Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    03/10/2024, 10:07

General

  • Target

    https://agenciatributaria.gob.es.stt4k.com/ret_url/a98673feaa26dce6d0c0777d10e2e0e6/login.php?serID=email_auth&sessionID=RHnWkyVAjPgbu&[email protected]

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://agenciatributaria.gob.es.stt4k.com/ret_url/a98673feaa26dce6d0c0777d10e2e0e6/login.php?serID=email_auth&sessionID=RHnWkyVAjPgbu&[email protected]
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbacf46f8,0x7ffcbacf4708,0x7ffcbacf4718
      2⤵
        PID:4252
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
        2⤵
          PID:4608
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3112
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
          2⤵
            PID:4220
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4776
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3364
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:8
                2⤵
                  PID:1560
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1516
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                  2⤵
                    PID:3116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
                    2⤵
                      PID:536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                      2⤵
                        PID:1696
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                        2⤵
                          PID:5012
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=2104 /prefetch:8
                          2⤵
                            PID:548
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                            2⤵
                              PID:224
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
                              2⤵
                                PID:380
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                                2⤵
                                  PID:3104
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
                                  2⤵
                                    PID:1592
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
                                    2⤵
                                      PID:1676
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                                      2⤵
                                        PID:1144
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5588 /prefetch:8
                                        2⤵
                                          PID:1448
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                          2⤵
                                            PID:208
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
                                            2⤵
                                              PID:3948
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
                                              2⤵
                                                PID:3568
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                                                2⤵
                                                  PID:2388
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2440
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2100
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:1352

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    53bc70ecb115bdbabe67620c416fe9b3

                                                    SHA1

                                                    af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                    SHA256

                                                    b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                    SHA512

                                                    cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    e765f3d75e6b0e4a7119c8b14d47d8da

                                                    SHA1

                                                    cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                    SHA256

                                                    986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                    SHA512

                                                    a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                    Filesize

                                                    214KB

                                                    MD5

                                                    8681c29159b8e99b1a55c659b0e04159

                                                    SHA1

                                                    d09d15f3efa442f20c613d1b4026ec4c0d11d074

                                                    SHA256

                                                    09f3a9be569f593b391588741045403fbf43150cac7f911d2462b8e3a0ae535f

                                                    SHA512

                                                    3de0ece2eeda427a17cf49e81e4b8c82b3a5a46e695b9d29bba85a85cd374dc1ff0b08ce6d92b873085a775d5de0d71e6e80435522bcd4e1b63ef3dade69d8d6

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    0f62333e3a701b0b60381529296a9da8

                                                    SHA1

                                                    0065a23376e6dbf4cb3d554ef92a93816bd8d305

                                                    SHA256

                                                    77dde0e1bc44b20be5271be0a7ee48ed670f741bcffba98abcf01009c252f3e1

                                                    SHA512

                                                    68db613158bb871c1d9a8eaa510a936a5d79cef97d7d3bf3631787c8eaedb0357824187efd7613bdcb5ee8e813d1575716396ea6616b85176a2dce1fd56bbac1

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    9ab3bc25940b8d760c21ae173a5fb333

                                                    SHA1

                                                    ecfef6107ba8d943cea8934f272cabe857774d50

                                                    SHA256

                                                    29700131beef4a9ede56ace8d119b09c1891040757c01d6057c87a9a60548134

                                                    SHA512

                                                    ab0778c1c62eec15607b00fcf9c2f4023bec4beefff36df8be2c57b60e5c16321c92d83ee3c5a413d67085719e4836567a0084e5482f5d1af8d9627f96f1ca7e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    9KB

                                                    MD5

                                                    b9572664e151effbfbeb53f8450d01b2

                                                    SHA1

                                                    acc7356c6c962507673c4add60189e0cf41bae93

                                                    SHA256

                                                    db804adcbe2caeca89e149f8de5dac02dfd0db1a8a55776c2a320dac79c61519

                                                    SHA512

                                                    acfe11d39bab37351da17bd040a039b948a404b82e4b34e43e931095ccf5f27eb77745812e3bacf179159047cbe6153a21c2cc6f3f09cd3a143592d36fc3094f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    11b7911b8a38987cf6ff306eca708484

                                                    SHA1

                                                    e076a8576187a373e141a8e1651175912b78df61

                                                    SHA256

                                                    bb00c42323980345ef61ceb4930f7c91535fa2f145b076ae8be374eff02bea6b

                                                    SHA512

                                                    8ba3cf9900f6b08ebed59b7bd6d3a8b2d767beddc78fc8969234c20009c0e645a3167c1246ebaa9a5cdddc1d0f2284804699c71cbfbfa45ec5dd7a7fbf28a14c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    2d87c454b2af6d557ac8fb8511a69f62

                                                    SHA1

                                                    6a693bc72bacce1afb7c3e0ed5fb5a93de4ab51f

                                                    SHA256

                                                    9ed27afe38b92dd480ce9a1d8700ffc4cc4aab291d8c566cf6adbc7b373fd9c8

                                                    SHA512

                                                    f89a7287ae88b8aea4569bdfadb436d24de0bf16600313498da8be571f55a5f63e24a141908e22a936145694fa225b304ce1b3c1c56ae6bfb2960e346995311f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    f41ea660736680c3de8e3999a017737a

                                                    SHA1

                                                    d942f4a7242832f21c7d1fb3dafb99fbe8f91dc7

                                                    SHA256

                                                    1317d939a1ae12a84799e1a335003cfa95e345865b1e6bdb0be964eefd4afe96

                                                    SHA512

                                                    db2959c480a85fde7731930cf4218363f76690e45038c014e644c50f4e7a1f249d5a09a1831c3d926e99f55d8cbbe74b044e4b2b245855134c96175f2030e52a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    d760a573072a5464a9a71ee838f4b849

                                                    SHA1

                                                    1dc059b0c9ba89ee3cc925022eb9f55d330d0fcd

                                                    SHA256

                                                    1aa2f4ad3f9320bb69a065027a0c18ec0e2e171192dfcafd8c9c6e7d90246c04

                                                    SHA512

                                                    b804bddf0bfe8cb2cf0291f818b73cdaee716401b7f50db0c493e7b61ba560e471321c124db69bd5615530516d237863cc2fe5e8511c04a5c44fea4e19f8104d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    21deaf94238364701081a00d911cc1a7

                                                    SHA1

                                                    e803c50029f543664205bf0a0b88f0fd9db0b0ab

                                                    SHA256

                                                    30d9a7cbcc9bd1c533e0176cd9e830e25634ca72cefb9d5d234f3dca60dc2564

                                                    SHA512

                                                    e110db0b16253779875e854cfa43bb91a3c548f6339b64bfbfca41391d382eba3766e54c91977194c114956bd9cab03973653398f7a109dbf029ba932c86366a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                    Filesize

                                                    72B

                                                    MD5

                                                    aad04ded6536796cfb869406f0ea95ae

                                                    SHA1

                                                    fe49d9efb6bf0926cb4b9d3dbb2b3bce970d57b9

                                                    SHA256

                                                    f673face1c0832ee9a2df3f8ddb7308263b498d9b343e01888791e442ed31aae

                                                    SHA512

                                                    44ba866471c2be079a4b1f5c28131bc0db64ee0f6b161e4006116a77648aedda1a8795341cacbf49317023737d6909efbeb6ba386b8142f3acc84df7e431f2ca

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d5c9.TMP

                                                    Filesize

                                                    48B

                                                    MD5

                                                    1836fa7ae108387aeb3c75e36b6d1516

                                                    SHA1

                                                    c0af7e2e1033757445f73c57ef599c85b33f8f43

                                                    SHA256

                                                    17955860488134484863e5fa3f1ee363d532978f9858511cde41893db2f5f170

                                                    SHA512

                                                    a6779367733a0c43710b3f0224e83c3405d738fd6c37268ec65135482b6871f1f3f5d5397d9539752e51be5b439f3dc578929606e9f0244bca99128fb59c4bb7

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    206702161f94c5cd39fadd03f4014d98

                                                    SHA1

                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                    SHA256

                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                    SHA512

                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    3e40ec83f35ccb828cbac51b1ac98fbb

                                                    SHA1

                                                    72d211c8e59fc028324e1ba5536b3449be1f7b66

                                                    SHA256

                                                    387d02858c53c2994e48daad918b05c585e065ea52cee588425882391d13b3f3

                                                    SHA512

                                                    27e4c9495825baf3b24e977ef6bae5fd4e08178bd90f22c02d3abd2a4fa66ce94a639c43e57ceefed58e640442be911278a1935cccee5944b3c02884bf000ea9