Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/09/2024, 12:11

240905-pcpkbazgpn 6

05/09/2024, 11:52

240905-n1xp6a1bmh 6

05/09/2024, 11:33

240905-nn4b6szhpc 6

Analysis

  • max time kernel
    807s
  • max time network
    809s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 11:52

General

  • Target

    http://discord.com

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff874146f8,0x7fff87414708,0x7fff87414718
      2⤵
        PID:3436
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        2⤵
          PID:636
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
          2⤵
            PID:2624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
            2⤵
              PID:448
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
              2⤵
                PID:2000
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                2⤵
                  PID:540
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4128 /prefetch:8
                  2⤵
                    PID:1700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
                    2⤵
                      PID:2660
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5020 /prefetch:8
                      2⤵
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5024
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
                      2⤵
                        PID:3200
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1332
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                        2⤵
                          PID:1832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                          2⤵
                            PID:4592
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                            2⤵
                              PID:3092
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                              2⤵
                                PID:708
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1212
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
                                2⤵
                                  PID:2140
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                                  2⤵
                                    PID:212
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8414662616435627802,7128118986805612929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
                                    2⤵
                                      PID:4364
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2348
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:2100
                                      • C:\Windows\system32\AUDIODG.EXE
                                        C:\Windows\system32\AUDIODG.EXE 0x534 0x518
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4492

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        eeaa8087eba2f63f31e599f6a7b46ef4

                                        SHA1

                                        f639519deee0766a39cfe258d2ac48e3a9d5ac03

                                        SHA256

                                        50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

                                        SHA512

                                        eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        b9569e123772ae290f9bac07e0d31748

                                        SHA1

                                        5806ed9b301d4178a959b26d7b7ccf2c0abc6741

                                        SHA256

                                        20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

                                        SHA512

                                        cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

                                        Filesize

                                        148KB

                                        MD5

                                        3fa8cb7f53ac0f3e21649403e737b3a2

                                        SHA1

                                        e6e6a2b566c84acba49dd66418cb0f2c2e02be51

                                        SHA256

                                        4d3d85bdbe619f9f1d118ab166a44b72d4372428ccbc90c46465eb69268350ec

                                        SHA512

                                        5cc19ca9a35772565c4e85c9416caab2b66b0f6461e2c00d7e729751f2b7bb63b8ebd0baa5f08e0bc342b0f22ee81c3e630c412ecdf61897a96a3c41811ed575

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        2KB

                                        MD5

                                        4184740804f2fc3c1fe0d1f4d59ebc94

                                        SHA1

                                        945ad6b99f51d2f4abd0c20a6784a84c94ef8b2b

                                        SHA256

                                        5acb52573ac201b705efaca096b479f2dfec261c24b84fa2eaa978664c94a0ab

                                        SHA512

                                        dae6adb380632a94e46f092156306a4e62beca79ab3df400ea2c744d420fedb984d80dfa7ce03356447777da58e9c0a569ad7de29f61adf04543d18e78301094

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        2KB

                                        MD5

                                        15b6e5372adbc8cd82100fa89808db4c

                                        SHA1

                                        e7a4eaf6299b955c4cf4e4d3ce33c7c032cd6422

                                        SHA256

                                        bb5fc415ffeb1b6cb4666b931fb0b0402df18f6d7fccd30edb660a15fba0ae97

                                        SHA512

                                        ce32615fd63d4b023bfc96fd28a605013ad94ad35617ae40577f85ba434c5f8601cbe7f8760d14ab969f14632c926b35d3789a2acd17695ca2422e6fa30dea67

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        2KB

                                        MD5

                                        b7c7bdd9ef44f7b47b6cea785def5fa5

                                        SHA1

                                        79b2fb53519f7d9c3159100997f381380c0ca48e

                                        SHA256

                                        9ee7f13489d0098efb3dcb486b6017b1c43f5b222229969fc4b812698dc65271

                                        SHA512

                                        2235c541388d0ed82e9491459d881260bb7460b5ce5dac8088b44ec65e2483b1ffc9c5a42de48957d4c43a74fb7f861b81efb8fc6d9ac3a0cbdc502b8a25c676

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

                                        Filesize

                                        96B

                                        MD5

                                        56990d310f04cbacbe3de90928ed46d1

                                        SHA1

                                        cd6f776991c585dd5be61e7894ed603b983b6c25

                                        SHA256

                                        814824fb78afd9a5ba6a7ba27652d2fd97525f2441450747a3340ab0e218c8c4

                                        SHA512

                                        2a59d70bcf900a1a6b094b9de61632f353f91218bae27d51d61db6199c41b9677cf9c53d45e10b87c254d081a73fc3f05a501664aab556e775801ecb49e957af

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

                                        Filesize

                                        96B

                                        MD5

                                        d9dc1f5e387b9ab18dd67aa6870f2983

                                        SHA1

                                        6d7e70324cf77b91b869a6c7f808affcab584e33

                                        SHA256

                                        6ce939639cecdccb618ec8927c4e950c0ce601a68f396bb8ee88e5da9b63421d

                                        SHA512

                                        411500f05113e45174314aef120ab02e460a70b802ad52678c8fdf0cc7b189d2d4a885b5060ac69552eb37befaf9ee7dc5315378a74f3e9c7168669b38b5ccb8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        1KB

                                        MD5

                                        7b077248214b87f0d1425cd57bfd5a21

                                        SHA1

                                        f2fc325a88069948d73835dfb9117711933d4ff1

                                        SHA256

                                        43eb99bb778ce25493e17c57f605b4e46dd6d6323b194d3ad24eba69aa7244b5

                                        SHA512

                                        4210754ef1c74a18d4510384074671affdc9f6d178bfec3f7382c577a7c9b4de4ac9de804f2aab1d36acb00b3d813fb225994b53fc329c1c8932f5f2136c6b0c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        111B

                                        MD5

                                        807419ca9a4734feaf8d8563a003b048

                                        SHA1

                                        a723c7d60a65886ffa068711f1e900ccc85922a6

                                        SHA256

                                        aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                        SHA512

                                        f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        111B

                                        MD5

                                        285252a2f6327d41eab203dc2f402c67

                                        SHA1

                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                        SHA256

                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                        SHA512

                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        1KB

                                        MD5

                                        6a764d447434a70ffb8246aa94f6e316

                                        SHA1

                                        307dfdc05f94dce40285c30ff4953b85af0906ae

                                        SHA256

                                        f76620840ac92b22c24bcc931d8495e2d0ce4e98d666a86f6931d89276f065ea

                                        SHA512

                                        18f524c28fcd1355e5068e789d2492395c7614bc588266bfb953cc2f1a28ac061c7de714bd6fca9b0664a164b25d8f792b5e3a167722f86c9a43587fc702d806

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        5960975a3f11dca52d47bcf420967b52

                                        SHA1

                                        f49011a313d34c9e28e62ce3162a604a8b3592e4

                                        SHA256

                                        a67b6a0c4e08901be4e5144ea22652717fd8149b83db4f2549dc46a47e568ba4

                                        SHA512

                                        476b2c3c8f2d561b50f01621525dfe2e97f0bcf585847278e10285528ffd2e96a041792f4b89392f599b4f7ac826efb8aecb42a12a75585eaa3b12f08477be8d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        b1866362d3bf6bc6d7b823ebaf5db684

                                        SHA1

                                        5529a7e1997f2f36ad9500a69e0a36158bf70dfb

                                        SHA256

                                        462999fc9642477c6abcb5adff66b31dbf4807db94f88072e7fc7f122975f517

                                        SHA512

                                        fbd84ad987f8453ae5723ae7b114339b62c06a1cb2af7272c33ac6053339041512603356f77ec5f5d4e946e2bde40bd15e79f75dc5de428fc03036bcf8819944

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        8840add0691a42541d96ffe06238f709

                                        SHA1

                                        ca289d66b050694115485f6f47fe5bf4ce9aaf18

                                        SHA256

                                        5558b04627687812890d19e07965349e0803d1c105db256bb62f5d4ea757869f

                                        SHA512

                                        87ed459726d4f699eb7c3579c76c24825314e5e435d8da6a2b096bc445117f9b6d1a79fefb57c14548bc422912860a85e63473cc573bf726a34302fd4e4bbfde

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        e75a0488baffe36dd7e39f19e446927c

                                        SHA1

                                        6f5c3282b49d6eef95efa63e8c789b919eb936e8

                                        SHA256

                                        3bfe41314a148efc19faa53c401e2e8b482ef9f218cc43e1ccb7bb93c678fa59

                                        SHA512

                                        422ef2aacf3c372a2f28adcf1add4094b275ad5382386a9ff5a9f8253d76e32021a4bdb88c4cf9037a008d0e40505d999cd9695145ae3b31aada0323687d0b64

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        d4d1668b82da98ee9d14f555f4572215

                                        SHA1

                                        88597e883acc3cf317f0d2d3279db8612237fce5

                                        SHA256

                                        6a898976502521f345cdd1c48633f5aa13aa3d81e6af2bb25fc6fe7a67e8e655

                                        SHA512

                                        6f92ae2c1d190521cc0d12d27f81a20f6a0887ac0f9834003ec2c552d2d4ceb9f5251c930844aa9d80a5d57012eb4232bf5d5cad9a80eeb85b8cfbed28d8b305

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        aa5f6d19c599a2add333d3ee1b35c891

                                        SHA1

                                        9e75b0664cb671518d2abe17c0b80b2766c4dbe1

                                        SHA256

                                        b1d594b56a907e22008bbf257fab497d243a457100ad16c1ae8c18bf0a3ab96e

                                        SHA512

                                        d5297485bc8838853baa18908645b0dd05739f5179deada4ed813fb6e58c068e897ea7e8aa3bf808570d134cfdc89b59f7f0acbf62958c30370fa7c7b611b994

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        4acd2fb755b0ebd39ca1c1f5f7f9d908

                                        SHA1

                                        73df87a8fa45bc39b084258c67defb8d7822273c

                                        SHA256

                                        0c6c61768b8767ffc867c6483d253d92fcb9dbcb4414bbba79cf4e4de4b620a0

                                        SHA512

                                        118ac297e9f6c1a0b5002480aed3d38627432f3bb5674a77258f9948c34c74f3b508f7527256f1ef643d2140f8e734aa6a03f5db83d1105941137394afc97d57

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        869B

                                        MD5

                                        3c233940c12c68d07399c350937893c2

                                        SHA1

                                        96c31f8be9facf993db594cfd8a77dfc99d7b0b1

                                        SHA256

                                        376d68ef3fdcf2a2f6e5b10aedf923f53ddcbfdebb196cca19bdd1870bacf947

                                        SHA512

                                        9787db21a91ab4e0389e782ce43e9b7c35c6a9b2f58b865830a0229fa03824b1c5a7dbd51c8e16bd299facd9401e72fe48ba1e31cd80623fb36b33345d5b2247

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        869B

                                        MD5

                                        bf0a03be597093ed74726e9301199644

                                        SHA1

                                        e4eacfce4dc17ac916889d0c19165388be318746

                                        SHA256

                                        7fe42fca4c7fed4235071e2440b490b5106bcd09c3e1f7ccf1dc7f2ad90d0833

                                        SHA512

                                        9f0e25d3745356241b42923ec68260af432dcc303e07a991d97f509c72cae95284593fc4da026274f307058fcfad5c0f948d838bec8b9c7df6468e9453c2b785

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        869B

                                        MD5

                                        ba03f9e587c6dacc96991efc749300d7

                                        SHA1

                                        02163e1c7c1e4aef70f78203ce7ce3e44744cf45

                                        SHA256

                                        bca3182bd2446ed87e19e8aa71bc8663997fee57e6115e0c275dfd3db0f76cb9

                                        SHA512

                                        47261d3335741a43838642a9bfc76e89104bc6615489bb5941bc13cd932fdd548af2a65a4f0aa28f0f79471ac9c9a1241e208d20c3fce2658701837a0951eabe

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        4879f63d70217906dbb2751e2bbb188f

                                        SHA1

                                        c00f9b2b7f257b1abfb4ba72abcebf316d598e87

                                        SHA256

                                        276e5e6936d17b1ef392bc17db3a50d63391f4e8c73b951a4a837b61dcad7fae

                                        SHA512

                                        1b2315fdf418dba5e5daba8b503d626ccd0954ffe48ea973ad76958e2e297f97a0f79c7e201baec472d717d68e3b9459464d7482d7bf05da46c83a45189b54c9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        869B

                                        MD5

                                        4258ac8c04d3402829f057d9e687f45d

                                        SHA1

                                        321f85cfccffd267409113115450100258c76c56

                                        SHA256

                                        ec17d6f1f34a4f3c17ec9eb6f5c631f2aea8bc1f771462c0dcca94169ba8078c

                                        SHA512

                                        e5c06dc957e3361beb04b27087db6bfeba6801818d750b0c8f435e387a7da2f0ede916e6883094ebeca01122a2423fabecf6de255a0f986810252b70083e1d22

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        2adc2d6670b140eadd88fe1d13e07f81

                                        SHA1

                                        827f91c4e2e0d36237f103cc5e4fa83a36cbe03e

                                        SHA256

                                        4c55a5652862e421bf7c8fe5cff427f607f2870581cab8ae45b5fa6f39bee0c5

                                        SHA512

                                        0f2a9411d28648cf2db3bdf28e994f8f05dfd3334148e2ec5d9b3ebc923336cde4d50b90e850aae54ade9bc7f8fd0a62d32ca1a115538da56b4081e2162b69f6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        551086da134f39f1cfa0bfdb71b87142

                                        SHA1

                                        1a4f8b5a7c2762676e07dad0a0cc522d02fb9fbb

                                        SHA256

                                        b2517ab4784c1c5c70b33bb8bcec4fbc4be47aa94eb2f62e94b8ab4ec56e9272

                                        SHA512

                                        1f8358cb75155960431f37eb6473a496adb0eba4ae4b09df21b511c886a52908faca781405e0f2ae752e349839bfa2a234dca7a56ce5fb48b0a974c5d1550253

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        cc3c7e29d94cd355a04a94643a6fc5f1

                                        SHA1

                                        87235b8bb42cd916f8de7cd5713bff1866a8eafe

                                        SHA256

                                        b62bb98a7f4a81562bb17950c5b2964877e1b2257a17083aded62e6b50ace2d3

                                        SHA512

                                        1292a22fd255784baa65c9653f313b2f9495d007d70e22c5604f7d9d1a5e1bf49a1f7e63958cf8244d10ac16f6de3293e09ac366500829642541009ec668497f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        e48352214bf92891e1ce534af9162c44

                                        SHA1

                                        a29cb9c2a0d46fb9e09d7a7222e1d3d76f27c5bf

                                        SHA256

                                        a18618d42088a43069f167a686cabf460f8cbe0aea5853cad0c2045c02a14ef7

                                        SHA512

                                        d7e82e6336b89d4077f54f671ba9fcb41e9831de60abcdfe6f285ccdfcd055ac4dbcf52458833cd35e064cb7bec7b0b56f3226fc69cdb34c5b89abf0ad73c67e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        a0e6223e3173bedc3c1f27fdcd6fdb2c

                                        SHA1

                                        8569cabae3f6c278553e9460fcb69f19ce2c64a8

                                        SHA256

                                        b0d3611672b42f0539bfb484ce6d0ee891e42f639fb4de5418677d1ff5b8fa69

                                        SHA512

                                        088ebd86fb4427503bf97cdc9db9ff2a6c30ec75d5807cc8b6b3ff646320c50255253037f37d317752876f28ab1292ca1075f94d930369eb3b719288e40b50e8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        b8f239f009a26f2a272eaffe1aac3879

                                        SHA1

                                        7ebedf5ac11226e42aa8b213631b1a49d88feb82

                                        SHA256

                                        c103585a31601343eeaae2574635cfc3a3fd28ebbcd43e65d15c2da80159efc9

                                        SHA512

                                        d12d93497d3b300d35446f1fecec649917782713ae19cf2b5ce75c62ffff92c92c6c86c52c2a2b1c0a38f76a68320dcb203d3b26781f3e6b95ad98eec83ebc75

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        82cff9e99c6c5d8e655a6ce5fb532675

                                        SHA1

                                        5f7546d56e30aab6bed9f4691a9bffab4fece5fe

                                        SHA256

                                        115217bdc58e451b00cbc4c3ec11e4be305be667ff99ad28bf7624e188e668cb

                                        SHA512

                                        1d430df0eecbf24f1dfe2b2e322a3a9b0453f819eb862fff48ee4cd7bba4b513c6c468ddafa06514c14453857b64257ffa398c20e5cb54edaf5a43afd139a3c1

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        4c631f1df42b1f4a9e9cb6b1b3b1860f

                                        SHA1

                                        5f9bf1f1b463501c57717a845dbd26d07db4db0d

                                        SHA256

                                        8667b7df292bfa4d79008cdb2ca4daa5d440616555171d4083d252cbfe4b21f3

                                        SHA512

                                        a6d526fd7f68125762c2fe2910ae86f8396aaa7087f739faddb45cb7c30dcabfe5640cceaabb7fa66e433fbd9a5364fa142d1ed188abacfcbcfbf048d8037449

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        b368ad5bc647c4ea5718c799b816d415

                                        SHA1

                                        a657ec8b1f17f0766ce45eb4db4f55f590e39662

                                        SHA256

                                        bcd9815ca63d19ab3eb93eee5e69be1c02fdc7f569594045ad7d9d391f227145

                                        SHA512

                                        d6b1d436bdd1addc08b10f6f77176a033623b48df0c1d808833e97b822d21e6ff9ea19b09fd384940a8db214fc17740d1e4ea2ad127deebf77726ee85e6752d5

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        2bba34960d6e4dbf67583c8a5a053756

                                        SHA1

                                        a2982c2eb3d38f9f2c811fed5779e36bf2370c0b

                                        SHA256

                                        f49cbebc0dc1b1d650bf2968d86c87a4958843a2ec74324c014446e222096160

                                        SHA512

                                        9102b83c9bd47de7f8b0ae0d87af0b241f89bce0db5e291695ec0c934d7e37bf85bed1a9c29e808c5130916d967b950e782bc953311de6998cffcea6ff705165

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        1e6629616b2bf51172a7795a35ff194c

                                        SHA1

                                        a55e3dd08e0c7d1611d1307bd08d74ff50063871

                                        SHA256

                                        033157d6ed49478d704a583fbbe31f1e3d73648e276eed4867a12dcbdda915e3

                                        SHA512

                                        d11109efc57458d21d80f09fc53744becbe37533e3b82945d3f958c8d63e535a122a13bad77db7862dd402339cf3350ed4e50d80b1e69f7582cbd027b57c533c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        21e3f6ac9dca84f1f47890608c24670a

                                        SHA1

                                        573a4bda53ec566d3a3e1d3f74b583968cd1146f

                                        SHA256

                                        8eaf13b55d58f20cdf0aee3a30152da9b954e7bf49f61258dc3867b49480fea2

                                        SHA512

                                        da1615e895b8a5ae032b88efac1486d9fdfb1a85fd15e395dfa542b7dacaed86324876251237d2a520c73a97fd47efbc5df7258b4a128436c67dc9ad11d6f2d1

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        fd5f82941b2b1aedf32297904fb37bf9

                                        SHA1

                                        ae826b7cda0aeaf28937afd5a2ae05b776c1f715

                                        SHA256

                                        8ab0728126ce9ce62e4153cd9df83e50d9577880897271eacad4c05bdaed1209

                                        SHA512

                                        6f6436a2d590042ec1e57489530cdfe7d4cd579ca89ae1e6a21d71a02a1ed84ef2bddb595682f08e0a3530d4da3a91418a020f724fab6411d7d568d06b7765d7

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        869B

                                        MD5

                                        6e90ed8d057e1aa6fc751cdbeb26bfac

                                        SHA1

                                        6d406a36427ca01bb4a2897924929a12f0286dac

                                        SHA256

                                        e49e7ec6fca2f32f2565a98a46a4abb8bb63bcc499692e6aeb98a5196151d549

                                        SHA512

                                        80366ee273010a9d34426261b2374ed148d326974d53c0524acc5e63591c502682dc1f5b043da450e8b0c8837e7d40061b8878b29a872cac1fc6a67376a004be

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        bbbd0d03ce22e07d8b1e246e658c1731

                                        SHA1

                                        4ccc5bd35146a05cff75ef16fdfbc41787da209a

                                        SHA256

                                        c8e8e41f1567d17d6d6ca00fbdd09e678d1a90db5f07e17f0b7ae7595bf97ee6

                                        SHA512

                                        2b18f2cb1fee0456fb001e4facc70cadb47e87d190fff21afc6f0c068a838901e74b2646e7fa51c1143463480138c3686130dd2443b1ec46c84adafac1a5e419

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        cdfb95559845953ea6672b8fa813625c

                                        SHA1

                                        b5db1e14c9d13be8011f4d202b0160b389e01055

                                        SHA256

                                        95fff2c00cecb62bbf5b411eaaa8cfa4556d04033b31f3ceb149fdd381d0e789

                                        SHA512

                                        4f055839a40467eae4d7874cb85119b3cc5a7efa3e7ba74a100f4252fec6ffab8d438d716600b843997e06b6e66437294a9c1c839466b8ff60b873a23307cace

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee38.TMP

                                        Filesize

                                        537B

                                        MD5

                                        93c7f0d949ac90563eb3c5ea7af9bde8

                                        SHA1

                                        a164c68bf8b274e70fd269204d11faae980210ad

                                        SHA256

                                        71dd8f41a28b0487afb88225a25cd3951fc861bdc55d09cc5e13b101df628c87

                                        SHA512

                                        f9b8ba42ac850313fc212c70449671db4379e514f41d9cc77b8038b77c9c2f1d5787856baa22e7586b442c50c2a8909d73b5feb110b63827f516686cc5f2a620

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        46295cac801e5d4857d09837238a6394

                                        SHA1

                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                        SHA256

                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                        SHA512

                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        206702161f94c5cd39fadd03f4014d98

                                        SHA1

                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                        SHA256

                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                        SHA512

                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e71cefa4-f89a-49f9-a6af-472e2e16f781.tmp

                                        Filesize

                                        1KB

                                        MD5

                                        682fee80d604606152980a9077ea97ea

                                        SHA1

                                        7451f138e291980b4af8229276bb03a9f1a29b78

                                        SHA256

                                        bcc96b44e610c563ca84e63e7eec5da7117dd1feb7a7dbb1137bf4ffc7d48389

                                        SHA512

                                        819173583a25e534d72ecc95042f85a35742002aa26cddf032d2371c09f4f3d5df3de6b7b851a2c19acfed623093e6c17787cfd165d5afbcf6558efed82089f7

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00002a

                                        Filesize

                                        17KB

                                        MD5

                                        a2a8d4620524be9eca7f61eac3fb3c52

                                        SHA1

                                        68caf758966594d7c2de8ae9430a6b21d76eb82a

                                        SHA256

                                        39f3ff198c8f282157f3c4fa3e41ac5fca9954a9780c2b4cbac94e69aafbad3a

                                        SHA512

                                        682efab9a1c9709d6d66bd86c73624160108df4eb9cad89fac62e2371ce3078cf4f7303c9b2dbf37705f4e0ed5fca1cf2a8be8fb504d685ad2b10dc7d9dad59a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        e9c8a7d3a3c5d8b24bb23b18719b6c0c

                                        SHA1

                                        2ebfa01a34619490c4949b2042b82032547ec6b4

                                        SHA256

                                        0eab914bf82911bc5679d6c3bb6338329c8b6b6d25611e2405b04f0671b6b65a

                                        SHA512

                                        5e1f92671383670cc8cd5289c6f008c107752f18f1317ca6e65ef24411c17e9bff32d83d8d61f3f7c34787fc08f42647b8e60c02b68ae7cb80a41dafceea6491

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                        Filesize

                                        2B

                                        MD5

                                        f3b25701fe362ec84616a93a45ce9998

                                        SHA1

                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                        SHA256

                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                        SHA512

                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84