Analysis

  • max time kernel
    1199s
  • max time network
    1176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:54

General

  • Target

    http://Google.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Google.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
      2⤵
        PID:2328
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:4784
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1036
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
          2⤵
            PID:5096
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:4792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              2⤵
                PID:4048
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                2⤵
                  PID:464
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                  2⤵
                    PID:1068
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4932
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                    2⤵
                      PID:528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                      2⤵
                        PID:3672
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5640 /prefetch:8
                        2⤵
                          PID:5112
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5632 /prefetch:8
                          2⤵
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3300
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                          2⤵
                            PID:3496
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                            2⤵
                              PID:4052
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
                              2⤵
                                PID:628
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
                                2⤵
                                  PID:5048
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
                                  2⤵
                                    PID:3672
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                                    2⤵
                                      PID:4404
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                      2⤵
                                        PID:4024
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
                                        2⤵
                                          PID:2772
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13212835092103163552,12507953515107089721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4696
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:1040
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:3280
                                          • C:\Windows\system32\AUDIODG.EXE
                                            C:\Windows\system32\AUDIODG.EXE 0x4b8 0x308
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4548

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            1ac52e2503cc26baee4322f02f5b8d9c

                                            SHA1

                                            38e0cee911f5f2a24888a64780ffdf6fa72207c8

                                            SHA256

                                            f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

                                            SHA512

                                            7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            b2a1398f937474c51a48b347387ee36a

                                            SHA1

                                            922a8567f09e68a04233e84e5919043034635949

                                            SHA256

                                            2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

                                            SHA512

                                            4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c6d6e58-0fea-4a4d-8f16-3fdf384b7a8e.tmp

                                            Filesize

                                            6KB

                                            MD5

                                            5b9b2c823af4f40bf7115a4af769ce4e

                                            SHA1

                                            59697573e0b2705121a6fece4ec8e79ee461581f

                                            SHA256

                                            41e152f633ebc5624e38efde65fa88e246322d90040529e6e91076c57e911b7f

                                            SHA512

                                            08fe8205c3d8ad6256ded27703c166347eac61d67b8382ce14df4df9681960345579ddca262ace1402bb1d9d9e16c7c7cf27c824891bbdf865011c9afcb8b666

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                            Filesize

                                            36KB

                                            MD5

                                            b16554fe707a36d7dd6447f75cda5ace

                                            SHA1

                                            cf93cbeb955eb264e84d8bd32eac7f285b12b8c4

                                            SHA256

                                            24c734b4a18f83e06e35e4eb9740620a99786a8a9b45274f29928bab398c1be6

                                            SHA512

                                            54d12c8ff2df2d0b2ac66ed6c12694b21a997159afc96e260815020c1eac8c299a9360321361a3a24de60a723dbc0de07cc3cadc659cfafa0143aba8fe8a4b0f

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                            Filesize

                                            62KB

                                            MD5

                                            c3c0eb5e044497577bec91b5970f6d30

                                            SHA1

                                            d833f81cf21f68d43ba64a6c28892945adc317a6

                                            SHA256

                                            eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                            SHA512

                                            83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                            Filesize

                                            69KB

                                            MD5

                                            aac57f6f587f163486628b8860aa3637

                                            SHA1

                                            b1b51e14672caae2361f0e2c54b72d1107cfce54

                                            SHA256

                                            0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486

                                            SHA512

                                            0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                            Filesize

                                            40KB

                                            MD5

                                            9dc9673c5af1dcf765ad951ecba52c69

                                            SHA1

                                            9d5c1202e46a7d699bf85559b0a827bfc3a57751

                                            SHA256

                                            bd993164fb521b40693bef84eab25d964ddf89b16788458e661e453eb418da46

                                            SHA512

                                            bf515983dc980667844bb4a30b05400ef01df2047496335ca2770466bfe8a2170a4dd822fc56bb109b6235ace7e4ff52a75957d2d9a752c3bdd8b71265b698e0

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                            Filesize

                                            65KB

                                            MD5

                                            56d57bc655526551f217536f19195495

                                            SHA1

                                            28b430886d1220855a805d78dc5d6414aeee6995

                                            SHA256

                                            f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                            SHA512

                                            7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                            Filesize

                                            19KB

                                            MD5

                                            2e86a72f4e82614cd4842950d2e0a716

                                            SHA1

                                            d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                            SHA256

                                            c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                            SHA512

                                            7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                            Filesize

                                            88KB

                                            MD5

                                            b38fbbd0b5c8e8b4452b33d6f85df7dc

                                            SHA1

                                            386ba241790252df01a6a028b3238de2f995a559

                                            SHA256

                                            b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                            SHA512

                                            546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                            Filesize

                                            1.2MB

                                            MD5

                                            991cdad1cf921ac5ce995a0ec9b6e312

                                            SHA1

                                            a3fef88dbfd32034daab4811e8446791d2481c6c

                                            SHA256

                                            a2590c2b03e01f0ef1181caa7c78800ede4255186ae37c1a28194698f8f19324

                                            SHA512

                                            807937d9f9bbf1fad83784ee802d40195edf45dcff47d11ceebdc83bd3151f773f1e36a8e8ffcaceaea707dbdf948ec0f4577f325739ad9d4f63fc6596a341ee

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                            Filesize

                                            33KB

                                            MD5

                                            3cd0f2f60ab620c7be0c2c3dbf2cda97

                                            SHA1

                                            47fad82bfa9a32d578c0c84aed2840c55bd27bfb

                                            SHA256

                                            29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

                                            SHA512

                                            ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                            Filesize

                                            75KB

                                            MD5

                                            cf989be758e8dab43e0a5bc0798c71e0

                                            SHA1

                                            97537516ffd3621ffdd0219ede2a0771a9d1e01d

                                            SHA256

                                            beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

                                            SHA512

                                            f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006f

                                            Filesize

                                            3.4MB

                                            MD5

                                            53a8d310277587d456f7b67ef1dfb27a

                                            SHA1

                                            959dea106857239d532ffa6a449337f9581ab44c

                                            SHA256

                                            bd0395da847f61a703e96ff9d3db35b052ad1695b22fbf7e3487097d84f70d35

                                            SHA512

                                            765e1bbe66e42120c117afc7890e21051e6fe1859e0e286bb0e1a413c06714b4aaa43aee8d2d5b6a5f9132c853f938e5512da222e98c6bf4d71977a68cdd8879

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008d

                                            Filesize

                                            6.1MB

                                            MD5

                                            e9f5175727261b8763cd51d53378c76f

                                            SHA1

                                            f841f699c1cc4db9df76a14dafcd015c84b509c0

                                            SHA256

                                            6574e0c50113e4245c77ea985dae386edc68868a7fe4d6c2d914410617e82e56

                                            SHA512

                                            ee3a0b9fa2723c030f67a4968f177af225c84b4773f71df718cb5c616af7403567417d62c5aac7632de87beaefb2e894f03f1b723806a3fe1987874a1fb803da

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            2KB

                                            MD5

                                            1076e9a5c3274741da9faadef9694c1d

                                            SHA1

                                            14f8d4c2d38d1d9e9627343b0bd01e2c1bf0b3ab

                                            SHA256

                                            302f9a177144d8a3cf3fbed07607882eaf8b80abda5d83f0d8fb69b3381fd09d

                                            SHA512

                                            505737f57707780b50e7a7a3f5576ec2f8a51fc88643b4a144cb5d9f24d837d95fdc63340a5961675859aa54331b74ab38fc3cf115178fa5e1277325efee1d1b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

                                            Filesize

                                            96B

                                            MD5

                                            1fcf9800720f80652934003dbf3c8806

                                            SHA1

                                            463ab35f5753aafbef2049c6de43fe2dfdd7b63b

                                            SHA256

                                            f1f467956834c588af76c6e42bc804527e3c3bcc9bd3ea4b3999691eb5b8d6c0

                                            SHA512

                                            a0fcf9aade31230703bd3edf1199456737a796b16cb00d44f8d3820fc1c3568490d641c1ccf68db8ed8595ec880edc17f21a94981c5337d9d7c7fd0f177a8bb7

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_html-classic.itch.zone_0.indexeddb.blob\1\00\8

                                            Filesize

                                            116KB

                                            MD5

                                            3819aa96bf3a0ecbd8453ae4008e56be

                                            SHA1

                                            4be74fa0bbaf8c53898fd84ccbac2a66c89f1eb5

                                            SHA256

                                            ea834f581b1b69023e56f238bf3916ef29a28107df23044ce312591a557898f7

                                            SHA512

                                            c6e53f77cc6e4f7b518f4afb9664c0dc6ab2e9115a2d1e2320a3367da1ae9b73c5ea8f70bd1699bec6e36db6a961d889f79e113f92603d2241aad82325fdc187

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_html-classic.itch.zone_0.indexeddb.blob\1\00\d

                                            Filesize

                                            128KB

                                            MD5

                                            a8d0627aa61021b6dbc7ad3f2be08cc8

                                            SHA1

                                            b8c93428812692ac7c299469e1991bec149fbcc6

                                            SHA256

                                            1dbafe42d7668c86dfac855c628bc57130c5b2e4b34da76cb0bd198a08419e7d

                                            SHA512

                                            ed11cdde0fd710ff046aa7fea88f0a319d9ad5f51e616b354e47fd104f100004f4edcb04e62b438602d3f6862f996428a578969be436e7f4750b1ee0a5bcd16d

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_html-classic.itch.zone_0.indexeddb.leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            46295cac801e5d4857d09837238a6394

                                            SHA1

                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                            SHA256

                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                            SHA512

                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            2KB

                                            MD5

                                            9f576dc0acd2a360f07115081a18e845

                                            SHA1

                                            e4f43e7b2510c1250869eff896660aed1530b957

                                            SHA256

                                            239775e5dccbedc1a293e81a8bf89b5c6b3257b3fabae2e8d78a47535ff26dc0

                                            SHA512

                                            41ceae597df16a700c0ca3771dc146eb89713643436e7dbb53d65d0b51817746575bedd187a275fa3a6b6cd6b23c4a10621e9553fb792bcb2dae6ae6e06d8351

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            2KB

                                            MD5

                                            0fc381ae1e9b1fa0ebf20998b1a72368

                                            SHA1

                                            2dc1e23cf1b6deba903f4d6f83bc6b2b954aaf61

                                            SHA256

                                            4aa92301d551bf4f21fbd095468c3ac4b1430de1ed8224f240047ad3bfc73c71

                                            SHA512

                                            8d78ae7265eb3db6775b9bdfc6adcb579e9b7376b9f5cc85ce2fbb6a5c3db099e8768a35310d403fb4f6f355b7de1dcc5ac0740f12ec6ba68cb40bd1af71450b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            2KB

                                            MD5

                                            ffb8e37e5b5ed40dcebc0aa97f570e3f

                                            SHA1

                                            73046bceae42e79b0adddc71cfa26ba484af4357

                                            SHA256

                                            af8ff7f4da77c25f60509c61e2048b7993136ca37a41c91c1eb2428ccc3f38e1

                                            SHA512

                                            7bca077425f88c6d7941737d6d2de7f69dbb2109b286c995e54966d8b7930d85d79163ac0ddff6d44a483bebdf612b4d0167ec304f46c0ea67d19d4c68416287

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            67a822ef3a915e6cbcd34cfaada1baa9

                                            SHA1

                                            7d58717f1e2c5e4239dc960f750ad85d1e6aedbb

                                            SHA256

                                            342feafa81e78a6e871cde35d338d7914457ed688882a4259746f04a11bd262d

                                            SHA512

                                            6bd513c95e8723fd9b0f7eb0403ae9bdd9f9753e5fffca3531b0018d1685c69c20499379b6e327ffd28cf69773b5c1db7c9422553ecda919096efa00d5995016

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            d91f6cf9604bf0b279360bc2108796ee

                                            SHA1

                                            70bf868810530112caaaf78d914ec5ab8a0e007e

                                            SHA256

                                            a9b4f99425e06bf2be19b58ef3a23ba27ac32d41e98ef756038c49be39354bb6

                                            SHA512

                                            d5eeccfbe8de9ea8716020517166e151a6a8fae942c68f1551edc3744f791f9bd3519b2258f8f6ed60006301fe1342542672e2aa65cdb08fccd8d7d5a6635aba

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            8dc25ae8c6bee95bea7f084937c21ec6

                                            SHA1

                                            38853bed8a4321bd73d41d328a522be118395a53

                                            SHA256

                                            0ca596b71a7ed2a33d10ac6a807a19646e3fcdbb8b7199e495d98aa22035efbe

                                            SHA512

                                            d9de66dd26743e789328bfc06a32b2c42f3796fcd61fffbf102d1b071efc40a69bfad1732f6d196090d7369a208f9adce5011c22c85ae7d141f41caaf1e0d1cb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            87eaf02062ca483a88b3443d9ca8e040

                                            SHA1

                                            82e561be79870a464d9eb3289c2d342fb82d85ff

                                            SHA256

                                            a2e86fcda97e46b5a3693108817edf6ca2f00a10ec762692b72fb52ec4f8c56f

                                            SHA512

                                            24a24ca2d3c317a80358586059fbb9d6f14f7fced2da7c6d55945596bbd1b127097a9bc18ef61c286d859a211ebf14dd2f0ca0cd03795d19b6498de17e800e63

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a6a33c36f9ae5ef29cc45fd7c88e6a0c73e1c12f\650ae747-2fde-4558-8f1b-b1af438ba249\index

                                            Filesize

                                            24B

                                            MD5

                                            54cb446f628b2ea4a5bce5769910512e

                                            SHA1

                                            c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                            SHA256

                                            fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                            SHA512

                                            8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a6a33c36f9ae5ef29cc45fd7c88e6a0c73e1c12f\650ae747-2fde-4558-8f1b-b1af438ba249\index-dir\the-real-index

                                            Filesize

                                            48B

                                            MD5

                                            c7ec302c978fc9a65a1e75c0846d4a16

                                            SHA1

                                            8d1b54edbfbf2edc90c2defd87add2bc5ca16e4c

                                            SHA256

                                            8b8772f601a174c91ab707673160b28421288ed8ce108dce96ab3512b46ce967

                                            SHA512

                                            99146a85ca3b4d7df96aa0db544d586903f5156db1f127705ae8ea55d7d4224a68eb66f79463c893d92fcb87535bb226a081dc2fc2d7e0b3bbcd7ec649cfd213

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a6a33c36f9ae5ef29cc45fd7c88e6a0c73e1c12f\index.txt

                                            Filesize

                                            104B

                                            MD5

                                            a469f4d682940bef7cbd5513f52ee69d

                                            SHA1

                                            c5c3e397a453820e744fa2ef750c6ee5f3fffd83

                                            SHA256

                                            acb90708d7b7b050e6fbb18749db31d11380a065916e119d147318c73d059e16

                                            SHA512

                                            2b9fbd2ba9cfb5b0b4a37f1b8d0db824ff18d33b6b254fe77c46764b865341c2f88e327fa36b4d6741fd74b5333a1f1633552ca7cbac5485a1af5637ccdc60b1

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a6a33c36f9ae5ef29cc45fd7c88e6a0c73e1c12f\index.txt

                                            Filesize

                                            97B

                                            MD5

                                            0a7fdda99950377166eb65ee1c32cf63

                                            SHA1

                                            e4b190e0332ab596577c9b2808803e8551b75880

                                            SHA256

                                            57efbc1b459b6975b1a5426560d1cd8f83b8177ad0fd3047274190440ddf3bc1

                                            SHA512

                                            448501ac0557631d7ad104e776cdd9f089a21eafcd969dd34bdfc093cf9e5735b357327f7bfb8d9264bd58486e0a84b8193d985a01ba0ebb1778622445432977

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                            Filesize

                                            7KB

                                            MD5

                                            f8ea8b8b14c4a628a9fed14eb944c6bc

                                            SHA1

                                            2fdad9754a9f833472137bd39e4ef8319d273cae

                                            SHA256

                                            e13b02a22feb8721e421da3f4d36869935db6512fd3b2c19458d30280cfb4b89

                                            SHA512

                                            b4ca3be810a449f6eb1bb2b53da36bdd7d12bd88963c8d1f657d28b613f0c3be818296ccf76f7f2911bd028769ba34fa8409e98b8ebd37b7afa599646b4e41d8

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

                                            Filesize

                                            3KB

                                            MD5

                                            30d940fa9feda2c98537bec5e5ed2ef0

                                            SHA1

                                            ce7d082d77605ebc83a66f320a12b7191642f585

                                            SHA256

                                            49afc7ac79dc77559c5bf662b9ba4ed865885e6ad722263dd48e3dfd9f91f295

                                            SHA512

                                            c514b07c6fee395e7a1fdd4aa64c7b8af070a41e94278fb8d9554a39249906d722d2bb1fd6aa1fe4a24c5d4d4ab46ef14dbed477643a22f8e478e71df76bf6dc

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                            Filesize

                                            72B

                                            MD5

                                            8a3d2c2fd74c03e549d842e0cf17e5a7

                                            SHA1

                                            85fb979c28b514706813c92f3b313ad63162ae98

                                            SHA256

                                            8a6c1dc926fdb58c48d41c1a8b55a0b26a3b05ca083bf78349d2b6093599af04

                                            SHA512

                                            309ffb8d6f169cb10e267d769b3907917b136c726111cb227cdcbcc76bf296da77211ed2d8481d43f7861b6374c7f99efaa5ae42064374203c3a4d98b52ce637

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b011.TMP

                                            Filesize

                                            48B

                                            MD5

                                            b907a44058886ed73b2041ef5a1c7fd4

                                            SHA1

                                            20939877ba2670073fa526be372de91ff7d5a7c2

                                            SHA256

                                            e62d9b3f4bdddc2508c6278165b35aebbfbe5250be03c1d2cbc7d77048b45dff

                                            SHA512

                                            2b0ac773ea30d9f5f6ddb53efa773d7066c73864acc6aa8d7c4addf309bd845361b4a1f3d370e6bdd155f156e1b0a9f660d6ebbc3c8a791ca2d5d1c6066fd767

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            706B

                                            MD5

                                            ed66d75117a19d667be246d105f631b4

                                            SHA1

                                            c617c50e021793b4986deb340eb554d9d827b690

                                            SHA256

                                            ddb183c2b09d176e0a89abc4776c273acbb9adcd4ff9ce92dac1a3a799ab2eec

                                            SHA512

                                            08c84aa0676ab1de374a619baa65d117dd4fc6d34f059657b2d26fd757b3de50ef9a057d37c394ce7747ebb5b32af115f0b147f585d39589940450e114ff0c53

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            873B

                                            MD5

                                            367343c5f00af6512de81d6259d8044b

                                            SHA1

                                            0638ad4ea190ed70e13638d4104f59254ea225cd

                                            SHA256

                                            1df6967f18c3e62dcb61f3684ff849932172c31aa2131b16569ef5dbe80d5f75

                                            SHA512

                                            0c9540abae6310d6e0e30c0f96f9dd4b7eb0359649eafd9798ada5632e7682f4279a2195c5fe101282a527ff68d202191a412d30f8bb12c488d34da559ea0a45

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d580.TMP

                                            Filesize

                                            204B

                                            MD5

                                            cddda9107f3ff16701b0597ea4e31f4f

                                            SHA1

                                            8bb52c831682e28e9f29756662774a610462f222

                                            SHA256

                                            53291be872ded78eb04ab78029acc27789e6ce715598b449d5b90dc4bfd78159

                                            SHA512

                                            8247e87133ff2d14244271b74f7d11cec8275517950d2d02415dd07afc9164326adfcfeed5dddadd8bfdea8f150a270b26f795c9196fff3e62d93af1ed8d9915

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5906a52-66c6-4231-9c3a-17f440dcc58a.tmp

                                            Filesize

                                            6KB

                                            MD5

                                            5d70fa88c03ebd4876657bc2a5797be6

                                            SHA1

                                            2ef1693e73aec80729a7a7114fb87ef32a995955

                                            SHA256

                                            d628fe4f903add23949e123f9ff2110cbec04b1518848c2e785e28d3f135ee21

                                            SHA512

                                            055904263bf43be6ffbff23cd0555151b824c242db3def23c366b67150b7531e118b559344e46b9ce9238186fa3639e96e2ff6f360f981ead6d6e0624472d375

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            74026da451b2ac53413eaa3646b33fed

                                            SHA1

                                            d1d9094a122cbe752cbe698204b7a88686fffd6d

                                            SHA256

                                            853d6f241236c4cc1349bff1ee17fbf6bd5bcaceebf96b260e6b020778ac0192

                                            SHA512

                                            c4b6958a6b0d5954de5926a8c9c787f6620aeccb879ad511ffd2a80063e46d07af4e4214eb99517bc58cdafaadc75ac5631dec0c9b97fb958759e4100dca0943

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                            Filesize

                                            2B

                                            MD5

                                            f3b25701fe362ec84616a93a45ce9998

                                            SHA1

                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                            SHA256

                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                            SHA512

                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                          • \??\pipe\LOCAL\crashpad_2936_PCNSWSQJWKVUVCGP

                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e