Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    49s
  • max time network
    45s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/07/2024, 18:50

General

  • Target

    CeleryInject.exe

  • Size

    3.4MB

  • MD5

    ff3728a63db84bd000176d56e5672d0f

  • SHA1

    ddac6646d16d6efe73d9cf8b8c7a8cb3d8ab55ae

  • SHA256

    375f3b4bdff6a9d9ac581456d0ed49b56e72443cc09bac1010596b74b8945d02

  • SHA512

    8824507a41a59ec649d51f012c6ec777237edc42b764c47c9fdff6e7e3722adf0283ff118ad69018cd27911572feb1db280a5feecea2936780e6dddfa5df3eb3

  • SSDEEP

    49152:B5EU2GVV1EcBHbhI9ZFlDGjiolwOp3fvGA:UsX1JUu

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe
    "C:\Users\Admin\AppData\Local\Temp\CeleryInject.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1940
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3964
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca7a63cb8,0x7ffca7a63cc8,0x7ffca7a63cd8
      2⤵
        PID:1412
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:1628
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
          2⤵
            PID:1856
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
            2⤵
              PID:3292
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
              2⤵
                PID:2372
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                2⤵
                  PID:3008
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                  2⤵
                    PID:128
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
                    2⤵
                      PID:1948
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
                      2⤵
                        PID:3372
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                        2⤵
                          PID:948
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                          2⤵
                            PID:5056
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
                            2⤵
                              PID:1508
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                              2⤵
                                PID:3124
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5448 /prefetch:8
                                2⤵
                                  PID:3204
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3800 /prefetch:8
                                  2⤵
                                  • Modifies registry class
                                  PID:1676
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                                  2⤵
                                    PID:1968
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                    2⤵
                                      PID:2384
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,7488880840799051679,11950857060739149543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                                      2⤵
                                        PID:1948
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:684
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:2248

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a082f2d-5173-4b1e-88ff-09a0c402e1f1.tmp

                                          Filesize

                                          11KB

                                          MD5

                                          3524a838fbd70621a68d5b0412f290ca

                                          SHA1

                                          8c1f253f513466afaf68c7391a212da80d94848d

                                          SHA256

                                          8948f8c6ff56c94d66707a8eca32e3c72bb6018c270a4c671793c8336768f8a8

                                          SHA512

                                          f500e2d8b640bdf52fecab59ee7960a61de7935b5faf886a1d77f7d738d82ef3d75e8a980eddca2befe982347ebe40e6d019414b10346481261f735db6e5c224

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          575466f58c7d9d3224035d23f102d140

                                          SHA1

                                          2fce4082fa83534b3ddc91e42fb242baee4afa1c

                                          SHA256

                                          9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923

                                          SHA512

                                          06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          f1d33f465a73554cd1c183cbcd0a28a2

                                          SHA1

                                          f5c16fc4edff600cb307f762d950500aa29a1e8b

                                          SHA256

                                          22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9

                                          SHA512

                                          7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                          Filesize

                                          62KB

                                          MD5

                                          c3c0eb5e044497577bec91b5970f6d30

                                          SHA1

                                          d833f81cf21f68d43ba64a6c28892945adc317a6

                                          SHA256

                                          eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                          SHA512

                                          83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                          Filesize

                                          67KB

                                          MD5

                                          9e3f75f0eac6a6d237054f7b98301754

                                          SHA1

                                          80a6cb454163c3c11449e3988ad04d6ad6d2b432

                                          SHA256

                                          33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

                                          SHA512

                                          5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                          Filesize

                                          41KB

                                          MD5

                                          de01a584e546502ef1f07ff3855a365f

                                          SHA1

                                          60007565a3e6c1161668779af9a93d84eac7bca8

                                          SHA256

                                          9ed00a33812a1705d33ccf2c3717120f536e3f4e07e405539e1b01c5a38a14ea

                                          SHA512

                                          1582b69b40e05bad47f789e1b021cdd5e3f75548a39a99e0db1b15138425e530e25ce6e56185b1dfa5f51758d2709e52d53f309da2e662ebc34c8d4974ab6469

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                          Filesize

                                          19KB

                                          MD5

                                          76a3f1e9a452564e0f8dce6c0ee111e8

                                          SHA1

                                          11c3d925cbc1a52d53584fd8606f8f713aa59114

                                          SHA256

                                          381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                          SHA512

                                          a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                          Filesize

                                          63KB

                                          MD5

                                          710d7637cc7e21b62fd3efe6aba1fd27

                                          SHA1

                                          8645d6b137064c7b38e10c736724e17787db6cf3

                                          SHA256

                                          c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                          SHA512

                                          19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                          Filesize

                                          88KB

                                          MD5

                                          b38fbbd0b5c8e8b4452b33d6f85df7dc

                                          SHA1

                                          386ba241790252df01a6a028b3238de2f995a559

                                          SHA256

                                          b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                          SHA512

                                          546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                          Filesize

                                          1.2MB

                                          MD5

                                          c71e53854f68266b9b7f2151cfcc5c32

                                          SHA1

                                          356fa2aa7d9a8c7585d846fadde297d33166ecd6

                                          SHA256

                                          ba4913f000f60e3762611198396ef0bf07204cb4381a74d83328e6369eaf39b5

                                          SHA512

                                          d261f7efb5490d0e9e11517d1e96d8d090bb0a64584565afe335ab9becb54f399e5eea088156c999004b771f4cabaa107256822bc1c4085194a35744d7915270

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                          Filesize

                                          18KB

                                          MD5

                                          ee8fa9b6956474196b7605e97941ee45

                                          SHA1

                                          91eeb6359661342c951323d9619bf0c59c659e40

                                          SHA256

                                          526a25c67c37b08299a48d68c6b41c0c4b9926431b0277bf942a0a44c2e19304

                                          SHA512

                                          f887359e91cb5df77a88eac0a1c94a3ebae0930dc8a2d22363e2d5b2c5fd7f9493e398c8f3d3ed92b5b7e14a5493f5db1eee7c54e919c93596f8ad60dcacbd7a

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          2KB

                                          MD5

                                          aaa9fd9d2150517d478815965dd3a3a8

                                          SHA1

                                          960d8949015aa771663ffb736d866867a0314d0c

                                          SHA256

                                          06212582fbedbc54bbd3a50a5e4f21c6446de261f444b6aa75b9d6c6f465374e

                                          SHA512

                                          dd5f8aaf5d5720cdc609b9ed77508859211d3014d7e156a4b9fca433395f85616e6e6e7cf3508bf6961396ac410c4195e95700e0fcec9680ee635ad8aea8f4e5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          3eaa20b2d3a9add1de2f6f72c508bc5e

                                          SHA1

                                          9e5a5130048f3caca50fb39814218241c297a013

                                          SHA256

                                          bf139e3d40718d64bf57214fd4526e741ada48fe3a6d4f0566728ba3d99615cb

                                          SHA512

                                          6ec5be7539711fd6db1bd41643449ccd1d2def27b7ab323e36b2c1990dc1da96dde87910b43d26c8d2ce3b5a904f4d1ea27467ee8ee55d5e51daeefee5cba684

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          f3963e4713eb71dc80246d22ba36bec3

                                          SHA1

                                          a71bc9469fc2344140e2a647af778d2244a7e9fe

                                          SHA256

                                          8e98f1943ad5cc79fe98732c6cedfd94d43ac194905c9978b34df39d9e9b3932

                                          SHA512

                                          023c32dcf901f26b4a627ddce80df7c76c864741a1680b1be3826cd54b08dd39ccda21eedb439e595aadfcbe4052056c509e4dfda9cbd50509541d4419aa6d9a

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          4181d6ba3e9cec53c8139515d8adaf4c

                                          SHA1

                                          9017ea17d89533fbe11d2f5beba055943809a49b

                                          SHA256

                                          c8f7e079341c25f64ec2e83485591e35f508ce30475281e4a423f96c13662dec

                                          SHA512

                                          59ef3b9a7056697b7250c4638c7f732c4025b2a6d965bd4bc595f93c128cb09adb39ffe7354c17e1e222e52509d3228a0decdcc2771585063eeb38b14bf5dd5f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          91886a0714f6dc4460b0747efc66ad01

                                          SHA1

                                          2c9a15c470def05dc71fa08371898e1236e1d129

                                          SHA256

                                          2715448506a4825966e9eab4284c736dba3f7def82ebeef1227a4b6a5b7fa284

                                          SHA512

                                          54444969a85c9286713c926f7add60b7561cccabac947d1f12cd45b0215a3a9330b39c35145857c15e31e503edf8034d23a48bc024a186ede3c9d415fe58b732

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          56f2b3dc167add635863c6a26f6313f4

                                          SHA1

                                          cd80e87ae1033204272ed4b1f74e7aadd5ff51b0

                                          SHA256

                                          56bdcaeee6c9cb5683f0aeff36abef84472e2adff18b4a4b3daf8b300ca2bc73

                                          SHA512

                                          d0a00f740cd1103d0e1b4d34e07780a6b6ddeb235f032a6ddf3e5cea809bd97746d2ff6909c4850ac6cccf0601c1e31f19e198d70d9d59be568de2e0ec8578b8

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          a8adfe2dd409b8e80875c52cb4180aad

                                          SHA1

                                          f304697a8903f8a6f28fbf478b7646df429ae70d

                                          SHA256

                                          0d31abb974e31643f5bf66d7b8a27179c8a8be2cdd09123c6d6995def7a7eb04

                                          SHA512

                                          575f980d2ca2d21ec9db23e7d6ae1ac8799769ea2b069cbaf4808cd1d7bb2ff5a967bfbc0f60fc36a44118233c8cb90fcdebf4898cef81aaf2075da7ea4de363

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          96B

                                          MD5

                                          93e72b8ab3d23d39645af7d98b82260d

                                          SHA1

                                          f3772cb26c94002fa117d409e0712725d922de1b

                                          SHA256

                                          7eebe5d3544737109061316eb70eaa974ad516b4aa45d90e8808119ebdccc78f

                                          SHA512

                                          e649cf74f400c55e7a43c46036de34a0380a44e38f212f1c376c01396b26c43d42bb309ecf9048f340309a38e2ed6b9fb9f665f52445a5180b7456f3c43c49e1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584ee6.TMP

                                          Filesize

                                          48B

                                          MD5

                                          bb49e8f62991d5cf9fd9906ecfbd25c5

                                          SHA1

                                          ac3f188e06e7275b28de90d9f13bbf81fab346d1

                                          SHA256

                                          a499b6b6330df2bd5e51de82f791a2165c0c8f7abe42b94288e53f4dbf1d96f1

                                          SHA512

                                          65b4d098106891dd2e685ead2c1be0405f1824b29f47f9398646a2f12b4cb85a71a8bb5cac966f5d42895a463bf77db2b48484ca1d31f9a8290886bf64919a98

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                          Filesize

                                          872B

                                          MD5

                                          4bed369bce61eebd53f7430068d531b3

                                          SHA1

                                          413071baea59655a69f50d1d76d753e59f6deb7c

                                          SHA256

                                          ba3c052fe3b2b1cef685b956c7b12647b3764f759089ca1a8380aece30092f6c

                                          SHA512

                                          8c792256396c2e3e0291a20c28d5d49ad6aec78cc20aac0ff3d25f5be3293c5d293de00aa31052f790aad8db95be34912a47459bbcad65dc577a61df322c6b7d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584f34.TMP

                                          Filesize

                                          872B

                                          MD5

                                          7fa069ada471f1ee5473366582c5191c

                                          SHA1

                                          f45929cdbe0dd700e397b364fde5668249364eeb

                                          SHA256

                                          b1b460ea149ea0abd63fd2e4a85fec742af854559fc678cc4e2fd24dfd700f50

                                          SHA512

                                          9092f4eb1e4164e70a46b4434bca77471d07e46f0519acede9e9fb1fe0f6e49dc1e8b1d98fe0497656555526bbfa61a2a48220555e3788646cbb0aa1c41b7658

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          13cf01568226c71ad30c4466841679a9

                                          SHA1

                                          2bc8f079007d6b3b0ab7c011b798a723c2342dd8

                                          SHA256

                                          27ddbefa86aa21cc5be4a750b4eb9a63b72ddc5fff9d1a26fcc90bab9d99cf24

                                          SHA512

                                          9e2209072929ae8ea68167b6b8a17a9687d9cb21fecf3e79623fc1cde748037d83ab42a14f7950d79639dd8675ffd16b186b3dadbd049790dd00ab8ddbf8ed9c

                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                          Filesize

                                          11KB

                                          MD5

                                          f14d35e09a6dc5894408e3e4d2b71cdc

                                          SHA1

                                          df29ec121d401c6894fa1abd4ccc73b164b2beff

                                          SHA256

                                          8880a0b04af6e95fed9d68f98585fa976416a373ced4706c535bb37a8820d984

                                          SHA512

                                          e5ec58fc970dafb685f6990b213447e9fb4e40a14c25a79567f619d68be5b05061ef736110026d389c343573e30fe134d0de442b53593af54dd29b3c446d306c