Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

URLScan

urlscan

1

https://mistermodzz....

windows11-21h2-x64

9

Resubmissions

03/08/2024, 02:56

240803-dfezha1clj 9

03/08/2024, 02:53

240803-ddg13swajc 8

03/08/2024, 02:42

240803-c7cssavgkf 10

Analysis

  • max time kernel
    1034s
  • max time network
    508s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/08/2024, 02:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://mistermodzz.com

Score
9/10
credential_accessdiscoveryexecutionpersistencestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mistermodzz.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0cad3cb8,0x7ffb0cad3cc8,0x7ffb0cad3cd8
      2⤵
        PID:2916
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
        2⤵
          PID:1896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2524
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
          2⤵
            PID:1364
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:3156
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
              2⤵
                PID:2052
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
                2⤵
                  PID:3044
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3004
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                  2⤵
                    PID:3008
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                    2⤵
                      PID:960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                      2⤵
                        PID:3684
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3940
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                        2⤵
                          PID:3384
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
                          2⤵
                            PID:5080
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                            2⤵
                              PID:3280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
                              2⤵
                                PID:3296
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                                2⤵
                                  PID:1012
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5656 /prefetch:8
                                  2⤵
                                    PID:4720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6124 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3112
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
                                    2⤵
                                      PID:3500
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                                      2⤵
                                        PID:5068
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                                        2⤵
                                          PID:2284
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                          2⤵
                                            PID:3136
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
                                            2⤵
                                            • NTFS ADS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3432
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3712 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4888
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:4976
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:896
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                              1⤵
                                                PID:1404
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:4888
                                                • C:\Users\Admin\Documents\Client\Client\Client.exe
                                                  "C:\Users\Admin\Documents\Client\Client\Client.exe"
                                                  1⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1228
                                                  • C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe
                                                    "C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3672
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\895c01f2a97c8e5b030d6a8ded574f02.bat
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4500
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4656
                                                • C:\Windows\SysWOW64\werfault.exe
                                                  werfault.exe /h /shared Global\81d371a0cd44471cb6e54b819ed9d5f7 /t 3092 /p 3672
                                                  1⤵
                                                    PID:1096
                                                  • C:\Users\Admin\Documents\Client\Client\Client.exe
                                                    "C:\Users\Admin\Documents\Client\Client\Client.exe"
                                                    1⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4372
                                                    • C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe
                                                      "C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1396
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\15c1a09e7d0e02098719e6afe4667b30.bat
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2392
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2148
                                                  • C:\Windows\SysWOW64\werfault.exe
                                                    werfault.exe /h /shared Global\221b3816fb42409c8f757da4b26ea534 /t 5044 /p 1396
                                                    1⤵
                                                      PID:3444
                                                    • C:\Windows\system32\taskmgr.exe
                                                      "C:\Windows\system32\taskmgr.exe" /0
                                                      1⤵
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:1456
                                                    • C:\Windows\system32\sihost.exe
                                                      sihost.exe
                                                      1⤵
                                                        PID:1468
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe /LOADSAVEDWINDOWS
                                                          2⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • Enumerates connected drives
                                                          • Drops file in Program Files directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4928
                                                          • C:\Windows\system32\dfrgui.exe
                                                            "C:\Windows\system32\dfrgui.exe"
                                                            3⤵
                                                              PID:3448
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                              3⤵
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              PID:3620
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0cad3cb8,0x7ffb0cad3cc8,0x7ffb0cad3cd8
                                                                4⤵
                                                                  PID:2616
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
                                                                  4⤵
                                                                    PID:2484
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
                                                                    4⤵
                                                                      PID:1892
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
                                                                      4⤵
                                                                        PID:4596
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
                                                                        4⤵
                                                                          PID:3648
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
                                                                          4⤵
                                                                            PID:2528
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
                                                                            4⤵
                                                                              PID:3712
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
                                                                              4⤵
                                                                                PID:2440
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                                                                                4⤵
                                                                                  PID:800
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                                                                                  4⤵
                                                                                    PID:3796
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                                                                                    4⤵
                                                                                      PID:4152
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                                                                                      4⤵
                                                                                        PID:3860
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4316
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3628
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                                                  1⤵
                                                                                    PID:4784
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:1400
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                      1⤵
                                                                                        PID:2084
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:5064
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3408

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\.oracle_jre_usage\9abebe34b4336e53.timestamp
                                                                                            Filesize

                                                                                            59B

                                                                                            MD5

                                                                                            d28d168e9aad0efd8091e24fa8b53b5c

                                                                                            SHA1

                                                                                            bae08fcf2f766a2c7e159fec5ba5e843f83a2df4

                                                                                            SHA256

                                                                                            ef43981ac441ed33592decf6842db6fc227d811216b0f170fbe958a67d4ab34c

                                                                                            SHA512

                                                                                            06c5a1b9a4cece0fb9c9b27ca606f9ae5fac9c0b46a341629677185ebf01bcaca30936138447a1b3e1db758666f6fc7b719e2ed6c9695760d36cc612d8c0cdad

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                            Filesize

                                                                                            64KB

                                                                                            MD5

                                                                                            9e466b4837d8431be725d6b9c1b4d9ef

                                                                                            SHA1

                                                                                            3f247b7c89985a41d839cad351cd0fc182fcb284

                                                                                            SHA256

                                                                                            2f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d

                                                                                            SHA512

                                                                                            01de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                            Filesize

                                                                                            4B

                                                                                            MD5

                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                            SHA1

                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                            SHA256

                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                            SHA512

                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                            Filesize

                                                                                            960B

                                                                                            MD5

                                                                                            16846df493521e84fe47cd6b6451ec8f

                                                                                            SHA1

                                                                                            6d99eb017c5aec08d3a7e908bbd4a051ce250c02

                                                                                            SHA256

                                                                                            69f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9

                                                                                            SHA512

                                                                                            aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            b4ae6009e2df12ce252d03722e8f4288

                                                                                            SHA1

                                                                                            44de96f65d69cbae416767040f887f68f8035928

                                                                                            SHA256

                                                                                            7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

                                                                                            SHA512

                                                                                            bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            4bf4b59c3deb1688a480f8e56aab059d

                                                                                            SHA1

                                                                                            612c83e7027b3bfb0e9d2c9efad43c5318e731bb

                                                                                            SHA256

                                                                                            867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

                                                                                            SHA512

                                                                                            2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            f5a0208950dc408b64d0761b28db9a59

                                                                                            SHA1

                                                                                            f4c13cca372786d854857305682c2f494270c9fe

                                                                                            SHA256

                                                                                            e1f7e0f1b26e3e512d4a9b5ea60b90b41374c3f1a3c0b4d697cdbec78d482661

                                                                                            SHA512

                                                                                            15a15cd5376d44224fec5a77868f93f4ed3c62e084ff8ec8326c99f7410581bb16d24c5ccb30e6ad0bc922f71511b86e9e7451015e852fef3563785d29da9d3b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            17b0df04d2a3490455c68d1bf4a7f7d2

                                                                                            SHA1

                                                                                            9c845666a3bc6ec1a3eef2ca1e955b76afb11708

                                                                                            SHA256

                                                                                            0ff59df6315d644036dd7623d164835aa357d6abe4c33c0b1518606b3f851c24

                                                                                            SHA512

                                                                                            497c1d8c2f89dd44b2aaf3845e11b999faa92475f9809b0a272c861acb901ad8670b20ec11fa537a3e3fcb17bd357c838bb6a5d27216bfed4c6daf4cf82900b2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dfe4108-ccd9-44e2-8c18-a6f1bbfffc16.tmp
                                                                                            Filesize

                                                                                            70KB

                                                                                            MD5

                                                                                            e5e3377341056643b0494b6842c0b544

                                                                                            SHA1

                                                                                            d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                            SHA256

                                                                                            e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                            SHA512

                                                                                            83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            0180353897cf7d4482fa5c6a0f5d2513

                                                                                            SHA1

                                                                                            5d65cf5b0c38b028a6788aefba65026ba89328df

                                                                                            SHA256

                                                                                            7f89a43b4bf6f1dd3004e5277e0382da4f46354935eb8d826e62c55b23756d76

                                                                                            SHA512

                                                                                            1545fa10761a854f547b0f3edd662f14b5f328b0aba02c06600a3c9bbb3c1c1ab300a182c01345ed773ab5da18be91a3a5b76a03099f84c2bbd118662403c432

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
                                                                                            Filesize

                                                                                            32KB

                                                                                            MD5

                                                                                            0672751b0995ef0a5a980e8db3b20e76

                                                                                            SHA1

                                                                                            39d3c3a94af634f99180fe5b39e2adc1dc382997

                                                                                            SHA256

                                                                                            86e6b40142c13ca83951ccd0265b59ed2c442ea4f4148166c7fb9b534a7acd34

                                                                                            SHA512

                                                                                            2763ecd1c9db9714fe51f902e2f10177631471a9b71cba917569b3a8f4509eab4e28545813de01e59f08466fda013582a61901adf004b15c131a66414b628836

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
                                                                                            Filesize

                                                                                            32KB

                                                                                            MD5

                                                                                            cde3102fe99d4e1c10a3801e7e856680

                                                                                            SHA1

                                                                                            ba2d90f5c660b5a2aed2578bb3394906059d60ba

                                                                                            SHA256

                                                                                            2956e4e152c25751ccb0ae2ed999adfc7980d74e3e1e641e958cedbb49ddf0c1

                                                                                            SHA512

                                                                                            4561b9f02f997f3c8e37fa14ac6de008f9e5371457682ab554dec30054daaef04bfa63de1486cda48259c35065c53e0ab11c980e1b57bd9cba20d9ee4bb691e6

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                                            Filesize

                                                                                            116KB

                                                                                            MD5

                                                                                            87b98c7b054ea4ec1b52db58b360f2c0

                                                                                            SHA1

                                                                                            a6bcdff70e06cf0fcd778cf5d85cdd280538b72c

                                                                                            SHA256

                                                                                            dd5df25c8a0ad79a5c7c2840118395589f49f827975933c458b54e50232e92ce

                                                                                            SHA512

                                                                                            fa8fd2806b9a3ba83a39610571406601b0f470db074eb7ea2d9c3e07fc4104917fdff442a80e688df72539c403970589b4da26387f2941f32c1b30d7b986db19

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            2c162df4f38f325af94238b34623036c

                                                                                            SHA1

                                                                                            63c869d6f4927a734e2ffc9a56f676c4c59c9593

                                                                                            SHA256

                                                                                            8a7e3b71d4831261ff76d1a859b5970ec2e9499bccb185cce0efee3a35d6e976

                                                                                            SHA512

                                                                                            031e3b5df9aa8438bbb678cd2d19705a2c2ae77d543833188614ccf54a9c80e5291e6e26ba497c1cec9e2eddba5f54150becef8c9e058738aa43c6a7e537aa87

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
                                                                                            Filesize

                                                                                            88KB

                                                                                            MD5

                                                                                            b757b67f4b65f9275a8781e3f3689463

                                                                                            SHA1

                                                                                            1503946b6d4d8d1996983f1bca3667af4f298a07

                                                                                            SHA256

                                                                                            0cd7ba4aa49be611210d085255f809cf21e735596590eedf4fa7ea79b573c2b9

                                                                                            SHA512

                                                                                            733685d050ebac7dc6feb2ea14ba179e149794dc77eb8ed361075cea3f7039b5e829fd2cf9142bd93d946b21b846b3a804b203ec342ed39c9cf1324550d50850

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            1bd2ae540e18f41dfb8dda33ab603b75

                                                                                            SHA1

                                                                                            0d914044dadd48735de2d110f0baafa79876de30

                                                                                            SHA256

                                                                                            26f927b0aa5d86962bcb00bafb03cb5dacd10d0744c28319b4602fc999df80e0

                                                                                            SHA512

                                                                                            19698977789d7e34dd1c2cc5eb7f12a91d0bcb3498b4eb4c2c94a5f894bfc5d1e2b880c51e1489b898e8180c53f7d4470d72ea2c4b9890807b0546b64c703530

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            6ba70b90dc3c043510c4afb24f43e567

                                                                                            SHA1

                                                                                            95138d489997e1471c009b19e985ffa8fd9ea2ae

                                                                                            SHA256

                                                                                            e0f229a38b9bb4464d8363682cb5ac5d0d5207fc9f1bb5bdda8f63882d9ddccf

                                                                                            SHA512

                                                                                            6222e98219f5ff1de51e7ff555b9a44a98944072a884c8317a41a216653e01064118acec5afdad186221836097df641eac010dfcb45c9112593011ce56d4d7ad

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            07d7f6b19d6c3dc606591984dd4319fa

                                                                                            SHA1

                                                                                            9b2cfecfd9950376e46c62deef92afcf22db2121

                                                                                            SHA256

                                                                                            ab71e82adb6561b272b5a0745f68262e7e0fad5929e2d7220a4940a14186786c

                                                                                            SHA512

                                                                                            3a622662eb2e548a735500605ad3b08eb3aba93589deaf8e6ad2bc0ac0dcac50891e9f1acd027cef45ab211a34adce399e6ca522aff5f05557c4101b98106b93

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            d85c4aefadb1d54ea92ed9ce9ad44b7f

                                                                                            SHA1

                                                                                            87749e9e025f2af571c5c551547e5c0eefe3d447

                                                                                            SHA256

                                                                                            ff32cd835e6a009f742d1fa2b01facbcf63b81f3e842b060d355bdb75282d8a0

                                                                                            SHA512

                                                                                            b7d1fe8ae9cf47fd7bc93f77d904d65beefa63865123167d74ec18fc02d7f541d61ed90b076ce45391dd13730df094ee31412f2ed1f944a5661ab4dc84b3f395

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            5c3a15d47e5e6c7d6a85a968589be6a1

                                                                                            SHA1

                                                                                            55e6870573b9237996f904d2a139e8c6639f0361

                                                                                            SHA256

                                                                                            e504026b499d1ce85f3e6d7b7101a96ebda2777af696b200352945c5d70b7134

                                                                                            SHA512

                                                                                            abfbcadf38022ac6086691d361872cf780f0dcc63e5d161be797b9c6092fe81fe957d5868d47711a48cd9e00717fd0d70a4ae8d679114c84294aa571c7051046

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            6ff4d7dc201f6b08a6a1a8ed0ffef128

                                                                                            SHA1

                                                                                            04b48a30e9a9f8c9051c4b385457d0e3824c9a04

                                                                                            SHA256

                                                                                            8ed3151b9b32d8dba6d70cf152d07ea28441d58e152cdf4ac8cdcd5c47185449

                                                                                            SHA512

                                                                                            f9d35856313a78bc9fa8e3cd1773dfacd7b2df086fe1165bbb848557ba24b6c0656b90bcf89843368177173fabcad50940a5282ee42573b12377f5a5bef815c2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            8a99884fa61aba28cc8acb248ca6604f

                                                                                            SHA1

                                                                                            ff215fa23891d3ead8f8d1f69e792566cbf34eb8

                                                                                            SHA256

                                                                                            9ad290147f3549fbd0be5600f91aa967dcb04b9ca42a16c195db224c73d6f05f

                                                                                            SHA512

                                                                                            bae470df4ca52754a780f0d90eef38fe0aa4e4c46e739e7aeb1f22283909270db7048ce6fea726be6bd82a7012ce8c0b7b5be8ab978c6849c76b4cc22cf15a47

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            a740659984eef63e32596f5d23765155

                                                                                            SHA1

                                                                                            d684fbe98b3328e92cdc71785d91ad947bffcb19

                                                                                            SHA256

                                                                                            40d72012092df425911f490722a402b2a6e8e817168ff9693eff4559314f1381

                                                                                            SHA512

                                                                                            576178ed0f8e7bb6689a92616a452f385ed6e4374e7ac15f057246253621fe22191aa59700a69e0bfe30b69470dc4f8379775e3a229f3362f5f3c184dae621eb

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5f6c8e.TMP
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            52e449912a936c4f8c8f6dace60d22f7

                                                                                            SHA1

                                                                                            ae13c8c2eb92e161dca0cfdab294566d0fdda0aa

                                                                                            SHA256

                                                                                            fd7a5ac6abb277bc3fba021072f2208347218fec8db5cfe42c056d7f3dbbab6d

                                                                                            SHA512

                                                                                            19f241ff04d9872c391e1f8478543952ec76dc362126fddb3b3a99124c58151ce4319be75e3e9a13919a99c98c3436d87c5798c4befa499cbb8691ca6c316621

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
                                                                                            Filesize

                                                                                            33B

                                                                                            MD5

                                                                                            2b432fef211c69c745aca86de4f8e4ab

                                                                                            SHA1

                                                                                            4b92da8d4c0188cf2409500adcd2200444a82fcc

                                                                                            SHA256

                                                                                            42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

                                                                                            SHA512

                                                                                            948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL
                                                                                            Filesize

                                                                                            36KB

                                                                                            MD5

                                                                                            68928c8c345f70dd17d4aae4bbcf0254

                                                                                            SHA1

                                                                                            40f7183cf7b9fedfb673ae01cdde63eaca6a677b

                                                                                            SHA256

                                                                                            daa3ef3bd9ddddcaff3a1de407d82f16d4abfd905cff7fb17a64990282de64e6

                                                                                            SHA512

                                                                                            1c21cd736cdcf228ae0466cb5e2340ae306a3a7869db4d572e98e22cb4547aabb27474aa874cd876c7648aaa76562a66a475861eeb5f9ecb9212790cd03ce1f7

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                            Filesize

                                                                                            26KB

                                                                                            MD5

                                                                                            b14e9b45722a116a34a5bc212042d545

                                                                                            SHA1

                                                                                            7690ec0c6498cf1c32cac8c54430cd41ea4da080

                                                                                            SHA256

                                                                                            4cef4c871536b0608f4b9d54fc4f83178e2aefb1527175d557d183923804ad56

                                                                                            SHA512

                                                                                            3655ac46a77628cfd9940a957cc00cbd4707cc469bac19d982c117dc87d37a011ac5c599154b4d3bcb241df7b6c005f17235a14087de5d99cb4c9079da077daa

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe5f749c.TMP
                                                                                            Filesize

                                                                                            25KB

                                                                                            MD5

                                                                                            1103eac5cc6761b51e33acc036eb5a0c

                                                                                            SHA1

                                                                                            dfda16b8a867439e7e48cc20a8e4dcc9c4e189b4

                                                                                            SHA256

                                                                                            5eb1777aa4ef4817dcce761c506c044f6c87b74001660f264fe51550b661582c

                                                                                            SHA512

                                                                                            d5cabbc5f34b6af49739b43c5e9b7895d5f8ebf07569b49a099250598a20a41d91b3bd844cc4b8d6f678778e0913c4759db203ee66a3e9764b1b18d314316778

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
                                                                                            Filesize

                                                                                            41B

                                                                                            MD5

                                                                                            5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                            SHA1

                                                                                            d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                            SHA256

                                                                                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                            SHA512

                                                                                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
                                                                                            Filesize

                                                                                            48B

                                                                                            MD5

                                                                                            e57155b2b3bf998dc5dd1bf1be76ce89

                                                                                            SHA1

                                                                                            d8008f54739d646f25b37b0afbca7c902b6a7b97

                                                                                            SHA256

                                                                                            1f806649d62e22e46a668712a3587d848507f6ced48287ce78b41211e499917a

                                                                                            SHA512

                                                                                            5a26228f38c9b57caeca563b2eb089274e5436a64096554332e260c16c74a5754c5a9875cd61434ed768cbab03ef695d68e9921435a5d3f34fb74367703711b0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            284351b39e321627d50571fcbb328eb0

                                                                                            SHA1

                                                                                            c62bf4be1da8d41c964b4a54c88bbc6d1c6f96a5

                                                                                            SHA256

                                                                                            ea730b3b9db7a8890c6fe82aeea2125d85abdc083097ae54783f6b4e69224aa1

                                                                                            SHA512

                                                                                            735de0a8db721893e5f52eb59129c16658a8b3c8775ce24e2738dc2a84424dafe9f7613c7ff10e439776cae78a8b7e60aac8877c5d3364e6236cfd0f98760242

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            0f400286de1b391c47766ac06e3f13ed

                                                                                            SHA1

                                                                                            cd0794cb8f50d58c1ad9fd61c14f991a7982876d

                                                                                            SHA256

                                                                                            8c27ae73d65e30b0931095646623726af40fc0423cd628f03231107ed987a686

                                                                                            SHA512

                                                                                            46905f3874cd4b3ca6710e2c575b172f3d919e338c9304a9ec6c347779b3308f98674642d5f098a4bd82ffaa9e7e8ac1829f46adb6cc539901af451c8ca45724

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582507.TMP
                                                                                            Filesize

                                                                                            873B

                                                                                            MD5

                                                                                            85436e2b80727959a1d00df5b2c53fa4

                                                                                            SHA1

                                                                                            face0b550b75f7f2b0dfba6094b024fbb1ab34a9

                                                                                            SHA256

                                                                                            4abaf115c4557e43b67da982c5e6ec2f8487acd812b8fe0d5e6c5b0d1bf5373c

                                                                                            SHA512

                                                                                            8e7fdc8fa595087f1aeab591b2e104bba788d478495c7c088ddf5612f0e0c6733d0034efc2139ba0086edcf91e6f12f84a6a3e9e88899f8aa7751c51da1fc915

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            46295cac801e5d4857d09837238a6394

                                                                                            SHA1

                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                            SHA256

                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                            SHA512

                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            206702161f94c5cd39fadd03f4014d98

                                                                                            SHA1

                                                                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                            SHA256

                                                                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                            SHA512

                                                                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
                                                                                            Filesize

                                                                                            16KB

                                                                                            MD5

                                                                                            9a8e0fb6cf4941534771c38bb54a76be

                                                                                            SHA1

                                                                                            92d45ac2cc921f6733e68b454dc171426ec43c1c

                                                                                            SHA256

                                                                                            9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

                                                                                            SHA512

                                                                                            12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
                                                                                            Filesize

                                                                                            1.5MB

                                                                                            MD5

                                                                                            29d482eb9e0ca26ba7c1a2b8e861b893

                                                                                            SHA1

                                                                                            115d33af630e9a62818e07dd71abaccd2a11ff22

                                                                                            SHA256

                                                                                            a3724d8cc979716aab5cb0a967f7298cb2a269280994b41104d7b1e535b64f2d

                                                                                            SHA512

                                                                                            f0cee5cea174f43265cfea48447686e0fc32e89bcf8fe163ac8ed234603006795502a5b0d8725c6ad41697a8d4786b79ff94b990ff9f325f3ec62432038b93ad

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db
                                                                                            Filesize

                                                                                            16KB

                                                                                            MD5

                                                                                            d926f072b41774f50da6b28384e0fed1

                                                                                            SHA1

                                                                                            237dfa5fa72af61f8c38a1e46618a4de59bd6f10

                                                                                            SHA256

                                                                                            4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

                                                                                            SHA512

                                                                                            a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data
                                                                                            Filesize

                                                                                            24KB

                                                                                            MD5

                                                                                            c7814bf9b09c8786277e50d1b54c800e

                                                                                            SHA1

                                                                                            b109fd135dcee5a103663e3adcc3a5cfad793d78

                                                                                            SHA256

                                                                                            a87af2e2776538f555584cccf03839577c5e60e273142c69d90447c6e46117bf

                                                                                            SHA512

                                                                                            3b804cc781ad86354ddb0255b4fbf3d595469d60c14c83f03dfc1f36fb9a909d2df22713ce99255ff4b2717e3d4c6b93ad4499de5372ecbae27bbe9e61447cc5

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            0962291d6d367570bee5454721c17e11

                                                                                            SHA1

                                                                                            59d10a893ef321a706a9255176761366115bedcb

                                                                                            SHA256

                                                                                            ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                            SHA512

                                                                                            f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
                                                                                            Filesize

                                                                                            120B

                                                                                            MD5

                                                                                            a397e5983d4a1619e36143b4d804b870

                                                                                            SHA1

                                                                                            aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

                                                                                            SHA256

                                                                                            9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

                                                                                            SHA512

                                                                                            4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                            Filesize

                                                                                            11B

                                                                                            MD5

                                                                                            b29bcf9cd0e55f93000b4bb265a9810b

                                                                                            SHA1

                                                                                            e662b8c98bd5eced29495dbe2a8f1930e3f714b8

                                                                                            SHA256

                                                                                            f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

                                                                                            SHA512

                                                                                            e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            517ae2f6bb3b958ad16e37665563e3e8

                                                                                            SHA1

                                                                                            c29bfc94783c609b010ba15546438f1393a59807

                                                                                            SHA256

                                                                                            5a8604cdfe05ec0228903f56bec89ca0293baaa8684f0194d4aef855d05cea37

                                                                                            SHA512

                                                                                            5343f8f9a013eb281ddd3d403308f9d58694a531da984022499d1bd91e6b5722c5beaafd8a357bd3d8c1808860e94361285acfd58ee8ea93c6599b3031e27627

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            a903b6955ecb93a83d4a3cae2a80c25c

                                                                                            SHA1

                                                                                            5f5d3d402c3cd87a8f84dd2098d09b09c8f5a9ce

                                                                                            SHA256

                                                                                            3e728b72d8e42868f904397f3a9189fdd8bca0f3960da0087a827999fe122a64

                                                                                            SHA512

                                                                                            3070b6841a8ab5cb338805451c4dd9cc1f46390e40900016fc0f6eddc73333babf8060ed9c9ca76e06f6fb7b33a308951180b677fb61ac8555adec00d4c8ed06

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            c9e2a55a643a2fadd52825b0ad247800

                                                                                            SHA1

                                                                                            3a25c37a5ca76e0496d45c70a1f045c4e6d10f56

                                                                                            SHA256

                                                                                            7566e660cbf3ab4bdd9e4595bda4884c220c784137e5c363d08d6b7d4ee2be8f

                                                                                            SHA512

                                                                                            d47d8a69e4295c7dffc0a8a2ebac478b95c1ec350a18c65aa4534f37314c531bcae3e0f6a1dbd2484e8f22066de36c7cc972bf2f554ddfb684b8de257806c19c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing Cookies
                                                                                            Filesize

                                                                                            20KB

                                                                                            MD5

                                                                                            22be08f683bcc01d7a9799bbd2c10041

                                                                                            SHA1

                                                                                            2efb6041cf3d6e67970135e592569c76fc4c41de

                                                                                            SHA256

                                                                                            451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                                                                            SHA512

                                                                                            0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            cf89d16bb9107c631daabf0c0ee58efb

                                                                                            SHA1

                                                                                            3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                            SHA256

                                                                                            d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                            SHA512

                                                                                            8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                                            Filesize

                                                                                            264KB

                                                                                            MD5

                                                                                            d0d388f3865d0523e451d6ba0be34cc4

                                                                                            SHA1

                                                                                            8571c6a52aacc2747c048e3419e5657b74612995

                                                                                            SHA256

                                                                                            902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                                                                            SHA512

                                                                                            376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            41876349cb12d6db992f1309f22df3f0

                                                                                            SHA1

                                                                                            5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                            SHA256

                                                                                            e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                            SHA512

                                                                                            e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be00d14b-b63b-4e5c-b9e9-95c59367a886.tmp
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            fcee4e115b3178587f585817dc476a68

                                                                                            SHA1

                                                                                            acecd2a29fe5b8004956549820ada0bcdd0cf2b6

                                                                                            SHA256

                                                                                            97fd7700786b3821362ec6615b32d5731fc06697d2ac101e414ea928e1fa60a2

                                                                                            SHA512

                                                                                            1b97573d33182881cacbd8ec9e915f795631969c7ce5ebd6e3bfc848c4099b54f1d90411ba9fe1a83770c77c110ca9b61cbdac759d73929b5ff87617d71489b1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
                                                                                            Filesize

                                                                                            4B

                                                                                            MD5

                                                                                            97c830c538d225ab6750f6ea423343e0

                                                                                            SHA1

                                                                                            c6009e0d07257423ed1ea6ccd019c72a69991371

                                                                                            SHA256

                                                                                            1fd269a6e96dfd872dd405946a45ba2987ef9302aeca66055e08c3b88815f9b9

                                                                                            SHA512

                                                                                            8c3ca0e0d963bcd2f58dd213e4f6fd53bc16bce111e258eafcbef6581106748d0ed69c40199fd33169fcc9428fc31f7385ca302c8026c7e61b248506fd33e8e2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                                                                                            Filesize

                                                                                            1024KB

                                                                                            MD5

                                                                                            749d408a627b90e524819b42aca07b45

                                                                                            SHA1

                                                                                            241f5c6bb141450bce999aa2b98327764c933665

                                                                                            SHA256

                                                                                            0ae92a30e61d4baaae0e0c02a7b896a008612a98fdc336dfc13be6b28bae1829

                                                                                            SHA512

                                                                                            a24d889d82587a591a5cff976f4bd6acdee928c2bb8b1c9b555b4c0c3373ef3bedfabdaec360004e59e98dc0c807b7ce96ae6bd5fdea41fa8ec47e10bafcec4d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                            Filesize

                                                                                            24B

                                                                                            MD5

                                                                                            ae6fbded57f9f7d048b95468ddee47ca

                                                                                            SHA1

                                                                                            c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                                            SHA256

                                                                                            d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                                            SHA512

                                                                                            f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            db78d0e7a576778b07c444f77b9bb99f

                                                                                            SHA1

                                                                                            be72067d1be19858f50a5ca7c87ef56ca266731c

                                                                                            SHA256

                                                                                            c0a9984df734dd1b09b8f3d395c59a499400b00e8200c63fdba6377486351d3c

                                                                                            SHA512

                                                                                            b541cb37b5b4439a95ed3f7b9b91da351596fadcb7a529b3d092cd452c9aac9403e5fb553fce58418957e9be754b5c307be30b731fe7d35ab78023c9504a00de

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                            Filesize

                                                                                            16KB

                                                                                            MD5

                                                                                            13a1721f4ac8f232197d25cb7227db45

                                                                                            SHA1

                                                                                            57cbede4af94d669351b4dbbc7e727d1633dd008

                                                                                            SHA256

                                                                                            cd7883b0c107c561a32a89995003c8a7a8850f5f470130a497d20c0d87858640

                                                                                            SHA512

                                                                                            070637dafa3efffb1657ca0d209c5378faf5ccfa760f0f1a9af2ee087280cc34bd12c9d3af21f81c300e7ee3178e5762135faf934d0b1a71557c0db8de6179ca

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
                                                                                            Filesize

                                                                                            17KB

                                                                                            MD5

                                                                                            80720fe0e0120e81341e7f6a74558ea6

                                                                                            SHA1

                                                                                            d8e4671fb8aeab3033cb8d74e65d3a176c0e13b3

                                                                                            SHA256

                                                                                            8242bd5da688ace1aad7dbaf274d877bf5e3d1ee068cfc765d114a59978b51e5

                                                                                            SHA512

                                                                                            cf3496cb9d46e41d4a9ca9385696a137abaf66822ed138c63353096dc0c30d5cce4ff89d346bd6f4d54e806ced98c10e1290ee985e58d5985f52e6d1f4131862

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            ac98e452e0b8b8d63fe1785a2014b10a

                                                                                            SHA1

                                                                                            c7f886fee377e5013c8010aaa8e2def8c6efef37

                                                                                            SHA256

                                                                                            54445dae22a20ca03b43f05032aa457b387ed6124fb88c24761e054d7604af57

                                                                                            SHA512

                                                                                            e934279c649934f24ae7ad298f6b81694b93b66e3ec0acbb8747bde51240ce28ef841f13500a22b560556ed182da09beb43709f1600c10eb7d76ce11851a468b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
                                                                                            Filesize

                                                                                            24KB

                                                                                            MD5

                                                                                            2d38cce0584a5e1aecf48fab09d8c432

                                                                                            SHA1

                                                                                            21db239eb862d0cbf1f5d1f06bc180029f3bfee3

                                                                                            SHA256

                                                                                            c69f2b9d0d0c65f644e4722ec42204f71f01977e4e2052650d4d766e88268fc6

                                                                                            SHA512

                                                                                            c87479a91d67fae77593e926f5a067b90b4afca863815fc2eef886feaf2e633cfb2bcffff3395b16c957dad910ba026f0967d7d053de7b02c5f54d9659896a4c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\895c01f2a97c8e5b030d6a8ded574f02.bat
                                                                                            Filesize

                                                                                            134B

                                                                                            MD5

                                                                                            5f9531d30f1404d9441eab4ba8bf812b

                                                                                            SHA1

                                                                                            ea1ce8870e6c10a64eaa87153d1e6f91036ea669

                                                                                            SHA256

                                                                                            474379fb0ef61f6881c498bed88bbcd1dc60c0438a4e8d68335771676235530b

                                                                                            SHA512

                                                                                            13c7755bfefb4686b5a46b52043e9bab955abb16e4316c621e02f44572f2e68ab4698e247eba6a2a8324488ec933297e25da0b03adcf822189b3cdbf0367ea2a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5riziu0d.tzd.ps1
                                                                                            Filesize

                                                                                            60B

                                                                                            MD5

                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                            SHA1

                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                            SHA256

                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                            SHA512

                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3007475212-2160282277-2943627620-1000\83aa4cc77f591dfc2374580bbd95f6ba_4880fff3-ce96-47a8-956d-b60b04225313
                                                                                            Filesize

                                                                                            45B

                                                                                            MD5

                                                                                            c8366ae350e7019aefc9d1e6e6a498c6

                                                                                            SHA1

                                                                                            5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                                                                                            SHA256

                                                                                            11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                                                                                            SHA512

                                                                                            33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            115daaae70ebdd84bcb5dd0615c28ee5

                                                                                            SHA1

                                                                                            a10ee70461447b573b8ba4d61970d571a43784e8

                                                                                            SHA256

                                                                                            ae98b4a4e744777bb3d7e62a6b49291c8775577e226e31ca322a9299621e2f8d

                                                                                            SHA512

                                                                                            d2f077c2f2631b1857d4c2ab195440a377de7dc7c69a0494d334a3e2f2380c60761b74bd17c9e7b1d6ad8c769b367c59a1f679f168ef416eff8fc7e2586f1b78

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\Client-upd.zip:Zone.Identifier
                                                                                            Filesize

                                                                                            26B

                                                                                            MD5

                                                                                            fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                            SHA1

                                                                                            d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                            SHA256

                                                                                            eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                            SHA512

                                                                                            aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                            Download Submit

                                                                                          • memory/1228-508-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                            Filesize

                                                                                            272KB

                                                                                            Download

                                                                                          • memory/1396-771-0x0000000001220000-0x0000000001221000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/2148-909-0x000000006F530000-0x000000006F57C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/3672-664-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-713-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-538-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-576-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-580-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-585-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-601-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-608-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-611-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3672-665-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/4372-740-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                            Filesize

                                                                                            272KB

                                                                                            Download

                                                                                          • memory/4656-689-0x0000000006F90000-0x0000000006FC4000-memory.dmp

                                                                                            Filesize

                                                                                            208KB

                                                                                            Download

                                                                                          • memory/4656-673-0x0000000005460000-0x0000000005A8A000-memory.dmp

                                                                                            Filesize

                                                                                            6.2MB

                                                                                            Download

                                                                                          • memory/4656-699-0x00000000065C0000-0x00000000065DE000-memory.dmp

                                                                                            Filesize

                                                                                            120KB

                                                                                            Download

                                                                                          • memory/4656-690-0x000000006F530000-0x000000006F57C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/4656-701-0x0000000007960000-0x0000000007FDA000-memory.dmp

                                                                                            Filesize

                                                                                            6.5MB

                                                                                            Download

                                                                                          • memory/4656-687-0x0000000006000000-0x000000000604C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/4656-686-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

                                                                                            Filesize

                                                                                            120KB

                                                                                            Download

                                                                                          • memory/4656-685-0x0000000005B70000-0x0000000005EC7000-memory.dmp

                                                                                            Filesize

                                                                                            3.3MB

                                                                                            Download

                                                                                          • memory/4656-676-0x0000000005B00000-0x0000000005B66000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/4656-675-0x00000000053D0000-0x0000000005436000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/4656-674-0x0000000005230000-0x0000000005252000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                            Download

                                                                                          • memory/4656-700-0x0000000006FE0000-0x0000000007084000-memory.dmp

                                                                                            Filesize

                                                                                            656KB

                                                                                            Download

                                                                                          • memory/4656-672-0x00000000027C0000-0x00000000027F6000-memory.dmp

                                                                                            Filesize

                                                                                            216KB

                                                                                            Download

                                                                                          • memory/4656-702-0x0000000007320000-0x000000000733A000-memory.dmp

                                                                                            Filesize

                                                                                            104KB

                                                                                            Download

                                                                                          • memory/4656-703-0x00000000073A0000-0x00000000073AA000-memory.dmp

                                                                                            Filesize

                                                                                            40KB

                                                                                            Download

                                                                                          • memory/4656-704-0x00000000075B0000-0x0000000007646000-memory.dmp

                                                                                            Filesize

                                                                                            600KB

                                                                                            Download

                                                                                          • memory/4656-705-0x0000000007530000-0x0000000007541000-memory.dmp

                                                                                            Filesize

                                                                                            68KB

                                                                                            Download

                                                                                          • memory/4656-706-0x0000000007560000-0x000000000756E000-memory.dmp

                                                                                            Filesize

                                                                                            56KB

                                                                                            Download

                                                                                          • memory/4656-707-0x0000000007570000-0x0000000007585000-memory.dmp

                                                                                            Filesize

                                                                                            84KB

                                                                                            Download

                                                                                          • memory/4656-708-0x0000000007670000-0x000000000768A000-memory.dmp

                                                                                            Filesize

                                                                                            104KB

                                                                                            Download

                                                                                          • memory/4656-709-0x0000000007660000-0x0000000007668000-memory.dmp

                                                                                            Filesize

                                                                                            32KB

                                                                                            Download