Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2024, 08:13

240312-j4mxxaec84 3

12/03/2024, 08:10

240312-j2q7jscd2y 6

12/03/2024, 08:09

240312-j2cn6acc9y 1

Analysis

  • max time kernel
    144s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/03/2024, 08:10

General

  • Target

    Bandit_R6S.png

  • Size

    194KB

  • MD5

    3e8f2ad9cfabe7114ba0653233590690

  • SHA1

    ef502bd77f17b24bdfb86b6a692a07e7783ac431

  • SHA256

    d9313d8b5df341b4c1178fba770a7fd56819aeca7d56ee01f86d7861635f108f

  • SHA512

    c863b3bd80bbe93227e34963eef484708308b3ca205ff32ca83140cb0e0f311bdf7bb64b5dcae3e29d6e73ad1c535fc20fdb3ed4281c9bd35c60fdc443833fd4

  • SSDEEP

    3072:VDDYNAMbdd9NH0rbfMI9qdvszHpLQ1/7L2HUKiNv2h520oHRSeGkoaKIV7alpM53:iNpX9NHK0I7zQ/NNvS52UeDFO+IjI

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Bandit_R6S.png
    1⤵
      PID:3700
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.0.335868923\559834913" -parentBuildID 20221007134813 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b8ef28-565a-4128-bb0b-99ef8e55ba13} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1888 181c09f9258 gpu
          3⤵
            PID:4332
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.1.366886228\1688917591" -parentBuildID 20221007134813 -prefsHandle 2252 -prefMapHandle 2248 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b615bde6-5a00-42eb-9ab4-c09c7a757832} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2264 181c0906e58 socket
            3⤵
              PID:1500
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.2.1351270541\2059634714" -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 2880 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa749015-00e1-4b93-99de-15a16400d092} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2856 181c4deb558 tab
              3⤵
                PID:2116
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.3.1844224721\1722354677" -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77669b5-9151-4f01-922c-750c1452d32a} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3348 181c5898058 tab
                3⤵
                  PID:5048
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.4.575876738\1289377583" -childID 3 -isForBrowser -prefsHandle 3484 -prefMapHandle 3488 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e638b5c-cfe6-4126-8d41-c9060d493ff5} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3472 181c5898658 tab
                  3⤵
                    PID:2716
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.5.712099932\764151526" -childID 4 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3be2381-e0bc-442e-b7a4-b79ddffa7f9f} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3684 181c5896b58 tab
                    3⤵
                      PID:5112
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.6.7678912\2086120793" -childID 5 -isForBrowser -prefsHandle 4160 -prefMapHandle 4156 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8822386-d392-4bcf-80f5-92a62bb9b0e2} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4172 181b4962b58 tab
                      3⤵
                        PID:5104
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.7.265969256\1622464648" -childID 6 -isForBrowser -prefsHandle 5252 -prefMapHandle 5340 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d0eba6-7970-4045-8c98-ac6f81a45b67} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4544 181c7be6058 tab
                        3⤵
                          PID:2164
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.8.413706878\177988766" -childID 7 -isForBrowser -prefsHandle 5376 -prefMapHandle 5484 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78cb336f-f30d-4be7-ac82-cf1a7899a4a1} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2860 181c2203858 tab
                          3⤵
                            PID:2584
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.9.897162130\1468023906" -childID 8 -isForBrowser -prefsHandle 3620 -prefMapHandle 3632 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ea05d22-6eb4-4a2f-8088-38786a0117ed} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3596 181c7be6358 tab
                            3⤵
                              PID:1116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                          1⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2368
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff881153cb8,0x7ff881153cc8,0x7ff881153cd8
                            2⤵
                              PID:3832
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
                              2⤵
                                PID:2436
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2232
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
                                2⤵
                                  PID:3024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                                  2⤵
                                    PID:2824
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                    2⤵
                                      PID:4076
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                                      2⤵
                                        PID:5132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
                                        2⤵
                                          PID:5140
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5352
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5716
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                                          2⤵
                                            PID:5772
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
                                            2⤵
                                              PID:5780
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                                              2⤵
                                                PID:5964
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                                                2⤵
                                                  PID:6052
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                                                  2⤵
                                                    PID:6060
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                                    2⤵
                                                      PID:5484
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4944 /prefetch:8
                                                      2⤵
                                                        PID:5268
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
                                                        2⤵
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5256
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
                                                        2⤵
                                                          PID:6000
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                                          2⤵
                                                            PID:6016
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
                                                            2⤵
                                                              PID:5884
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:3672
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:3868

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                601fbcb77ed9464402ad83ed36803fd1

                                                                SHA1

                                                                9a34f45553356ec48b03c4d2b2aa089b44c6532d

                                                                SHA256

                                                                09d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15

                                                                SHA512

                                                                c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                a91469041c09ba8e6c92487f02ca8040

                                                                SHA1

                                                                7207eded6577ec8dc3962cd5c3b093d194317ea1

                                                                SHA256

                                                                0fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f

                                                                SHA512

                                                                b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                68713c370971ec3d8629ab2b90382cf9

                                                                SHA1

                                                                a622cd34e486a3dd6f8db835a078d68b71f97184

                                                                SHA256

                                                                291808bf2a18fad69af307421c692d3a77d4b2ef5f9ad28edf54b77e67347be8

                                                                SHA512

                                                                b36dcc35dad8120c29e13d31a091c90ff77d2f1ad1e2bfc9d14fc2eed7cb3e295694bda6f5c7392696101c7c4bef78c99319b10e4510859040908b159f2224c0

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                29a096744c201583f2c832fe159e9dd9

                                                                SHA1

                                                                b3e7d3147137642b5ae4e97a78f6799d63d9f64c

                                                                SHA256

                                                                886f44ecdb82c5835b891e4ddc09feaa891e9bd9957c9dcb53da547810318548

                                                                SHA512

                                                                28358fe926d709314d58a185afa3dd3eafd52084cafca7874f51e1079c9054b2cc15a1bc9552913034dc0ee063f84cfe8c07a6e46b8dd5816a54801927df31cb

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                6752a1d65b201c13b62ea44016eb221f

                                                                SHA1

                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                SHA256

                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                SHA512

                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                11KB

                                                                MD5

                                                                4ef08fce86f0b470d97f3c87624f7396

                                                                SHA1

                                                                9dbdd39731d2554fbc245bdda78fb741bab0df55

                                                                SHA256

                                                                949460fa4425fa3f00433bb6f5588cbefd17849cf97e180f5db14c43160062fc

                                                                SHA512

                                                                7c872126118dbf6995de063861a79e7d5d5a15c2e35028638819fc5e398eee483f29025c59bdaaf281eeda5ea5e9b2fb33a5ab1d46a2d39a4de051ee1853496c

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\doomed\28305

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                3f1fc0b11b9f879f2b187eb525ba12ed

                                                                SHA1

                                                                5b94f609b6a58cdc8aa049dfe739868e2ce36c87

                                                                SHA256

                                                                5aec29baa7af2100ea8bb12298b98592e1a42fcd42560f44b3219191f129f517

                                                                SHA512

                                                                6c92f4c45a7e676b68b3c68419e932cb87496bd31c03f73d4a9d34dd9fe768804099194e426699d34a40b4bf637c57c8cd974d5fe912c06bac94ee6614e6e805

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\45514F58EE166DE19E4DE720A21DDF1DA12F6C6C

                                                                Filesize

                                                                203KB

                                                                MD5

                                                                5efed4b837d68d06a320c95314ad65b5

                                                                SHA1

                                                                f71a96dca2c77ec91a44c9c531fdb187184466a5

                                                                SHA256

                                                                703bba1257e1e71f743d29f7be23eebd9c76057646f904e0a5ba3404d0343085

                                                                SHA512

                                                                0586cef9d659850fdbd70299fad67e89ce997c237bf52916bb37888644756a66dc1d83b99ff85e4505f7e34f9723a201dabc03e94e344e342c626c6d8a8007d7

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\4E0C28FF25B34AA6D81276C14EFAA147A7403E02

                                                                Filesize

                                                                22KB

                                                                MD5

                                                                507d4b83a7e907897b38da8f2a213a00

                                                                SHA1

                                                                232535a48bae919285a3a174f7cee87bca7027e5

                                                                SHA256

                                                                982a7786474226c5e6a0d3c6340e87e50722d62aa8044ec0897eeeef66d8f445

                                                                SHA512

                                                                959670b618aaeb54e357b1329af46cc557722e9828ebb9c5b9131bd41dbd0556e058367dbcd8f0866ddb12bf23b9d2b5295a5187158a5da9a653ae2513c6a744

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                3045e08e3bf83092ee6657379a6ece02

                                                                SHA1

                                                                f5d7f34b2371d866ca40f3b10f227b6f294f7dfe

                                                                SHA256

                                                                c9f6a075654cc37448181453e2f470e45f71b3b6f84069019505f1ba7d41bc5c

                                                                SHA512

                                                                e0927c3e8dfff2e1834ab9d46e2f800e4add73bc25beca2aaa388e2f53bdcf3c16d5806310523fb229e6408ec3af4a83d1c4ba9dafcffbe78fb968f572fbef64

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\4f0a35aa-ee7a-4b0b-b05c-df82f4209a12

                                                                Filesize

                                                                771B

                                                                MD5

                                                                96c8c8f5327d1ccd5a401fd2cb0931ed

                                                                SHA1

                                                                02c1e8e711e01b385cb39bb6da72b22944899697

                                                                SHA256

                                                                7638a84517fea9d03279c6b618f32c4d599f782c7861e348b815ddeea2ff6eb9

                                                                SHA512

                                                                16464b3ae300432383e38518a2447f4b9d5aab8a6f65063c5959903ce0079f41cc4aab138d383d6d4804311c898a8c3ee98151281f43594e77ae9d7dac55db91

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\57e2a5e9-1334-41c2-8c5c-c0a844142d41

                                                                Filesize

                                                                855B

                                                                MD5

                                                                852378be8e2ba84e719ce42df46aa739

                                                                SHA1

                                                                9c3f81a6139cb73118e09a3464be24498bec347b

                                                                SHA256

                                                                47c5b21078dba54113340c1c8e5b5492bb847a2f1fa37e612bc301a97a0ef50a

                                                                SHA512

                                                                254c64919c95ee1c98787155d19126afe47dcbbdcc6f4b5c983fc773e48c42955233c0308e09eeb4100ddd8d91a8a4741e662fa4ba92d48ece2438b719d2aea0

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\9ad59c75-c1a8-4d32-b277-a127d52327ab

                                                                Filesize

                                                                746B

                                                                MD5

                                                                a426a87583b5cb570ad48ace4fb74ac1

                                                                SHA1

                                                                f0f363098920343001dada17eb7b444ca8dce030

                                                                SHA256

                                                                35e103f23ee72fa4efdb48262f8dfa35246e69705ccb71fc10f7484c9082999a

                                                                SHA512

                                                                6dcd80f34ca4da64a176ea1f3a98c6ed7af2f2be8796ada73299c668fceaa96129ccc562160dc4fec4df9aee01ed31c95e51f3ec1b6881220a35ec338e8eea71

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\ec54ef25-a88b-4e97-baa7-9b0a753c3432

                                                                Filesize

                                                                11KB

                                                                MD5

                                                                a23502701be1f82b4376787fc860ce1c

                                                                SHA1

                                                                d3c6300b699c09821fdec4ddff38de86986f250b

                                                                SHA256

                                                                853334ea744dcf7cbe48a5a35ef9f7201f0fc85b85092079b61a3c2d4bb90ca2

                                                                SHA512

                                                                7bb35abe8af28048537755311dcdf02974b995fa6e8598b279bdff38f72e87fd5a20ce50d1e21d093e066e7fbf9904e22cc26aa5aea7b7aa19d93868b00b9e0a

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                5ccc81cb4ba490d5c158ff57fc751706

                                                                SHA1

                                                                9fc80a88b16b60adc29e15cfb7704308aa14ae21

                                                                SHA256

                                                                1a54e1854960632e085463be75b4c2755ccf7c3a69ddbd0d5b9572d2fc0e6afa

                                                                SHA512

                                                                a783f62d4a1c314f9472870c0eb8628da538cc630e101b77038b0b1dec9cb406bf4fc88ddaffe11dad0e373f4a18ba196f88ccdc4a56006c699a3bc3c5707bfc

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                e97758634a0ec9d0f793bfec09bad955

                                                                SHA1

                                                                194014aa5ffe15741fdbee10f373d4b5e7a46afe

                                                                SHA256

                                                                af75db789be743c6b6382acad6793e786b3aed235dec0f5aa83a1d11382a8336

                                                                SHA512

                                                                f11508d55308e05214fd2e1ae4bb6b8955b9ac88833f14436ed26a83cc8db1a8728e1edd6c10bfefeada96bac49b4c83549df4947071184ceebbb9f610d5d465

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                3d2b175e639630082103f5cf2d3a2109

                                                                SHA1

                                                                bc8ead390870fa35c3e159f79e23fb73f5c36688

                                                                SHA256

                                                                250b8a534533218907e1fb4ab7976df5afd4741f29eaa7d2c5507a9032f17afd

                                                                SHA512

                                                                73819c6cf324b402f8659fcd7341d4ffe3866715494740565d262755fdb93746a70559d9f3952663587a9330b42f2260b4e3af0ec656fd7a5cd0c0eb332b4223

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                c0cdab8463887ad2e8c8a8706ff6c673

                                                                SHA1

                                                                aeec09b3b1f9eb1665a5a96bbcd944eb55513063

                                                                SHA256

                                                                7b067f883591baaa5f538a3abe2b10814c5bf5b4e0520d8476071bdbe9da0dff

                                                                SHA512

                                                                960767004f974c8100d001450137fa823ee556aa28f3fee48ed76157700551b30376cd6b2afbdd7fdde7edb09d610e4f7ed4087b43097ef7decd1cb2430d02c0

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                3b0c6334c45c48a257b10f75c6069c9c

                                                                SHA1

                                                                bacc2babf5dac47a7cd617ef75177ecfeb598920

                                                                SHA256

                                                                57a268a362a73501a8fd0207d6f97161096dbdfc0118dab6ab131c06ce8501f8

                                                                SHA512

                                                                84a6386daf86ea26a701eb6d53f71e0a5dea6db8bd13405a9ee949b37c7bdb8fa34f908cb9d96ac3a4024d6354c55c117559dc502ccb8272d10fd7f0cc25092e

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                ae3288090278e75b5c0d6296c0b9fd8f

                                                                SHA1

                                                                dc71072ed7815bec15d63b9c351b7034abfc10ae

                                                                SHA256

                                                                416b926a287552698d002c45b31668186e151c4dd322aafc6507e5978e01f391

                                                                SHA512

                                                                15646046230b0d07d0654a06d5841d3428c43ed291238ee44b2908043398ef869873cb9b10c3abade8f470d29cd8f06494f5c06acd837f92461573e79b301a69

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                5843c2e36a60d2d8d09185f88d57ae90

                                                                SHA1

                                                                2200c15fcba2a65c9667f66795894d4f5fd10d07

                                                                SHA256

                                                                59ff652949766eedc6d6af53eb294246bc2cbae407978039ab63fa702c2620e5

                                                                SHA512

                                                                c7758ea40e932d254ce23aaaaa4448a18c09ed20db83e604a20b5b6ca0b524c3e1772bf89a4b031314e135d8ad40b81068e6fca0e93e8cc3a2520e8dc7499254