Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/04/2024, 23:06

240423-23xptscf2t 10

23/04/2024, 22:44

240423-2n46cscf28 7

Analysis

  • max time kernel
    229s
  • max time network
    220s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2024, 22:44

General

  • Target

    http://blackmagicpartners.com

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://blackmagicpartners.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d4d746f8,0x7ff8d4d74708,0x7ff8d4d74718
      2⤵
        PID:644
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:3016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4816
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
          2⤵
            PID:3144
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
            2⤵
              PID:2596
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
              2⤵
                PID:4572
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
                2⤵
                  PID:4104
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
                  2⤵
                    PID:2488
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3200
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
                    2⤵
                      PID:2936
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                      2⤵
                        PID:776
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                        2⤵
                          PID:5384
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                          2⤵
                            PID:5392
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                            2⤵
                              PID:5960
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                              2⤵
                                PID:5204
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                                2⤵
                                  PID:1356
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3184 /prefetch:8
                                  2⤵
                                    PID:3436
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3400
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15607083169556234653,15079665514016279834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5492
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4024
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3388
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:5636
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3820
                                        • C:\Windows\system32\dashost.exe
                                          dashost.exe {c274138c-5703-4090-a91552bf89365dc1}
                                          2⤵
                                            PID:4564
                                        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Document for partners.docx.docx" /o ""
                                          1⤵
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious behavior: AddClipboardFormatListener
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3384
                                        • C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe
                                          "C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Contract.pdf.exe"
                                          1⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: AddClipboardFormatListener
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of FindShellTrayWindow
                                          PID:5612
                                          • C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x
                                            "C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:3040
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 372
                                              3⤵
                                              • Program crash
                                              PID:5832
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 3040
                                          1⤵
                                            PID:4744
                                          • C:\Program Files\VideoLAN\VLC\vlc.exe
                                            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\[Videoeditor] Contract + Preview 11.04\Davinci Resolve 18\Davinci Resolve 18 Trailer.mp4.mp4"
                                            1⤵
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2184
                                          • C:\Windows\system32\AUDIODG.EXE
                                            C:\Windows\system32\AUDIODG.EXE 0x508 0x50c
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3444

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            a9519bc058003dbea34765176083739e

                                            SHA1

                                            ef49b8790219eaddbdacb7fc97d3d05433b8575c

                                            SHA256

                                            e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

                                            SHA512

                                            a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            cb138796dbfb37877fcae3430bb1e2a7

                                            SHA1

                                            82bb82178c07530e42eca6caf3178d66527558bc

                                            SHA256

                                            50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

                                            SHA512

                                            287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3078b44f-8ebd-4dbf-a43e-a5866d01b811.tmp

                                            Filesize

                                            7KB

                                            MD5

                                            2e32b774eec92f210dcceacd341f2334

                                            SHA1

                                            c23072f66eab60a34d75e1531ee828a78ed90004

                                            SHA256

                                            3ab16a0cdabb0e7bcd55846d54d80867a8e970e73f2909c02a09d7c539b243c3

                                            SHA512

                                            50b1e5ba7ba3ba98c1defe78328ecf4df6f8cca99c2bb76be1ea5210330377ae0c22f1693a5034050ea33ca65523d0e0702b57cb61a24022e585286a5e69dc54

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            336B

                                            MD5

                                            1cb5cad7464ed5e6daa85cb8c0803add

                                            SHA1

                                            7d4a0c3686b039c7045842235cdf3df1e35f0f77

                                            SHA256

                                            44e17f16d3a646cd939bdbc53266d6188be871953af315c5a26d5b8ed3fda9c3

                                            SHA512

                                            cf5241b428194e44890a56c4d29a823b8fba1bd0ced38f368d5867c5aea2018242658e10f016040edcb210e0bf1582d584ef92d29a2434850f33cbfc94dfcb8f

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            1KB

                                            MD5

                                            927c6100db835b5c303a3c21873852cb

                                            SHA1

                                            bc2bcaa76c21fd8fad55a61fb76167b957eafc61

                                            SHA256

                                            99fa50fac8167a32a87f5e7ac76c47189dfb226350c6e5ebf3f9526cfd80ff08

                                            SHA512

                                            53cc58ba192427d150af2343f3093a803148fb7a6e91c9140e7f687ff7134bc1f8428a018e4be22838947336701e74ae3da7258651da7cf02c5d44d64709b1df

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            680B

                                            MD5

                                            23c308c16724727a4e02a229c1005d65

                                            SHA1

                                            9b6197e6a01ae26ed4e5928f49c21223077bfd44

                                            SHA256

                                            d88b3f0749babb2383c3da82309b8963a9385a80a15824c2b245d278e5bec563

                                            SHA512

                                            a5e055847292d2f890510dbd28e70734b02402a4c051f5ca3875ce8283c6984e60ebef89b4658860d8e2d2c5b7b9885ca8fc12b3b385db855f947e52f97989ff

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            b022c8d9405c52dadf3842075bc3d25d

                                            SHA1

                                            c567337b2e45351caf843980fc171a869810dc7c

                                            SHA256

                                            c332f5884cbfb72b7f30e285b75d4d7aeb8d32cee94e8a9a9937175412616e39

                                            SHA512

                                            9b3d4992de06fccf0b77d64e24197a3890036ba3e43eaa2d9b8d1954c5a5ba14b7e5b7db2bb881c725ff3936ba84c318c2b8d9a4c536b4f8b8e12da335e1c698

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            b0d178975ea51bdd515626fb1065b367

                                            SHA1

                                            04406989ba36be3629907c15a76fbea26f872932

                                            SHA256

                                            b5633af032e6498e21a987123f8f36818814f2e1d055cf58ac8aec49204e7747

                                            SHA512

                                            419029dd6aa9f76233cf23c253babe031ffc34c5f47d90841487f02edea9ae6b84d629f293dcd5f6241e114bd05c03524b6a0230bc3c40b895c9e0bc93ccf098

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            a88e66cae241d75ab1673700de7cb830

                                            SHA1

                                            442c087a822b0542a62bc139e443493d311ad170

                                            SHA256

                                            5a473b867cca5521434fa99ae7a4ac528553eefa097b206cbf6888a1073cb6bd

                                            SHA512

                                            5150df211c7edf074987197225ee5d5fcf03791dc9335e0f6d6dd5b0b46de5f0a902e729823d1897e35887a2d24e97a59d51e7179b657871b853bfe48d3df9e3

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            8ecf147280f5d25e68f698e39fdbf730

                                            SHA1

                                            871d1d16ac95dad5ca12924d665a58d4ed35799e

                                            SHA256

                                            5a4c86565428f2921c4729718a12cc8df3d21236652d7111df1178806e6ab6ed

                                            SHA512

                                            922fc86f9fc531910b46927ef4a346937ab7ee64da6de87c2e6ebd530377f44822dbf5c87432bf6eb245f798ccf4a30be51fcf9e06bae246d7bdd772ecf3186c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            564b57a0868f3d34e3cfed8ab5c403f2

                                            SHA1

                                            d77c45051b5c51a2b0e3a3f25233893f7c0d92fe

                                            SHA256

                                            804f86fdac5fa29947d61f3866a36c801cd5218f10113781691dbfc8a8e8fd14

                                            SHA512

                                            d891f57bf5766e2dd78f1a0ff5cb791745f9baec03148bf3b4e23b1e7d33b1e954d60e1a3167895814d5893357c1138ce3e5a4c73bf3f3ce7d6d525e4bbbed32

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            43d1a4322b07f9489a5dacaf45e59547

                                            SHA1

                                            62fc0d2fd3664bb09539542bedb4e7cfdc751887

                                            SHA256

                                            22ca96481bc896d54cde783f48b199fadf20a03ab83b6a5fe67e1f54dd0ae685

                                            SHA512

                                            53270b85492ddc9e8a7e7bdc837235db8d1215cceaab44f6403653a751699375392c77131906dc732655328b015f460ce7cf08692b6ef9200975564ad3252e01

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            9ececacbb81d0c94e0afa274aecd9836

                                            SHA1

                                            305c25afbfc80a96413f801a93651037b653e5f7

                                            SHA256

                                            2a36a9311ef5908c67edfa0cba16d0d9ac4366befa3f242af63fccbc23b7e15b

                                            SHA512

                                            5ff5746f7c510f464b79068566aff47d3972dd0c2df8f0fde6f9c3c0daa49ef828b7bbac507025931a022206435bf6b1312408a7a530c720101c73157fbcdd58

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            368B

                                            MD5

                                            30d5457e445d003d0d063a018872e8a7

                                            SHA1

                                            7ce3571ee2dfc2c5df1736a8ec7bf0873c75d5ce

                                            SHA256

                                            ac5dffc3bb777a01ee0ab533fb0613dbe05a2eb9c155b4a252b50252c5bc4bf1

                                            SHA512

                                            b38df3a67a259b12562a6ceca9d03df6f1f229f30940d9a460c0f5d9b795dfcea3d4c12079a6dc335d4488d01ee75f47a14d2b8191e6e626633cb47a597e01b6

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e7fe.TMP

                                            Filesize

                                            368B

                                            MD5

                                            2bb9bba8131b5189a63449c26982931f

                                            SHA1

                                            c3b678b12bfca3810181a0cf90f89cd49c7e682d

                                            SHA256

                                            3210e1c29390a32c985c16faf9a593e71bcc4b2f0036e0b0217f302451ab18a9

                                            SHA512

                                            08c524f1b440609d24efa9f832e40f5563dc83b08486067c63f6f15389e1aa2963f939e048e9f7639febe1b9184af7b1d469f62bc22ffc68e53fa523fa9304e6

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            12KB

                                            MD5

                                            f10783bb8c53bda4ef40976c07b2caf5

                                            SHA1

                                            e62493cc02ec90a8066a4d54128f50c6a3d4ed4a

                                            SHA256

                                            b619d5117d2d744768d885ecd3a763f84802a3480c6eb5e99be22d7b0e0fac1e

                                            SHA512

                                            f63ac681938d476c1077634a3c9674ca212fdbd7d7dc4142030e82467517c6f875b76009abf85caf0b01c8bc7961a481739462726044880a4181d50dd6d13ae4

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            3efb312414d4094a1f32249d9b8904dc

                                            SHA1

                                            929fbf2e14cad3ea1cf5dcb9f4f398d8534887d3

                                            SHA256

                                            daa2fa02a3e2d5c25beb3619b4fc44d7d9bbd6746f81a934c1959fa288ad18fd

                                            SHA512

                                            3036e7f824b12ca6c022e937b7c146326e00273bcf62873ea2284c6b254ca643556444e28d2583c66695ff1e1c0d8b995df959477d3872986d2d3d42f5fe671b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            1a8cb081db77bfcc18d45bf5de85a863

                                            SHA1

                                            50ccc88157d6d5741aeca0b4ef7217b1b138e023

                                            SHA256

                                            f4cf8356a1c034f45566ef3276b9dae9e405d581fddcec71bdcab986ccd31227

                                            SHA512

                                            4c8c0212ec760d520526ad5d085b5b435185ad19ed5d2c918f2bcdf7229e9ae7f306f14b4d4f299975321a51e50097009f41736b699a664a1f76aad5050e0fdf

                                          • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

                                            Filesize

                                            4KB

                                            MD5

                                            eb9a64f46ecc7b4a16e7ed2f04565267

                                            SHA1

                                            d705844fc07dcecf34c68ebe154f7fc1b92fec3a

                                            SHA256

                                            b8873e5a40e5c3397046a12ed96ed627883e3bc5b3c24f66dd6e204f67663f84

                                            SHA512

                                            1f48d419002dbf33ad9838d75227d5940698a2fbec4fefa1785f11b95b81dfd7c2207fbbad1002bd2d35eb48693773b60352c3be53be582b6c7c1a6f4a151107

                                          • C:\Users\Admin\AppData\Local\Temp\TCDEA98.tmp\gb.xsl

                                            Filesize

                                            262KB

                                            MD5

                                            51d32ee5bc7ab811041f799652d26e04

                                            SHA1

                                            412193006aa3ef19e0a57e16acf86b830993024a

                                            SHA256

                                            6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

                                            SHA512

                                            5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

                                          • C:\Users\Admin\AppData\Local\Temp\䕅瘵㍮㜷癸x

                                            Filesize

                                            38KB

                                            MD5

                                            3992f464696b0eeff236aef93b1fdbd5

                                            SHA1

                                            8dddabaea6b342efc4f5b244420a0af055ae691e

                                            SHA256

                                            0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

                                            SHA512

                                            27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

                                            Filesize

                                            261B

                                            MD5

                                            400895b083f950f7fe7b72a4bc624a46

                                            SHA1

                                            bd4fde6d0c75be33f309dab4e965f4d5ab6219a0

                                            SHA256

                                            bf224d33d257cb7e269693b2e0fc85a2c21a9af31c7c6508ed612f6007c55278

                                            SHA512

                                            5e0100ff463604c52d3067936eafeddc6f56711235a11c224230f7e4fa812b8603fc43c61afccee26468575d6761ade17770c9ee287573ee5c2abb6bbe2c988e

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

                                            Filesize

                                            2B

                                            MD5

                                            f3b25701fe362ec84616a93a45ce9998

                                            SHA1

                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                            SHA256

                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                            SHA512

                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                                            Filesize

                                            3KB

                                            MD5

                                            e0aede5f657b1c0a67b9e21d447c5b6f

                                            SHA1

                                            28167df66161f94845e8cb9b45c1e6da33a31149

                                            SHA256

                                            708928e5a0ede4908409791d1d3a1771506afc94d448a699d3aa02daab91da7b

                                            SHA512

                                            ec523e57f1ed906f09429933cd0515de3e87848750b94b952907711be6b1ab9980f123be27000b435859b1b1bda8a8d2a4b40d3d9167307a1a464d132c49076c

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                                            Filesize

                                            4KB

                                            MD5

                                            e515a4c0bfa6a66467e53002343b2ec9

                                            SHA1

                                            793248b33fc34a1a5b334f0c53ca4b3dfc493cef

                                            SHA256

                                            f1a948fee21879b3c1dbb7e6762a69f08075143f091d90b40876859ae56e851d

                                            SHA512

                                            c52b40b532e8dd8bd19d804d6cd38c98e7c440868bd6112577d9f4d4acdb9b260c45123c0a3f5b8d34187b95bb58eff09315edfceb599e0e6bade7be3eaf3ea1

                                          • memory/2184-903-0x00007FF8D46C0000-0x00007FF8D46D8000-memory.dmp

                                            Filesize

                                            96KB

                                          • memory/2184-941-0x00007FF8BFC10000-0x00007FF8BFC52000-memory.dmp

                                            Filesize

                                            264KB

                                          • memory/2184-937-0x00007FF8C1310000-0x00007FF8C133F000-memory.dmp

                                            Filesize

                                            188KB

                                          • memory/2184-933-0x00007FF8BFC60000-0x00007FF8BFDCB000-memory.dmp

                                            Filesize

                                            1.4MB

                                          • memory/2184-935-0x00007FF8BF1D0000-0x00007FF8BF411000-memory.dmp

                                            Filesize

                                            2.3MB

                                          • memory/2184-934-0x00007FF8C1340000-0x00007FF8C1397000-memory.dmp

                                            Filesize

                                            348KB

                                          • memory/2184-932-0x00007FF8C2640000-0x00007FF8C268D000-memory.dmp

                                            Filesize

                                            308KB

                                          • memory/2184-931-0x00007FF8C2690000-0x00007FF8C26D2000-memory.dmp

                                            Filesize

                                            264KB

                                          • memory/2184-929-0x00007FF8BFDD0000-0x00007FF8BFFD6000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/2184-928-0x00007FF8B7600000-0x00007FF8B8E6F000-memory.dmp

                                            Filesize

                                            24.4MB

                                          • memory/2184-901-0x00007FF8C3D10000-0x00007FF8C3D44000-memory.dmp

                                            Filesize

                                            208KB

                                          • memory/2184-900-0x00007FF7E5E80000-0x00007FF7E5F78000-memory.dmp

                                            Filesize

                                            992KB

                                          • memory/2184-939-0x00007FF8C0260000-0x00007FF8C0276000-memory.dmp

                                            Filesize

                                            88KB

                                          • memory/2184-942-0x00007FF8BF090000-0x00007FF8BF0F2000-memory.dmp

                                            Filesize

                                            392KB

                                          • memory/2184-940-0x00007FF8BF100000-0x00007FF8BF1C5000-memory.dmp

                                            Filesize

                                            788KB

                                          • memory/2184-921-0x00007FF8C2BC0000-0x00007FF8C2BF0000-memory.dmp

                                            Filesize

                                            192KB

                                          • memory/2184-936-0x00007FF8D8240000-0x00007FF8D8250000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2184-943-0x00007FF8BF020000-0x00007FF8BF08D000-memory.dmp

                                            Filesize

                                            436KB

                                          • memory/2184-930-0x00007FF8C26E0000-0x00007FF8C26F2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2184-945-0x00007FF8BFBF0000-0x00007FF8BFC04000-memory.dmp

                                            Filesize

                                            80KB

                                          • memory/2184-904-0x00007FF8D43E0000-0x00007FF8D43F7000-memory.dmp

                                            Filesize

                                            92KB

                                          • memory/2184-905-0x00007FF8CB370000-0x00007FF8CB381000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-938-0x00007FF8C12F0000-0x00007FF8C1301000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-912-0x00007FF8C31E0000-0x00007FF8C3221000-memory.dmp

                                            Filesize

                                            260KB

                                          • memory/2184-927-0x00007FF8C2700000-0x00007FF8C2717000-memory.dmp

                                            Filesize

                                            92KB

                                          • memory/2184-923-0x00007FF8C2780000-0x00007FF8C27FC000-memory.dmp

                                            Filesize

                                            496KB

                                          • memory/2184-944-0x00007FF8C0240000-0x00007FF8C0253000-memory.dmp

                                            Filesize

                                            76KB

                                          • memory/2184-913-0x00007FF8C31B0000-0x00007FF8C31D1000-memory.dmp

                                            Filesize

                                            132KB

                                          • memory/2184-911-0x00007FF8BBC90000-0x00007FF8BCD40000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/2184-902-0x00007FF8C2C70000-0x00007FF8C2F26000-memory.dmp

                                            Filesize

                                            2.7MB

                                          • memory/2184-910-0x00007FF8C0280000-0x00007FF8C048B000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/2184-909-0x00007FF8C3230000-0x00007FF8C3241000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-908-0x00007FF8C3250000-0x00007FF8C326D000-memory.dmp

                                            Filesize

                                            116KB

                                          • memory/2184-907-0x00007FF8C3270000-0x00007FF8C3281000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-906-0x00007FF8C3AF0000-0x00007FF8C3B07000-memory.dmp

                                            Filesize

                                            92KB

                                          • memory/2184-916-0x00007FF8C3060000-0x00007FF8C3071000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-925-0x00007FF8C2720000-0x00007FF8C2777000-memory.dmp

                                            Filesize

                                            348KB

                                          • memory/2184-926-0x0000025BE8730000-0x0000025BE88B0000-memory.dmp

                                            Filesize

                                            1.5MB

                                          • memory/2184-922-0x00007FF8C2B50000-0x00007FF8C2BB7000-memory.dmp

                                            Filesize

                                            412KB

                                          • memory/2184-924-0x00007FF8C2B30000-0x00007FF8C2B41000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-920-0x00007FF8C2BF0000-0x00007FF8C2C08000-memory.dmp

                                            Filesize

                                            96KB

                                          • memory/2184-919-0x00007FF8C2C10000-0x00007FF8C2C21000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-918-0x00007FF8C2C30000-0x00007FF8C2C4B000-memory.dmp

                                            Filesize

                                            108KB

                                          • memory/2184-917-0x00007FF8C2C50000-0x00007FF8C2C61000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-915-0x00007FF8C3080000-0x00007FF8C3091000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/2184-914-0x00007FF8C3190000-0x00007FF8C31A8000-memory.dmp

                                            Filesize

                                            96KB

                                          • memory/3040-881-0x0000000000400000-0x000000000044E000-memory.dmp

                                            Filesize

                                            312KB

                                          • memory/3040-883-0x0000000000400000-0x000000000044E000-memory.dmp

                                            Filesize

                                            312KB

                                          • memory/3040-877-0x0000000000400000-0x000000000044E000-memory.dmp

                                            Filesize

                                            312KB

                                          • memory/3200-61-0x00007FF8E3040000-0x00007FF8E30EC000-memory.dmp

                                            Filesize

                                            688KB

                                          • memory/3384-311-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-309-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-869-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-868-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-847-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-317-0x00007FF8A1150000-0x00007FF8A1160000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-316-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-315-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-312-0x00007FF8A1150000-0x00007FF8A1160000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-314-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-313-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-871-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-310-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-870-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-308-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-307-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-306-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-305-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-304-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-303-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-302-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-300-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-301-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-297-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-299-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3384-298-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-296-0x00007FF8A31B0000-0x00007FF8A31C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3384-872-0x00007FF8E3130000-0x00007FF8E3325000-memory.dmp

                                            Filesize

                                            2.0MB