Analysis

  • max time kernel
    310s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 16:43

General

  • Target

    https://www-oblox.com/users/4853456472/profile

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www-oblox.com/users/4853456472/profile
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1d9946f8,0x7fff1d994708,0x7fff1d994718
      2⤵
        PID:3740
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:3132
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4464
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
          2⤵
            PID:1212
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
            2⤵
              PID:3956
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3624
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                2⤵
                  PID:3996
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
                  2⤵
                    PID:5104
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1892
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                    2⤵
                      PID:2384
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                      2⤵
                        PID:4644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                        2⤵
                          PID:4420
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
                          2⤵
                            PID:1936
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
                            2⤵
                              PID:4648
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3428
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                              2⤵
                                PID:3444
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3384 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3420
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5736 /prefetch:8
                                2⤵
                                  PID:1856
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5424 /prefetch:8
                                  2⤵
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4060
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3325196668342831825,13006110949261549203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
                                  2⤵
                                    PID:1928
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3600
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3004
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4340

                                      Network

                                      MITRE ATT&CK Matrix ATT&CK v13

                                      Discovery

                                      Query Registry

                                      1
                                      T1012

                                      System Information Discovery

                                      1
                                      T1082

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        Filesize

                                        152B

                                        MD5

                                        6c86c838cf1dc704d2be375f04e1e6c6

                                        SHA1

                                        ad2911a13a3addc86cc46d4329b2b1621cbe7e35

                                        SHA256

                                        dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

                                        SHA512

                                        a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        Filesize

                                        152B

                                        MD5

                                        27f3335bf37563e4537db3624ee378da

                                        SHA1

                                        57543abc3d97c2a2b251b446820894f4b0111aeb

                                        SHA256

                                        494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

                                        SHA512

                                        2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031
                                        Filesize

                                        98KB

                                        MD5

                                        461b1ce98240466558c4b258394d8009

                                        SHA1

                                        6c7ed066a9858330257ba808a06adc96edd09588

                                        SHA256

                                        cba053ebf928df08fbbcd78e32d32e1fdc632b8ab24651153375b4c9aca77221

                                        SHA512

                                        1de347eaa96cdc0682ec041fe893155a4725c32af6f25ec185d77704f504cdf30e151a44f0363c0bf8754eb25189e1bc3f6fdbd65d421990a61e23f572462252

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
                                        Filesize

                                        59KB

                                        MD5

                                        7fd069146ea79b16633bc8b45f90482a

                                        SHA1

                                        98dfafac54f6f5db51e3baea698208833ed1b642

                                        SHA256

                                        a746ba588555b584fe98e42ac1a2dfbb92c2831b54c263f51fe91d124b9214d7

                                        SHA512

                                        c31822f497ebb35a5da455e77965f16a83e2007215ae88e64bc21019d8d45fff4671ab4300d9cf518bd2b652d071cc582fdfb99b4807c75e2022755e6c60a06c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046
                                        Filesize

                                        51KB

                                        MD5

                                        a1852b5323e1e4948f64c40799dc605b

                                        SHA1

                                        45799a41d7d105ecf1f20ddec0b858f0023701b0

                                        SHA256

                                        3dd244b14869619ad7208852d0cc32ca2ba0440bca1ca593280710c91e40a2c5

                                        SHA512

                                        83ff1136339dc73e38444fc3f9e778b007245979c43d5e0bba0c4261489cd27004239b760fdd6ea462818b5a348c8f323b854df5a8116e1bcab23abab185d1b0

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                        Filesize

                                        5KB

                                        MD5

                                        fa8a7447eeb761edbb919c284e7984e3

                                        SHA1

                                        5dc8fca5e0f9e2ad778bc2fae2b7b8610b177dc2

                                        SHA256

                                        4992e4998954d623c2e566e62fbfd4570131f58c538247406973f946cfc831c5

                                        SHA512

                                        95a70deb97521154b36cbb868c32073a4055a00d1fa06f8b136d9588cf4e6da2070a2b06df84bbaf2a177af623c91b4bf1a0c9e35a1db6ae19aa69de94d9864d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        4KB

                                        MD5

                                        a8eff90a01497d11bf77e5ed4cc29dcb

                                        SHA1

                                        86b268877cc2a536b443729875221592c3e763ca

                                        SHA256

                                        8a8bd6e19eceb0e03d2353df7f5495dac27aec2dcc988aeeacc3d4e368670c68

                                        SHA512

                                        bc57c06f6dd6a116c4926fd0c73c104519908f114faa5389b86124f489f375945b0430b50777e3ce20a99e3c9562a57ee5995b504a633cafd57194af74be5309

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        2KB

                                        MD5

                                        e86764c8d0ca3dc26fcb4746b454bc4f

                                        SHA1

                                        7d5fc108f971b1c45c60253a79431eb20d4063bf

                                        SHA256

                                        090e6c6218a057c127869bb6a62bbbaba916c9c057259513c0192afd2b829d04

                                        SHA512

                                        61330188e60189088320bc8dbe3998c0a14eb5dc086d47a1d068fcc9f532a481dafb8b46e16598821bb0135b68be8a3c2291a94b1cc878999d7d53f8f80de545

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        5KB

                                        MD5

                                        16b38f4d3a54838df91830ac302c9230

                                        SHA1

                                        7703937eb886d72e5667741f06a25c41cf6c2d64

                                        SHA256

                                        abaec104d2b5fe2174e9e59d8a1fa52ce49b1b33051dbd5c9d61a66d5fb97d39

                                        SHA512

                                        279cf926ea0c28d4fe43686f3fd1452d5482849c6d7a7c0f2fe29940f4af400d758dc8d62f58ca467282e038a851da12cc8ba83f59e96c1cba7f0c88e87d511a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        6KB

                                        MD5

                                        e7a9718451ce21072563214ad5589e0d

                                        SHA1

                                        a0a12fd6555d0f82cf916a504d2ce77c300ff631

                                        SHA256

                                        79b170ea70fe117168b70ed25e3d8dace05a35bf5fa8f0c74ff82d684c8ee463

                                        SHA512

                                        12110e22641a4a3bae322712959122ccf94e541959b6d3314f2437d8ddb95e7f83e6ad31e23545773477912378c6340a9795db661be81e5dc89bceb201fc31fb

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                        Filesize

                                        23B

                                        MD5

                                        3fd11ff447c1ee23538dc4d9724427a3

                                        SHA1

                                        1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                        SHA256

                                        720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                        SHA512

                                        10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        2KB

                                        MD5

                                        edd56cef509c7d9d68b84437db4b4dc1

                                        SHA1

                                        e668e86440003b32b07a7e8cfe4bd37a8cd3f2b8

                                        SHA256

                                        fb63c5f639b00d501545dc5815fdafb04133b85e125374480f62810c47ea373d

                                        SHA512

                                        640b0c2e7df42baff41996f5ace46de1eb500e4c22823f3d42c43386a10456a98f9e8406e404ef447d6d38afd752d7e40af790662c397f1f6cb7c64bd5d2865a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        6KB

                                        MD5

                                        98753e82a901a811e7ef8a55c5c4e111

                                        SHA1

                                        d3edb6f81f90db04db69ed9f54f0e2b26eea4d93

                                        SHA256

                                        f4b0490a219cd8e23f4fb93139fe849c63dce8d04eac06da72d1957e7c315a3b

                                        SHA512

                                        e8ce33e298f72c7687cc6e33a511b51a45ae26409a64e57c19e1f37beaeffdb794f1400666a7f6faef552da5cd36b37d6cfcc64bcf3821a92b74270a7bd73a7d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        3KB

                                        MD5

                                        5fee36254f13d6be8ff289d9e9672d39

                                        SHA1

                                        d54c2784971deb740c9fa3ab1150312e2c0103cb

                                        SHA256

                                        e3e0004ef729bf3361f06cf8770838f021a777d6927c7d8f02b024e3abe8e852

                                        SHA512

                                        f29431c5803c9035027f6434a5ad964451006483ed003829977d76bd7aa11ecf4664005fa1227124c34f434bf478ae643c1b6bbc1bd0084fbecae4dd572b2d9e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        90f5a1d5f24dc2bb971eb7ff75834ef1

                                        SHA1

                                        55c9368805535b0d3dfdf07e42483d921a3247f0

                                        SHA256

                                        317f6ed554545ff953532dc607c1e5d5c9e5c10309ba640783a1564d886b696d

                                        SHA512

                                        881b5b8cd802bb03e3add817d2f08c2bffac285b8dc21f6e70b1eca4f27a6e1c753c6669a6314295e4c63dfc831258c3bca257fc41c18a965568d1e09281cdaf

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        f6bcaa15d2ed740fd87af76194c9a26c

                                        SHA1

                                        3ec62a12fd7fe883d0c76ce5fbbd7cc5c5742a61

                                        SHA256

                                        9e3b18053fe445cbe37cdb4b970d19337ad3c746f550c5a891dcb601622baab0

                                        SHA512

                                        364fbd33dd04d82eb38cb7e17aae0d4fe4fecff6b0e7e00fa8a274b5db61269edf47399820c854af57c2117a874c0b3a9318a0d3674c131179288c3d26288b8f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        9e6ea83e576389adc7a23ce5a371693e

                                        SHA1

                                        3fc6f7119d2c13cda4e852591654a69b4eaf4db4

                                        SHA256

                                        4d3095a594ecfa3c665384392f87cb533cc68707da3e258c494e606dab436135

                                        SHA512

                                        02082baa847e680b028327dbf879c9471dfdbd6bae39034040b2d0386a7d9b5c7bda2e93dbcd213e85ec6d45a7c4f5192c6c37973ee09f12cfb0782831163be7

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        7KB

                                        MD5

                                        32703dcedcdb68ec852b38e5ffcfc496

                                        SHA1

                                        74c8049e1007411204b0cb004168fd677e452d78

                                        SHA256

                                        d541948a1f8f67f23df6d2ded480271b39c2b47d22a8220a8d4816b60cf5b167

                                        SHA512

                                        d99acc7989dfcaba7f979594a1120bfba4b02e705c13927c6fdd4653ad1f07830d4093e1c32dc3fbd76507f2d2e708d5a34f3e6fbd84c5d4cc09c4e3eb8b1d1b

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        7KB

                                        MD5

                                        3a88387d5377d0a58784add6561ca55a

                                        SHA1

                                        3f48308bb6106f7390fcc8b8c8493aeffad6fe24

                                        SHA256

                                        1632534f3c0b2a3f32c3ac210ff4cdcfdc9b71de5bc08b43a45133f29708e1bd

                                        SHA512

                                        68f245ac30c345089e6e93bf7694f61ee0e7b76a687338ac9ff9e060dbae9575962f81bf486dca2951d347142857711775f7d3b813021f1697da2033bc4be585

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        7KB

                                        MD5

                                        4297e7028e45bbaa66ef16c610ea103d

                                        SHA1

                                        84c23d6e196b19853ef6f0d06adae8ee46e96ebc

                                        SHA256

                                        74ed0f0361b41d73e0913b9af619dc2ae550e8576eddb68a8ea129c0b9fa26d1

                                        SHA512

                                        f4c3eb27a4817c2f81e220246a67b903869ccc28bbca4d1a1d02c2dc4d37dda6cdc193c17c58fb1fb1e26e6184a223df1e84e8aa16b5e5c4082db86d6db1653d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        a9bb400444560e5626550a0bc819ce0d

                                        SHA1

                                        49510137435f8223b8f83b8863eeff53fb863b6d

                                        SHA256

                                        62be595eec845df0838cb44bc4af8491682324b7f8b70065146a00dabc496d9a

                                        SHA512

                                        3fcd3614bb9ab5878a43751a885eda39d95c386a9b73b4109207e33ea4bd7921f0319dc8135ae83e1c592a4dbb0a0ce8b3cf7159564bc19771cd65bc3597c3a8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        70a35c97aadbea41db9cd633e1e82fb5

                                        SHA1

                                        b2ad10d4185a144be5481e8dc699596480e6951a

                                        SHA256

                                        82c2b5362089e2d1e0926dea23b13cdd46fa43d555931f0f0b7523ca2a15ac2d

                                        SHA512

                                        d128dc005fb5653a9e4fb9573f2c9b3ee0d778d9eeb286a8eaaf2774190964de68b9822db7add1403946243f0b11c263e9b8da4c581064985fc16898722b10fc

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        3KB

                                        MD5

                                        0f6eef85fdf08150a5796608a5b2168b

                                        SHA1

                                        a9ffad8727444e5217858ee267c8b8e4b63a7128

                                        SHA256

                                        d086f1e9cb42023db87c5c5f450c44406cd3a640b2a8462f5c0dbf2505b15ac9

                                        SHA512

                                        1bd520a7c4aed6a3d54b033f99f530dcfd189b28eaa773db3186ccffdb27d01e5c59313f162229fae2f34a3892ecc45b2f2d200c7f5bbfdab52730724aa17943

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        59b0b593f2b183bd5958442151872192

                                        SHA1

                                        e311bcb1a5c1bcf88b548df72dd01441dfd98e1d

                                        SHA256

                                        f901bcebb7405c9e5565487ae739199e2d9130f117b12a599c88f5c5e289f5be

                                        SHA512

                                        54159c614fc969b8272e8335567fdce0ca4d7020e88fcafc8bf61c93a4e69023c0cfa31b6f7b4c561b47bb6fc6863d077322c9e3a3715ac424818ee075310e06

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        519cc383ba7a9d887d5b5cf30dcfeffb

                                        SHA1

                                        30660a0c1c2ae49e60aa93ecb498cd1b189b2d47

                                        SHA256

                                        14d8746346ddf351c3596502c5538e99f82f67b564c13ece75a2c03b98c80352

                                        SHA512

                                        89c454b8c2d5dd71e2f70efde28d366bdee1369bfde91ad8662cc588d2a774a1947f20ad3a66d5219c76159aee478bd672458f1ca8546d1b9f4467bbff9f701a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        47caf445c78c348f15b4fd1447b61355

                                        SHA1

                                        2186ea31a5b5debdd8f6a60e43cfbe51fc5c208f

                                        SHA256

                                        aef745b239db59aece67972f63934ba650af7cc49ffc3d822b9617a9896ee997

                                        SHA512

                                        a03aa341e9093a62fa485efcba3a045f423398f6f785fde5e97f749c7cc9994150c6feecd3a5d2faf0bc075e9ee9aaa18a01554dd43b329284ea020e2a9ecc21

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        1992d2355b659039d0f9d341a51e1043

                                        SHA1

                                        893bd1c8ce440efcbd1889390be1652bafc2a9e1

                                        SHA256

                                        639aa638f565ba6108555c4af43fa2644dbbee4a3d353bd2be55791fd4a71c09

                                        SHA512

                                        e637aae8e5407228d9764c907ca5713d91c2648ed6852f89e2085710d10f541fce0c9836a29359afa067efc5d38f4912a228b011289078332558fce0bb81c5de

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        3KB

                                        MD5

                                        caa5bee24e5c8e4e6528aacd6116344c

                                        SHA1

                                        a7bb16334244550c465a8b05b4fad2922b2bb151

                                        SHA256

                                        f91f0570b5a3d7f27bcdf7ff2e49f9d0260e096fabf068a0d605dcaea41fb869

                                        SHA512

                                        06165f212558f325e982fd78417de93e1765d602bcd372f852dea7f9e36990f4c2a38d8376e239371d08c9e665d34495b9ce092e2c0c6ccc826f53d228812e0e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        1KB

                                        MD5

                                        8b481145d47fc0ffa73d7250081fab7c

                                        SHA1

                                        7ee456274bf0efadb2d6858609df01554ec43bcc

                                        SHA256

                                        52e4d41e9190480bbbf4f06b362abe076aa03d9b14a633cae9c33524718a2d95

                                        SHA512

                                        d2d0904d7307f690b8214fe45061dacbd4d0bed06520f38f5a3f03716ca1884da9f737af3c8d526ecf35e8914fa7e7175093f242fe86328975ca4976794bad61

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        1KB

                                        MD5

                                        3d3be57a40f31060a4845e51b01f40f0

                                        SHA1

                                        18e28adbd9a6eaa09de2df0250a08226d34f062a

                                        SHA256

                                        81db0ddcd6fa42fa30ebc36241e1bdb3ff88bc724815ae12ce28dde2da2960d3

                                        SHA512

                                        79305d66f636396f1a3c2f126468ca5fbab9196bceb18a024fe61a3e78ec56b3e0a7a6e5c402b802728967f6652990067deef719ee9d829d7b1968f704c8314e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        19daec18f829a564130fb303408858f0

                                        SHA1

                                        2cd46f5c8b5626d433779b12aec0f401018cc7bd

                                        SHA256

                                        7c9fadaacd4cb274b1ab03227f81ea91dec54774447fed85e4f3389aa874180e

                                        SHA512

                                        cbcd857edaec09ca9b2e089ce1f6f29791fb9c747f90da7e7798a378967ae5cb3de89c8ad8051e79fde47263d6600ce42f1eef94c5eec4a620e6b21799ed7453

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        dec51f100a4cdecb1de9b2190a01cf28

                                        SHA1

                                        615259babff003c265092f05ffd9ec292e02fe3b

                                        SHA256

                                        64258016b63f1f5a1b27d730a3f705b9d7faffd3f35233366c03d4ccfe7d3d6f

                                        SHA512

                                        f8df2e08ecc35c9bee9dcac41319cfd0ce04bf033e46bc5098f71f9abfcf6778201d73e63d8ccb361a5c165150ff7e6b72ada270d946750b9a1df6e8212caa8f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        cd6f40d2f3a19dab9b5b22968bc584e9

                                        SHA1

                                        ecb667b0592399c87720dcbd09f2a33fb578358e

                                        SHA256

                                        d60bc2ae67020fa3e9349096fa4cea6ba7f3c7bb60710ef9e0e6b7f29ef5e8f5

                                        SHA512

                                        6271e1e65bfd4daf36929f8229111f0faf0a34da693333a8aff66ab374470f47b958ab627d01bed39c448787c26ca9c992879c019d69694aa67570d8c5158ab6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        3KB

                                        MD5

                                        4a226f4b1b40bb3b135a6dd7bb31c74c

                                        SHA1

                                        676f917a21c208480c7db4184d24a54110e3c6d8

                                        SHA256

                                        7fb42ebab59d3b4414233c5b2c3f1ccfb7d6b52c86aa7a6064d8a3f00ffec6e9

                                        SHA512

                                        62f682d0a3c29d44a020fbc675a5ad430fe13e8207d05295aa399aa9e02f37b3487698cdee5829ce1c19c12dcece1764d7e40c9541125d6d6a86cb422756a9a8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        25a2b9c7030eb65570591001a7091a01

                                        SHA1

                                        38f2e9f9648050388dee632a4d5c59e8eaf7e108

                                        SHA256

                                        7f13e76833d5c61f69c6ee9f3da047d65db780833ac2d198b933dbe0db632f88

                                        SHA512

                                        4858b11f8e0013b93695c10645000bc97dce1a12601b9f7d934b0618f2a91c8835d7aa034895ae83df58661c8f77dacec8a28bf0b879cfcf1b7cf386a52504fc

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                        Filesize

                                        2KB

                                        MD5

                                        23db904752218b4b5526ce9662d0162c

                                        SHA1

                                        d46e2325bd47984def833c5b6dd763635223c934

                                        SHA256

                                        5d238d3b873b0903b593ada7e1a7382811b2278186f5f6e3d3e88888d3c9cf03

                                        SHA512

                                        29ac4cd3c9e2cf38c991e44c24d8d4c2783bb0c8f471cef181a2445805688b8e41dd149fd5d6cf623bc892c5ebda333fc2f71cb666823cc4becf2be1fa3b5807

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804fc.TMP
                                        Filesize

                                        1KB

                                        MD5

                                        f0aacc7312d85c1d70cb86042c16a53b

                                        SHA1

                                        47be66a797a49524a67a608f7ebe16dc41180f91

                                        SHA256

                                        8a10438f4e2d10a401f93af744ef68a34e092f1679c2c1a7c87972875419b60e

                                        SHA512

                                        b930ff4649bd0f017c25a9cde817427216ab36984035d4f893cf9cfcb07b524a95e01eeb248ff14b8e3d4844e79029f9c54fbdc56766e69a04d102c0daaa741a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        11KB

                                        MD5

                                        fd687cd0f9bc172affaac053625c76a2

                                        SHA1

                                        8cc96094065ba19bb2c14303ad77f9ec3dba94a5

                                        SHA256

                                        4b7869fb30ef3221b0ee8bae0175e6afb1b07e1e98e23fcbe6008042c69073de

                                        SHA512

                                        c2f6a87599d84214cdc3290b4bf8fd42c706570fa97f02c5c856fa174b609e5ae532d03ee9f5ce2b4e0f710618ec9532eed86c059db38fd92fa6694f818909e6

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                        Filesize

                                        2B

                                        MD5

                                        f3b25701fe362ec84616a93a45ce9998

                                        SHA1

                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                        SHA256

                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                        SHA512

                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                      • \??\pipe\LOCAL\crashpad_2332_MBVFGWARUBKONMNC
                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e