Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/08/2024, 22:42

General

  • Target

    c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe

  • Size

    896KB

  • MD5

    895e203a2b0491b4aaf67903e1c5d671

  • SHA1

    ec65e79e969f39f911569fbdfe88d69b6407d721

  • SHA256

    c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86

  • SHA512

    4db7e4de5f4f1acc1ccf6ab4bd9f09a2a550eb5e10ff3e916d9b99aa5984246a6d7aa0b717d70ad1a2fe774edde227ac609339ab2b9956bc22589899162ba924

  • SSDEEP

    12288:eqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTf:eqDEvCTbMWu7rQYlBQcBiT6rprG8avf

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe
    "C:\Users\Admin\AppData\Local\Temp\c4d8ceca57eca8abda4e05a78bfaab5c520595cc4d306d70b1c16575997eee86.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff74d3cb8,0x7ffff74d3cc8,0x7ffff74d3cd8
        3⤵
          PID:3380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
          3⤵
            PID:3960
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2312
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
            3⤵
              PID:2476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
              3⤵
                PID:4996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                3⤵
                  PID:1904
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
                  3⤵
                    PID:4184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
                    3⤵
                      PID:2256
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                      3⤵
                        PID:5204
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                        3⤵
                          PID:5200
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2388
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16328793110000758119,6145838316927244267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4736 /prefetch:2
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6856
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:980
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                          3⤵
                          • Checks processor information in registry
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2772
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4304420f-fd9f-4d51-b2bb-bfae35494cca} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" gpu
                            4⤵
                              PID:2904
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b325643e-c879-4161-bee8-faf1e656d027} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" socket
                              4⤵
                                PID:2136
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3032 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdf089e2-bf20-4601-a77b-901f8f6e63de} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                4⤵
                                  PID:908
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44470310-3c7e-492a-a134-a75d9f9cacf7} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                  4⤵
                                    PID:2840
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4224 -prefMapHandle 4032 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2be125d5-35ed-4baa-b0ec-067245238cb6} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" utility
                                    4⤵
                                    • Checks processor information in registry
                                    PID:2360
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 3 -isForBrowser -prefsHandle 4292 -prefMapHandle 4368 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9d8d4f1-a1ef-4bc7-afff-cefd746165f4} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                    4⤵
                                      PID:2580
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5720 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {971251c0-020c-4d52-aeef-a6fc88ba4cfd} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                      4⤵
                                        PID:1720
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5920 -childID 5 -isForBrowser -prefsHandle 5840 -prefMapHandle 5848 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be0ea996-a4ab-470b-b3a8-56e9570b06c5} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                        4⤵
                                          PID:2132
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 6 -isForBrowser -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94cc4859-9a12-41a7-b9b6-1d65624aa0db} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" tab
                                          4⤵
                                            PID:5132
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:1944
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:1112

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          a8276eab0f8f0c0bb325b5b8c329f64f

                                          SHA1

                                          8ce681e4056936ca8ccd6f487e7cd7cccbae538b

                                          SHA256

                                          847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

                                          SHA512

                                          42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          058032c530b52781582253cb245aa731

                                          SHA1

                                          7ca26280e1bfefe40e53e64345a0d795b5303fab

                                          SHA256

                                          1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

                                          SHA512

                                          77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          336B

                                          MD5

                                          6d9f5b267a01d6c508d898b816d4294f

                                          SHA1

                                          d7fff7736f8eaca3b670ef0ee0e31d9152bbf712

                                          SHA256

                                          70ada56425a9ba9c3a0f741a2eb4c427008dd38bc3889b627ef838790e23ef95

                                          SHA512

                                          cc60ce6882fc43add36b849213af3ca07cf315a014a0cc32a891e6fee98cad81b50485f6f5df1d6ab284a7102e80757c9d3e4e39e0d43e41caf74cd3d2fd7d90

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          934c0d4ee628dee1e687a0e0490f1eaf

                                          SHA1

                                          4bfb96b199b61f880a44aeb0a740ee8177304b40

                                          SHA256

                                          560a9cf5b23838e1e7a68e3fb85f05a381b14f031780ec02f68307c10b5f0f19

                                          SHA512

                                          1dcc2d4c384b4c89212ee496d720a90f5e8c273ca1890ab3b9a2efe46ee3f331a95bc8758c2b472c317dcc976b7d58a13bb66ba0d018080107d3f8289043a203

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          763976fb12de51c27faf87e7006ee948

                                          SHA1

                                          0d63a0a87c318480b8fb89a1d8e17e61a23ed1a3

                                          SHA256

                                          977e2a77353918222c39c5c6fd1062d11147ccd94f2413703a0e007c255deba7

                                          SHA512

                                          21c62f7acf5847cee4f73021b5287391fea23387d63662328a04958097cadb0e16b0c68f272e086798891712bad0ed4a05a0185243a858fb0b63f2a838451ae5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          e96fcfcfdb15bb21283359db6ba9c198

                                          SHA1

                                          2dd4bb02f2236b9071ca61caa0096f5a5d951056

                                          SHA256

                                          cf5a5efdc89fd6eade4b96da6bd7371cfe4cf214c097474b2f224aa7171cc3d3

                                          SHA512

                                          a0e4e6e98add2c04868c489bab8216a8f60b97f42da62ec06c56b88ff167a1e9e3a8e9259a44f72d39731413e95c216c6e1db3af2808c6155dde9dac11a5d996

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          644160ed473d991e1f1a2c502f17bcdb

                                          SHA1

                                          db7f643d252c4b9798c0e364f172cbdbce2a9df9

                                          SHA256

                                          92321dca3cb4a6bea312e40e2404e820783349744af66581a2a6e87c6855ce2a

                                          SHA512

                                          08656ba5f85c097c97984c65026d3b49c186399b31e245fe85154cd12e5a5ef7bc09f5796d1c9e55f2cd534841885f40eecebbd4880776e217534f7053fb304b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          37f4f1e126ffe28e421bfc04c40ce3e1

                                          SHA1

                                          8554a48d53c26021a5c2194e07606b60f42b92fc

                                          SHA256

                                          536ac20250951d0d9c2a1ea728c05dd8466ca1f55cb973b214950c8214709a03

                                          SHA512

                                          64917dfaa506e23fb13097a08e4b94b809937e0469a33548bd4ce298d01644784ef3d48a98c70245488daa82cc08a71c28611a7272c148a69020de4d0514be6a

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          0e50dd0a84a7ff1a870cca60783403f5

                                          SHA1

                                          f050ae2727929962871896e4d0eaf8ac4770296e

                                          SHA256

                                          103a9799502f03dd6234981120a4979429f2c59b574720d1b7c7feb100f198b4

                                          SHA512

                                          0d6065ab27f464d2619164e7fc9997f404a4936770df443ff0b39846a786a5b6b536aff1adad07fa33aa2cb49686c9050f95e50b78d4bb0e87eff0531c06f435

                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json

                                          Filesize

                                          45KB

                                          MD5

                                          b4d77c68ac70af6624bf8920a57573bc

                                          SHA1

                                          b1bd7dad1256df8e326ab457da0f409cec06f7e1

                                          SHA256

                                          624fc8b2458708441daed3759af597d8a9c4ea86661bf390dce9f112e90e926b

                                          SHA512

                                          1bfdef2b06cf4d475816b313d9aa7da44da6f215699666d40401156eb42c756bb152a083d41fa7361d13d21bcb4bb5489b23b152bdc8b50e008b4f585e100009

                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                          Filesize

                                          13KB

                                          MD5

                                          9ea91e9c50699cd91dc9b09f4f9962ae

                                          SHA1

                                          d99211de418974785e7b3e44e4b0acc44dc5b86a

                                          SHA256

                                          8e09d2fb0884d009952cdb2e02b0c2b6ebe2e345d77538825016ca0f686c3926

                                          SHA512

                                          8665051d70556ec493653a55d7d1ff950794c417654166f615cc5fc664945659e2d91137bfe8969d0259750e24d779a60a5a52bc188182da202d40647eeb32f2

                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                          Filesize

                                          479KB

                                          MD5

                                          09372174e83dbbf696ee732fd2e875bb

                                          SHA1

                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                          SHA256

                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                          SHA512

                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                          Filesize

                                          13.8MB

                                          MD5

                                          0a8747a2ac9ac08ae9508f36c6d75692

                                          SHA1

                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                          SHA256

                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                          SHA512

                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin

                                          Filesize

                                          10KB

                                          MD5

                                          5add2212e7568d273eb5c9e73cd883f2

                                          SHA1

                                          1f50fccb416e9aadfff23b11909750f6f80d01a6

                                          SHA256

                                          cb7aa6f2f6e8585330cff66c675b8494b9275fe7928a4e3695998a831eb63f4a

                                          SHA512

                                          31805326a9f0dd66eb776e58705cd76399ef0b0272904af057e40fe07263f8dd43070c56c90bb6faffead713faf0a14e7e1ccee5249522bd2a31c0b96b90ed03

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

                                          Filesize

                                          5KB

                                          MD5

                                          b72b25de829447f3ebf5e9844b47311a

                                          SHA1

                                          80a76a59421148e54986d392cac700688e4cef40

                                          SHA256

                                          e2b69c23c44b81d43a5d5d69148504a1dbcb8c2f6b1aa9c971f7d14230f2fd02

                                          SHA512

                                          c6ba0cc2e208cd8ce819d5408729ec457728bee60a03fc2d79e66b293155fba25ee426cb84b9de70f77ab49178a6951e8be73d4da11de8b0cd0982fcad8f8c65

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

                                          Filesize

                                          6KB

                                          MD5

                                          fa4fc74dcf3a28416c821e42eb7e1ac2

                                          SHA1

                                          b37d8ad714518c330fc45b49fbc9e4dd9abe4cad

                                          SHA256

                                          e7088adfafe0f791de9a3808fd2c72d435020daf93c121a9e9adf070d80a5b11

                                          SHA512

                                          7079faf47caecf0a1b06920d151d3b38a98cd6fe8fd41393dd9817312c5511d0abfca9b2dd38535f8bace118f693f3ef53eef9212fe14a509681421aabef485e

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

                                          Filesize

                                          15KB

                                          MD5

                                          496a2503a913db0bc4f607d290f1b269

                                          SHA1

                                          0516048f7ee6cdf37bd07280f44ea99c3e8b1dfd

                                          SHA256

                                          54e0190ca89ab55355d2c208436ab36a3f85f4e122b2946004931521b71e8826

                                          SHA512

                                          28ac0359eb51e06388cca5b7a3ecefdef972a591400315f60d7e544cf0c940e964745ef6a48f43edf2143a3fb088b2832fd2c68d063d8558d11cc8017fd2c47f

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

                                          Filesize

                                          15KB

                                          MD5

                                          0b78fb9af2701808ca2e65795e19b509

                                          SHA1

                                          75e736140334d6ab80edf199a08d940281a8dbfd

                                          SHA256

                                          878bf82f2511b06c7c127393473b4385f7d0e0f7693eb5ff212af7803751a559

                                          SHA512

                                          6315620b657917ed1db1f3c8e64e63e22343fd64a7d125b5e9c37b1ca54a127e22b03053bb0a97a0689250f2c870cdacaeba4087a44c615895b19d09efdac142

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\25760a07-cc24-4148-8047-a3f82538c0a3

                                          Filesize

                                          671B

                                          MD5

                                          a37ed3956298831779d3573b7a713a7c

                                          SHA1

                                          047150ef7195c8118696e82c349cd145a148e900

                                          SHA256

                                          567ed899c869c1731ade913e9bb307a8bc629d9d5696f6592e206ec1244e9af2

                                          SHA512

                                          d9f6fad26cbfa2d46c42a78990f0345bafe0c1343f4dcb9885b46777ba1b024740273a717697b8bdd34b65b1c43c6a5005091e4c6c065b2318b1cb1ce520d30e

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\a7b9b9b8-6376-4fee-bfd0-393ee2e0e5a6

                                          Filesize

                                          25KB

                                          MD5

                                          b33a583cd184a9b0df9630d88212afcc

                                          SHA1

                                          b1bd155bca5af33f093be15f79a2b456e140b72a

                                          SHA256

                                          626c6fa8412a74e2c144d7bac75f95820f77c99b63fd019b040e143cc967dd0a

                                          SHA512

                                          863be38872c93796600d8e9d267fb06d915fd30003c088b2c9bb8f57b830a38694618c524f37f2aaa5d63392fcd0ba521db791b57e048093f37b6c02252ba970

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\ba39ae29-199b-4d41-b792-9570d78ced11

                                          Filesize

                                          982B

                                          MD5

                                          779523fdfaaf0093dbc1e30def8ff15e

                                          SHA1

                                          fa379de9a18d2fb6711b58eb998caa7443ee1344

                                          SHA256

                                          d96ac81cb2853a130524a666ef33fa3dd4e8cf50e1f05be4571fd968f65c62fb

                                          SHA512

                                          9672f9053d8ae5c8b5be7a7fbae92a2536c520dd707fda510c271d28272f95e71321a9e1e70e9fd716ed64adc2372837f729c4be9fc2d65c8063c2777f78af44

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                          Filesize

                                          1.1MB

                                          MD5

                                          842039753bf41fa5e11b3a1383061a87

                                          SHA1

                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                          SHA256

                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                          SHA512

                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                          Filesize

                                          116B

                                          MD5

                                          2a461e9eb87fd1955cea740a3444ee7a

                                          SHA1

                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                          SHA256

                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                          SHA512

                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                          Filesize

                                          372B

                                          MD5

                                          bf957ad58b55f64219ab3f793e374316

                                          SHA1

                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                          SHA256

                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                          SHA512

                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                          Filesize

                                          17.8MB

                                          MD5

                                          daf7ef3acccab478aaa7d6dc1c60f865

                                          SHA1

                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                          SHA256

                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                          SHA512

                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js

                                          Filesize

                                          11KB

                                          MD5

                                          fb4a8669d5e6767668a904774272f18f

                                          SHA1

                                          a43f07594188ba2c4c95743ca5681e63f2d2d99c

                                          SHA256

                                          78f0f203edc51a0a4506f7870d9377dcff35003c9772cf299237a0467d35afa8

                                          SHA512

                                          a948b69be6b581347896d1e22bd2383f759675c16d1ede9076100c33df9728f596a3b84f1a17374ae5d72d2c8c72144f54b36920dad799f3e50ad41e83665c24

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js

                                          Filesize

                                          16KB

                                          MD5

                                          1cb1e532b62bcf5cbcf69115441b0456

                                          SHA1

                                          ac4bbada59c4683d7a3325318dc58fda3eccfde6

                                          SHA256

                                          257450b0cc037ef7dfd1ac2f2a09a1359fad2871e57b571a07593677fd8f8dbb

                                          SHA512

                                          881c807dc781f5f6034c1cb27b104b338dd26c05ab754f1d0c501a3a519de24fb89fa23d64596178f5fc0baea885dced5ac87242a012dc2e816018f992a6f17f

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

                                          Filesize

                                          12KB

                                          MD5

                                          bddb2c8e9d2abb9252c1b3431bee9467

                                          SHA1

                                          e5c10ef7128114ff484b795ae92f9c577d3918c1

                                          SHA256

                                          fe52cd059a8f45162f343a9c1e7e4d8207872d5d4a3ce5f2551b435bffd219dd

                                          SHA512

                                          d5b6225411e51a0d7338ed51bb31d70ac65f526e828376c719b412b5185e64cb1eb143fae5eb575b20405bcdc30e75e165513ea497cd947beb93004c8e02cdb2

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

                                          Filesize

                                          10KB

                                          MD5

                                          fcdd8e8a331fb2fb0897c4cfdcc43e85

                                          SHA1

                                          0a049975da7db4b9795b7c25eae0bc10cf86480a

                                          SHA256

                                          95499ae3e58f42aff4bdafd07af6e75fd1fc0566d74694b92e159527509f97c9

                                          SHA512

                                          4174abd504e15b43012ffb78aa0bdf1540400a2ac4583848b8b72974759513411fab9b7a6ba2528187ba5e7204e03f17f9dbe62e38e8e305846b73332d8d6ea2