Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/07/2024, 14:50

General

  • Target

    https://drive.google.com/drive/folders/1UBoPLqDj4r6L-sLzfD_idxNve_UnvqCL?usp=drive_link

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Detected potential entity reuse from brand google.
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://drive.google.com/drive/folders/1UBoPLqDj4r6L-sLzfD_idxNve_UnvqCL?usp=drive_link"
    1⤵
      PID:2752
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1400
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3680
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2184
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4416
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe0989758,0x7fffe0989768,0x7fffe0989778
        2⤵
          PID:4468
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:2
          2⤵
            PID:2592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:8
            2⤵
              PID:2056
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:8
              2⤵
                PID:2868
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:1
                2⤵
                  PID:2992
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:1
                  2⤵
                    PID:3892
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:1
                    2⤵
                      PID:5276
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:8
                      2⤵
                        PID:5400
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:8
                        2⤵
                          PID:5448
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:8
                          2⤵
                            PID:5524
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4956 --field-trial-handle=1800,i,12051580323954022318,12748996313633004899,131072 /prefetch:1
                            2⤵
                              PID:5592
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:5172
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies registry class
                              PID:5816

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              210KB

                              MD5

                              5ac828ee8e3812a5b225161caf6c61da

                              SHA1

                              86e65f22356c55c21147ce97903f5dbdf363649f

                              SHA256

                              b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

                              SHA512

                              87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              168B

                              MD5

                              63a6fe40fd39d01d22fa1af2bb8d0628

                              SHA1

                              be73c4a9969554e70e83a7ffe54aaa0e8ad1dd5d

                              SHA256

                              7e636d74316ef14486e674588b3614c5bc90124c3b5b1cb6b5922b6c0eb74a58

                              SHA512

                              48b4428bc08ed11b44560fda3d2c234037744785a3c1077148d80a681813c3b126c59edfc1dcc69d944bc249316686c9086d7068e4b7f0f8421665619755adc9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              168B

                              MD5

                              a3e6c144873b35d0dadf14aef578940e

                              SHA1

                              fbde097f5e79bd48a64ed40838137140414419a8

                              SHA256

                              9738c1afd981a7c89f3ff708b147faa16f2fed87e47004b3293444a4a7ff470a

                              SHA512

                              3e9d5a6ba18d7de299e701e4c73a9ac9526dc711c60080a2848a7f475570e8f25eb6a2a0b6c75d244621888da2cbd20dd14c2b6638d0c811dfa41a6c6bc816ed

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              168B

                              MD5

                              3dc3e9ae893b08cbf16596fd7552ae4b

                              SHA1

                              4606ef7eb2d6b9ecbc640ff857515916d92bfa8b

                              SHA256

                              287bbb497c0c0244ce61bb7f574ab423af59e8b7e12258ee5bfd3883b6bb0937

                              SHA512

                              767f49628bb9017c1329b5613772539c0459df5e8f1409b96c4ab6825721c4a45899a49c93a2422dbe10b08d6c2f6c15dd5df1e79e0e5f01ee582241764bf260

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              d9d0502b968f2d22d4d430c67e80df66

                              SHA1

                              eb28f4a01c991eeb39f056c22358c2b6fe108a17

                              SHA256

                              97bcfde23766badeb414d2bb721b684cb5bf4a94ccd4e82ed222f76bf874e6a6

                              SHA512

                              8e8b97b6df1168a78e60be2dac2962e4e6c9552f24cb3e970ec347bb4997d55d6c0532e43caad790e6ee09c4ba41dbb66b02c5f33741ca2cce9a47cd49619ccc

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              ae02a45c5f954a24e763e35a2b9cd311

                              SHA1

                              42107ca7a8e38de7822312f8346e46c70989ed49

                              SHA256

                              dbff45989d706342f3ce4bf8da860020c68e65b90af0f2176f5d4cea32fa9540

                              SHA512

                              9de5337455e8f3dd566f79f8d13da3dc673cb00285c84371933923694eb468faebfbb3d9113fe61b47d24dd28baba840a3fefb41ba1b02a26e0d868cfbd34388

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              371B

                              MD5

                              a498664f9019f1c4cccc9cacf5b49b07

                              SHA1

                              79c22f69d631f6575caafda5355c3b0ad71a5265

                              SHA256

                              b2d8977b8515b3db3eacbd53c8c02c42317f6b9b8d57210f69464d66bc276f47

                              SHA512

                              d7dd794c005d3fa8a1c755e19c5fb484f4e02cbfda5cfc1f8384a0ff2719d5f07716f2946de251eb2bc912367a48af186ff325f038abbf5f438e42ded1f16620

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              46303bfe62d0d6b8c6e3305e7112069c

                              SHA1

                              65d1d083d369b6194f0a955207b4e220c5c0dd45

                              SHA256

                              5871841489cbaf5a1a9cf79eddbfe90b9de95a8e600ed52a73be0cf2243a5f06

                              SHA512

                              f7ba680e4f977a5240c99e7c88a6d48166d6d15fbdf307b58ec1617f651e07612501d14043d4f24189ab3180bfaf4cf5fae0283c175e7ea0c10bf8cbcafec749

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              3b2b3981e8fb3fe96d0e749fa6bd66b1

                              SHA1

                              89d2a5b948caf716da46f842449d79243790e0eb

                              SHA256

                              edf1102b32d48bc83247cbbd559982ef62d6cf33ec8e00dffa100f5970d94144

                              SHA512

                              3192123022fa7ba2e4c20db1a4d3dcf4ad42fb814a4ce8de6ac65a656b17bd23027b2911477092b23cfc5d8ea7ac50474bec6ee7d516717696ffced51fd35f31

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              05960e2d735b27b03b9c927bb12db216

                              SHA1

                              7c80d37f0461fc6b50389f26eece472ef0e2861f

                              SHA256

                              dd0bd4587bd0c176f6ca84b7bf1aabc68807a5665010e4612ffebb278ba755aa

                              SHA512

                              0feb7d0522d4546ca6789f99b2be1863276b4b9e4e6df6b6431d2d6e763d1c264ea5b6a21c264d6dc7f047c79a35a1326f6ee3b5831f52caf46dd8b8d5bfe516

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              33ce2bd910bdd849f1d04e8d1d245116

                              SHA1

                              1b273e79275b91106730aa7963d5425f9cbcf694

                              SHA256

                              2907d23ea35ccb7e61ab8bb00bf3b208f92e502f0d18e5a9ea94a2349e42b83c

                              SHA512

                              ce88b79a370f0249705bdb5df61cb550d11cb0a3410a4e3a467645270cc4953d49acac0e3f14100d4c689332a7cdbae2743d2667ba2ede76ebfc997cbe900c1e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              12KB

                              MD5

                              9f10f20dd8effd2d89dc21d33d3f5e1b

                              SHA1

                              4bd1a9870683ef40d0ee771220cb11de80bddf3d

                              SHA256

                              ea074da97579054fa62c32e5b4ae1e189b8172703dc579683caa419d5088918e

                              SHA512

                              ffbbf2d61c50a85ce9d20c61ee94a811b1f4086cea0501f2794112b62dde4f79c46b0e6340e4a32f97a9b2a16fecbd3055ee8baf305bf3638220a3ac0667b172

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              293KB

                              MD5

                              d66262c26ef980e37a1bbd5eec39efc0

                              SHA1

                              02358201b9c249b827a3c4ac20e72e3369b2cc6a

                              SHA256

                              4f7739ca0cc91b32b25311e48c0a2e03625c084ae2e48647f8e102855d359b25

                              SHA512

                              ff1e494e29915942a2fa7916bc5f0765cf9963fd366b0134e96498833d64560caa2fe73e0ac09e6bf4233f5e860defd3205128b6af59317bc7cb455c620e6cdb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              293KB

                              MD5

                              d245604c5c3ee62adaaa0bfb37301648

                              SHA1

                              d433db6f2af305dfa27b5e5032510ee462131a91

                              SHA256

                              e9bb94bf1e083c6bb5c46961e390953cc61a17af9404d15807ab3864cb182683

                              SHA512

                              fc3e1e92ece90b0402c0818d8faba897a334c2173dea87141603931d6bed019cf4326c64b0c76fbfa8517bebae67271d82418d00a9c35c37c8f0903b611d4259

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                              Filesize

                              264KB

                              MD5

                              0fe5ef02f915b2308713997145a81b37

                              SHA1

                              7c7c1a93aa11a54e4a6808a148b8df0f49ff1193

                              SHA256

                              59febdb36d725ba2f20c27eb60abc0bf6c42c74e5068cd27125407932d6f139c

                              SHA512

                              0f1374f08317da865094bee9f6a29a4a0d0fcc489465a21e88ccd5e66eb5af6ba1ab7e980b21e9858e99f141dcb4bf7624d3e914bbad3f0729d1251924a7a0ae

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                            • C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

                              Filesize

                              74KB

                              MD5

                              d4fc49dc14f63895d997fa4940f24378

                              SHA1

                              3efb1437a7c5e46034147cbbc8db017c69d02c31

                              SHA256

                              853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                              SHA512

                              cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\599P0ON6\analytics[1].js

                              Filesize

                              51KB

                              MD5

                              575b5480531da4d14e7453e2016fe0bc

                              SHA1

                              e5c5f3134fe29e60b591c87ea85951f0aea36ee1

                              SHA256

                              de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

                              SHA512

                              174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\599P0ON6\cb=gapi[2].js

                              Filesize

                              80KB

                              MD5

                              750fad771f4f684472912c1d6140cbd0

                              SHA1

                              4cde2d7540f4897c121402a8dc2fa0f11f353e08

                              SHA256

                              0e093b02914cd9f80cd123cb932a1e732b30bbfd3b522e41fdcd6cb803d707a5

                              SHA512

                              50190c8b38a1f9738e6494eeff36fafc993232d6b8ad25c9946014d7b5cca00be25af9450644d64e73dc4c28a902a5a5ed31a2f65ad29ac8d24b1f3cd33d2ae2

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\599P0ON6\warmup[2].gif

                              Filesize

                              43B

                              MD5

                              325472601571f31e1bf00674c368d335

                              SHA1

                              2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

                              SHA256

                              b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

                              SHA512

                              717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\6QJA82V1\support.google[1].xml

                              Filesize

                              13B

                              MD5

                              c1ddea3ef6bbef3e7060a1a9ad89e4c5

                              SHA1

                              35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

                              SHA256

                              b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

                              SHA512

                              6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                              Filesize

                              4KB

                              MD5

                              1bfe591a4fe3d91b03cdf26eaacd8f89

                              SHA1

                              719c37c320f518ac168c86723724891950911cea

                              SHA256

                              9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

                              SHA512

                              02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2IGNEILT\suggestions[1].en-US

                              Filesize

                              17KB

                              MD5

                              5a34cb996293fde2cb7a4ac89587393a

                              SHA1

                              3c96c993500690d1a77873cd62bc639b3a10653f

                              SHA256

                              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                              SHA512

                              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DP7TYXVV\favicon[1].ico

                              Filesize

                              5KB

                              MD5

                              f3418a443e7d841097c714d69ec4bcb8

                              SHA1

                              49263695f6b0cdd72f45cf1b775e660fdc36c606

                              SHA256

                              6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

                              SHA512

                              82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

                            • memory/1400-340-0x000001B2DA7D0000-0x000001B2DA7D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1400-16-0x000001B2D3B20000-0x000001B2D3B30000-memory.dmp

                              Filesize

                              64KB

                            • memory/1400-35-0x000001B2D0DE0000-0x000001B2D0DE2000-memory.dmp

                              Filesize

                              8KB

                            • memory/1400-0-0x000001B2D3A20000-0x000001B2D3A30000-memory.dmp

                              Filesize

                              64KB

                            • memory/1400-341-0x000001B2DA7E0000-0x000001B2DA7E1000-memory.dmp

                              Filesize

                              4KB

                            • memory/3640-374-0x00000236DD100000-0x00000236DD200000-memory.dmp

                              Filesize

                              1024KB

                            • memory/3640-426-0x00000236ED8D0000-0x00000236ED8F0000-memory.dmp

                              Filesize

                              128KB

                            • memory/3640-420-0x00000236ED740000-0x00000236ED760000-memory.dmp

                              Filesize

                              128KB

                            • memory/4416-101-0x000001EF21160000-0x000001EF21180000-memory.dmp

                              Filesize

                              128KB

                            • memory/4416-456-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-455-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-457-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-397-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-398-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-404-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-405-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-406-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-399-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-329-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-323-0x000001EF10090000-0x000001EF100A0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4416-312-0x000001EF26070000-0x000001EF26090000-memory.dmp

                              Filesize

                              128KB

                            • memory/4416-149-0x000001EF26C00000-0x000001EF26C20000-memory.dmp

                              Filesize

                              128KB

                            • memory/4416-78-0x000001EF24710000-0x000001EF24712000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-81-0x000001EF24730000-0x000001EF24732000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-83-0x000001EF21ED0000-0x000001EF21ED2000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-88-0x000001EF21F00000-0x000001EF21F02000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-90-0x000001EF21F20000-0x000001EF21F22000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-92-0x000001EF21F60000-0x000001EF21F62000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-94-0x000001EF21F90000-0x000001EF21F92000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-85-0x000001EF21EE0000-0x000001EF21EE2000-memory.dmp

                              Filesize

                              8KB

                            • memory/4416-67-0x000001E70E9E0000-0x000001E70EAE0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/4920-45-0x000001A508200000-0x000001A508300000-memory.dmp

                              Filesize

                              1024KB