Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    311s
  • max time network
    313s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 16:33

General

  • Target

    https://github.com/DecerZz/SynapseUI-For-Krampus/releases/tag/Release

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/DecerZz/SynapseUI-For-Krampus/releases/tag/Release
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7ab246f8,0x7ffb7ab24708,0x7ffb7ab24718
      2⤵
        PID:3956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:4740
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2340
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
          2⤵
            PID:1672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:2500
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:1348
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
                2⤵
                  PID:4876
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4868
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                  2⤵
                    PID:2996
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
                    2⤵
                      PID:3688
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
                      2⤵
                        PID:1776
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                        2⤵
                          PID:732
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
                          2⤵
                            PID:2732
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5952 /prefetch:8
                            2⤵
                              PID:884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                              2⤵
                                PID:3472
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                                2⤵
                                  PID:4652
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5948 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4964
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3080 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3600
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2244
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4164
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:548
                                    • C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\Synapse UI WPF.exe
                                      "C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\Synapse UI WPF.exe"
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2220
                                      • C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe
                                        "C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --field-trial-handle=1316,4143267013382170005,15914244187479491553,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12821543248906906437 --lang=en-US --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --enable-system-flash=1 --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=12821543248906906437 --renderer-client-id=2 --mojo-platform-channel-handle=3572 /prefetch:1 --host-process-id=2220
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2484
                                      • C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe
                                        "C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe" --type=gpu-process --field-trial-handle=1316,4143267013382170005,15914244187479491553,131072 --disable-features=VizDisplayCompositor --no-sandbox --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --lang=en-US --cefsharpexitsub --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --service-request-channel-token=7065606784565154345 --mojo-platform-channel-handle=3632 /prefetch:2 --host-process-id=2220
                                        2⤵
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3360

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      bcaf436ee5fed204f08c14d7517436eb

                                      SHA1

                                      637817252f1e2ab00275cd5b5a285a22980295ff

                                      SHA256

                                      de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

                                      SHA512

                                      7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      7c41f6bce212114af45494b69bc471e9

                                      SHA1

                                      9e210ad615843cf3f6d8691df04558d5b015f65d

                                      SHA256

                                      dbf91cc3d3fc6e34a88406797f7ea31ca6194a4510111e8ce2788c5051458dca

                                      SHA512

                                      508148baa2ec160371601fb2a31c74551706c8c4aa8b35484bfb815d1bcd61ffd811ac6d1f14bcbf5303bc1b983b883252e2fb7765702a048abde384ed7e0164

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      496B

                                      MD5

                                      2ff4b0a28cbb1d79ad892d29eff5a289

                                      SHA1

                                      610ad5f22ba0b14005becaf3fe50512ed011fde4

                                      SHA256

                                      8684f55e8c85397e73ab1714db4ea03eacbd1299de8cd35bef22c687ea791785

                                      SHA512

                                      f91f60d325396329c1b6bc944b317b2a0d67f92c9dab1dd91a114054b1674ede3adb28319acdeb6d254c3a51ab8b016afbc42bf7665015e8f70038ce77434189

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      807419ca9a4734feaf8d8563a003b048

                                      SHA1

                                      a723c7d60a65886ffa068711f1e900ccc85922a6

                                      SHA256

                                      aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                      SHA512

                                      f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      e3f2f3f945059a9e61c61a93e121f72c

                                      SHA1

                                      125a7fd855d47f18e41460377e79a31caaf79639

                                      SHA256

                                      f99cfb0a65092015480364b68339cd25151fd680d3f04af4cc873d2f716631dc

                                      SHA512

                                      5b173ef33b4de18f0728edd1073f1924542c081f606de33cc840fb1b04838cbaeaffc1a43384cee2835094d5bd6521e31858b3d08f49b7d2b12b973bf953a776

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      35b574726884f27bf7a17ee885a9c1e8

                                      SHA1

                                      b5b82908ed35e0dd645c31d3ecc50618174d6c1c

                                      SHA256

                                      a9597006643e743b78b6afbfdd900ec51560013a8a9dd30b5b5c97808907251a

                                      SHA512

                                      786f0af27e716967859e54e706364ddc6268c7a6f480fad3060cc125c751c7333aeb0eb735f61b6efc51bdff540461d0d5faf65acd97c64f183fb459c47978b3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      ef300dfe1d2451169f5510e88771d93d

                                      SHA1

                                      5c7981df6469d22ff05631f53ce667a0b76fc2c1

                                      SHA256

                                      fcf2110111b853b3f98b965cb0f4ea2e7ce50992720d9d3f908e5e4087a34b4e

                                      SHA512

                                      41228b8c72e91472dcdf90fa76ca000fc35b3e3833d6fdb6337714584e3228f5311fc1502ff436bafe4d08da606ff1718fbc03795ba21358c3c68f81f978f98f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      cb07d0e05557e10f100afd9531ee461a

                                      SHA1

                                      76598dc3ebbc5a7f6281cb683dd1cfe3e326019c

                                      SHA256

                                      a705ed6075e6cacc9e999913eba36564eb28632ac1e6ce52713933ab84c29512

                                      SHA512

                                      b27dab75ca19373db0f083f770f55ef9869fa95165c61d8b9f36dfcacd85de3958ad73a57a8b659ca0c85a53adb0193d7f3830937a2b8c6f1c30a80f23f336ed

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      b0ba6f0eee8f998b4d78bc4934f5fd17

                                      SHA1

                                      589653d624de363d3e8869c169441b143c1f39ad

                                      SHA256

                                      4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

                                      SHA512

                                      e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      874B

                                      MD5

                                      5b793021ede1470d05d9370fe0ec4466

                                      SHA1

                                      0de7a5c0953148be0706ddf20d07251595542aa8

                                      SHA256

                                      b6cb7d464a3f5e02ce34c43bbdd7ab4c45924e2216b578366212e38be9d7f7fd

                                      SHA512

                                      bc2204e0cbbe7b6be28612735cdc04da82e1b8a8e562ffc20b3592fd12154aa5cd09380fdf588d3c0ee2a150525efaa0da53b9f82cd7af551f67d672197c388d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      874B

                                      MD5

                                      e72dbe8a2c10f2f8d1dd76a72b098893

                                      SHA1

                                      b033ad27e9300b08ff7207bc594d95ef82052974

                                      SHA256

                                      8f5222598e3b851b161e37f4779f61f3dea43d9385e6613d8ac70449026f216c

                                      SHA512

                                      bb1a6fad826f930d8c371920baa8af0c93548a1f167e92c8ed818035b04d33efe6c24c4bc97f2e91e4def4e0ff4202a0034fec572257360b347fe25ca80210a4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      875B

                                      MD5

                                      673efcc9236b81fb036f87477aaab8c6

                                      SHA1

                                      f60069a69f748e1829c1b85ab98f4c92a6bc6c11

                                      SHA256

                                      4ab4552c545c64cf58b75e3eeb95547b2b0126f763acbb2740260d07a80acb92

                                      SHA512

                                      8537dc76c61bb884329f316f4d09ff63b748dd92b0d06dad6bfa27ab86c620e5a3f205b39b44c2dc9cf31118f40c9464a20058f320be99d80a6316b25c4f1a77

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b20a.TMP

                                      Filesize

                                      707B

                                      MD5

                                      6894fa4ee84050ad2a8a68792df23588

                                      SHA1

                                      6403909401838692a4383517b90684c33fe1776b

                                      SHA256

                                      7f722774bbe76a17119f7ecf9a5fc4f59062ae0bf100a5c3a54859a10e4a701f

                                      SHA512

                                      ee0273b49a4b2abd81cd0afa7c22e70f2540758c3ab2accef495b63cfad794b3381e218e6072445454c5f17798996e8260306435147954ae0681e9c0ff8c31ca

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      12KB

                                      MD5

                                      5de8d2f85e0689d7b812bd32468918a1

                                      SHA1

                                      64dea8a883909205645eea7442fabe42f095ecd4

                                      SHA256

                                      84230d46331de1c069296248ba6431c2347714dbdc1f40fdc37f0cdb54c937b5

                                      SHA512

                                      d3253b506ac62e24da6452a164b8e62cf265af1fd0099509d6a2d62e24ea429b31045ccecc687e1b4aa0773f0a4eb6ec927e16329dda3ca6880040a89098fada

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      38f603ed7fe00e365da4caeb2a818fa7

                                      SHA1

                                      a8aabab5c96b987b51cbe303ca95da1dd55521e0

                                      SHA256

                                      57717c9c29c5a56d069bc32fdc605e9230b084333fd31216a66536c4c904e5b8

                                      SHA512

                                      8bc73eb1eeff6b9987e1f4ce7810f35827276c0cc426280bd1e3e40e44b1b519839181616d5bd29315935e96a1d19fc8fdd7bf4c50bc67d334cb77fc2affe94c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      e3b312a9cca1fb0e63102ec1f258f17a

                                      SHA1

                                      fc24b630c9d5c8bfe6f9fb771ad997b1a73a2b66

                                      SHA256

                                      63ae8e7f8ce384dfe9a2beffd21e1c71d9cfbde8ce0edda5b7427c0b558d2c10

                                      SHA512

                                      2cd72507b027f416bb9e55eec5f36ce298a2a0d9f633712d24e4d83b298019df333e99af2b027cea63f270b347d114d996e3d13aed045ba680cb8a609a067f92

                                    • memory/2220-331-0x0000000009610000-0x0000000009964000-memory.dmp

                                      Filesize

                                      3.3MB

                                    • memory/2220-337-0x000000000A8E0000-0x000000000A918000-memory.dmp

                                      Filesize

                                      224KB

                                    • memory/2220-325-0x00000000054E0000-0x00000000054F0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2220-326-0x0000000006040000-0x0000000006048000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2220-327-0x0000000008810000-0x0000000008848000-memory.dmp

                                      Filesize

                                      224KB

                                    • memory/2220-328-0x00000000087D0000-0x00000000087DE000-memory.dmp

                                      Filesize

                                      56KB

                                    • memory/2220-329-0x0000000009460000-0x000000000950A000-memory.dmp

                                      Filesize

                                      680KB

                                    • memory/2220-330-0x0000000008890000-0x00000000088B2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2220-324-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2220-332-0x00000000099C0000-0x0000000009A10000-memory.dmp

                                      Filesize

                                      320KB

                                    • memory/2220-334-0x000000000A5B0000-0x000000000A6EB000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/2220-335-0x000000000A7D0000-0x000000000A7E6000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/2220-336-0x000000000A860000-0x000000000A8C6000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/2220-352-0x00000000054E0000-0x00000000054F0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2220-338-0x000000000EB70000-0x000000000F188000-memory.dmp

                                      Filesize

                                      6.1MB

                                    • memory/2220-364-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2220-361-0x000000000D4D0000-0x000000000D514000-memory.dmp

                                      Filesize

                                      272KB

                                    • memory/2220-359-0x000000000FDD0000-0x000000000FED0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/2220-358-0x00000000054E0000-0x00000000054F0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2220-323-0x0000000000A30000-0x0000000000A6E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/2220-353-0x00000000054E0000-0x00000000054F0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2220-347-0x000000000F620000-0x000000000F62A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/2220-349-0x00000000054E0000-0x00000000054F0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2220-350-0x000000000FDD0000-0x000000000FED0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/2220-351-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2484-343-0x0000000003210000-0x0000000003220000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2484-354-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2484-356-0x0000000003210000-0x0000000003220000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2484-341-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2484-339-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2484-367-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3360-344-0x00000000056B0000-0x00000000056C0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/3360-355-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3360-357-0x00000000056B0000-0x00000000056C0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/3360-342-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3360-340-0x00000000054F0000-0x00000000055C3000-memory.dmp

                                      Filesize

                                      844KB

                                    • memory/3360-368-0x0000000074620000-0x0000000074DD0000-memory.dmp

                                      Filesize

                                      7.7MB