??\Volume{d253324a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{38d56834-d27c-43e4-9d7c-6d1aad9050ef}_OnDiskSnapshotProp

                                  Filesize

                                  6KB

                                  MD5

                                  dd1ebd8d98b762ad61c99f159250739b

                                  SHA1

                                  dd4d6941a1c7509295276ff669807d8aba77d519

                                  SHA256

                                  675e2013ba013cb932979867b9183443ac279d4145b4df70e01ddfb7126c85f9

                                  SHA512

                                  f1294247b082f9b666d8cdc5cb343ca7453ac46f4dcce46c31c858d1a580cedc0e8843693e199c68fb0c5a61f414c67b9da577b0729deaf08d69a2fc1be63058

                                • memory/1232-311-0x00000000065F0000-0x0000000006686000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/1232-285-0x00000000048D0000-0x00000000048E0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1232-295-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1232-296-0x00000000048D0000-0x00000000048E0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1232-222-0x00000000048D0000-0x00000000048E0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1232-239-0x00000000048D0000-0x00000000048E0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1232-312-0x0000000006570000-0x000000000658A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1232-313-0x00000000065C0000-0x00000000065E2000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1232-316-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1232-223-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1996-194-0x0000000006900000-0x000000000692C000-memory.dmp

                                  Filesize

                                  176KB

                                • memory/1996-152-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1996-150-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1996-238-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1996-327-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1996-149-0x0000000002DD0000-0x0000000002E06000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/1996-151-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1996-153-0x0000000005630000-0x0000000005C58000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/1996-253-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1996-254-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1996-221-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1996-154-0x0000000005600000-0x0000000005622000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1996-155-0x0000000005D00000-0x0000000005D66000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1996-156-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1996-167-0x0000000005EE0000-0x0000000006234000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/1996-175-0x00000000063D0000-0x00000000063EE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1996-176-0x0000000006400000-0x000000000644C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3916-317-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3916-268-0x0000000002B30000-0x0000000002B40000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3916-258-0x0000000002B30000-0x0000000002B40000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3916-197-0x0000000002B30000-0x0000000002B40000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3916-196-0x0000000002B30000-0x0000000002B40000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3916-255-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3916-195-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3916-314-0x0000000006F80000-0x0000000007524000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/4432-242-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4432-241-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4432-240-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4432-323-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5396-326-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5396-257-0x0000000002AF0000-0x0000000002B00000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/5396-256-0x0000000075350000-0x0000000075B00000-memory.dmp

                                  Filesize

                                  7.7MB