Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/10/2024, 01:27

241014-bvjvwsyhql 3

14/10/2024, 01:24

241014-bsxc7svdjg 3

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 01:24

General

  • Target

    .html

  • Size

    8KB

  • MD5

    1871888ec92ddc847b02447e82ba2df3

  • SHA1

    b66bb2d3b8bd9b518ce7bf884f96bd7732df2228

  • SHA256

    257820e9a4671fda444faa6ba1ba660a6e55b66e3a2980fa82095d7049b444e2

  • SHA512

    749c7941f127b92c843edd5f48c0f2be4ad443518cf15945ecefa4c4d98442c3426cd6e157de785a7eae62f9e7ae1ffdf25f19e29bed2f3e75a8f5c6e7113328

  • SSDEEP

    192:PN2x2BZg08Ya+Pj8efn+DvD3O1xna0NuHrSDK+yyoN:AxW181+LvsDO1xn1sHz+KN

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e86746f8,0x7ff9e8674708,0x7ff9e8674718
      2⤵
        PID:2432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
        2⤵
          PID:4444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2984
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
          2⤵
            PID:2040
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:2160
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
              2⤵
                PID:2284
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                2⤵
                  PID:2900
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3324
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
                  2⤵
                    PID:964
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                    2⤵
                      PID:2736
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                      2⤵
                        PID:3344
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                        2⤵
                          PID:2212
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                          2⤵
                            PID:2056
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                            2⤵
                              PID:3988
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                              2⤵
                                PID:3036
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
                                2⤵
                                  PID:964
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                  2⤵
                                    PID:1184
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                                    2⤵
                                      PID:5068
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
                                      2⤵
                                        PID:1720
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                        2⤵
                                          PID:3968
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                          2⤵
                                            PID:3120
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                            2⤵
                                              PID:5060
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                              2⤵
                                                PID:3564
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
                                                2⤵
                                                  PID:1636
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
                                                  2⤵
                                                    PID:2240
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                    2⤵
                                                      PID:4676
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
                                                      2⤵
                                                        PID:2708
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                                                        2⤵
                                                          PID:4800
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
                                                          2⤵
                                                            PID:2688
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
                                                            2⤵
                                                              PID:2684
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
                                                              2⤵
                                                                PID:3528
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
                                                                2⤵
                                                                  PID:4804
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5408 /prefetch:8
                                                                  2⤵
                                                                    PID:5104
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7448 /prefetch:2
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4936
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3091909702252190305,5118656026397789973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
                                                                    2⤵
                                                                      PID:1540
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:3336
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:5012

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        0a9dc42e4013fc47438e96d24beb8eff

                                                                        SHA1

                                                                        806ab26d7eae031a58484188a7eb1adab06457fc

                                                                        SHA256

                                                                        58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                                                                        SHA512

                                                                        868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        61cef8e38cd95bf003f5fdd1dc37dae1

                                                                        SHA1

                                                                        11f2f79ecb349344c143eea9a0fed41891a3467f

                                                                        SHA256

                                                                        ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                                                                        SHA512

                                                                        6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2875cf4f-5448-46fe-9043-f4a3ec2efb9e.tmp

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        494fe0cd5cfe84c9b503925ec13f5e80

                                                                        SHA1

                                                                        09fa09fadf6e6bacc72c4c7484f35f8d5c99f942

                                                                        SHA256

                                                                        653a5158c780c468a65cd6368b517d7861471bebb746227e7ebefe7bdb249fe2

                                                                        SHA512

                                                                        b6c771ba7cd8df573b7e739ade056c45ab526017f66034098ccff5bdc869de794dbd5f93f90f7b2c80c5c10dded71c9b7be0ed11eb46e78b44365565dcd965af

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                        Filesize

                                                                        26KB

                                                                        MD5

                                                                        d944ff8fe668dd09051b1385fdf6e8bb

                                                                        SHA1

                                                                        9b70ecdd5ddab7ebbab12f4f9ed09e021149b903

                                                                        SHA256

                                                                        dd38c8841c39f10092231d7656b086cb699f8f2c711e8c46c9eb807420d9cdb3

                                                                        SHA512

                                                                        350a189861184419f8f9d8b14110e3b0e19aea0b23514c2a5475e4858a092e2d618a126038b8ac4cff67a144e556ae8c62807185c09f21229eb6de96785416f8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                        Filesize

                                                                        24KB

                                                                        MD5

                                                                        52478f9dfdb9a43a858cabdce8192f0a

                                                                        SHA1

                                                                        99ad0aac467df31a9f6a480ba763fa6d1cf0172e

                                                                        SHA256

                                                                        f9980e2d703e0f15349b04b4092e733f3c8666da49ccc2a2ce97457ca78058d8

                                                                        SHA512

                                                                        5fe295fa944a8b0702cd88e70fe6e8f57d10a4f944ef18ef597ef36b8158f834364b2f91338c10ce14c0194ccd4d4e5c047db3bab964e587c5c3a1ef984abe94

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        25fd86e28da52491d63d7d20b0ae7a95

                                                                        SHA1

                                                                        fefd44cdce0ea0645ff5c810bea9d1aa671cb949

                                                                        SHA256

                                                                        6b2a52835ee9e8041627097398184a40d2f6abe6872c7fc8c0b8b192b3c66a1c

                                                                        SHA512

                                                                        0f47b518290cba1b3af9931470b9da8d62df521b0ad8af793dd691245a38c8be0f4034e0e2ba155df4255f8e0b015eb390672c876cdfad223edce8e4eee1f3ed

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        0e0e9625bb9185888f7718618eca847c

                                                                        SHA1

                                                                        1f0ce3d886f6664eceae595eba6a54c0c585c7b6

                                                                        SHA256

                                                                        00cfab0dcb6ff8559f2f96ed4c470a1de05d8e84e9bd5cd5b7e7fe7e936fe9cb

                                                                        SHA512

                                                                        01c0c341bca74b84819ed4f5824781e1d7b30b8f05304a51d6340a4a21aa1fcd4bcc575610cd86ec44624a18aee21a37a94eb5e90c9cf72bc8dcebdbf8ac2d84

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        ab211674e2e1d1535ea1d3876e4a745b

                                                                        SHA1

                                                                        b07ce527d177890be51e91cf46a85f4b85a5b734

                                                                        SHA256

                                                                        53f2042b71e27e2e313d426b3bf53819b1a2c147af3fe690fd59e7b3119f581b

                                                                        SHA512

                                                                        395d59c7cb80ab3ab3f45241399ea53b85bde6ad43b831e3e612f88d65d5cb1d142312ada6eda58fc61bea476baad063ca5af08b3cc4ff29c1ac2fe8661b9075

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        c0961b642f36a842762aae2f7d65e4d5

                                                                        SHA1

                                                                        1289a732ec2a9f2816e59b9acb52f8a73f758aef

                                                                        SHA256

                                                                        ebcdeeafe13cbb96fb1764666b0a59b9cf45693a5b7604e6ab578016f0bbbc7e

                                                                        SHA512

                                                                        19243f9047382298786269db735079bc189bcdd8bfe6dd67b4881a92eb5c937aaa3f7107c7085ea27be27882bfd8001808619c0f7547b32cff0a1064c59f7a6b

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        0228f194bba351c48370bdc0f9878c12

                                                                        SHA1

                                                                        4513401fa6014ed6f6160e73f3a96bf9bd891d5c

                                                                        SHA256

                                                                        063937f707407048d5a032fe01c38204c33428eaa97091c631c056b37ede4065

                                                                        SHA512

                                                                        4895e90210387264f1b8c6a1efc29a707d4bd3b3d80576a5fbd2632e6c23e2c4fde490c6407dfcb4456e8fff401fff6e61bcc580c606108e6dd7bf87060556c8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        505b2f9580125d05e463c6ed815d8b4c

                                                                        SHA1

                                                                        ddf907b09d149f6fe3b4b61d9c8a32ac5beaf20e

                                                                        SHA256

                                                                        8b798b2848b2c5642fddc1fdd1c65da942f0a5407fdb0fe46158efa0b7e8ce9c

                                                                        SHA512

                                                                        2d7b4da945ab6aeb31f6a1ea0ecb17cdf22a69392a7652a6a830d975a265dca67bd61973e9c6e6fd79cf2f2526b17f1dda67b6abcab78819ab38f533f00c4b2a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        4b5daf0dc3072052e4fe7ed4fff5fec6

                                                                        SHA1

                                                                        1f7a492985629d7ce00bcb1dedc56b710055416d

                                                                        SHA256

                                                                        b1131b7de26b340101a76bb9a8dfa2a35b013e134fbe18db7ffb994e7b0c3892

                                                                        SHA512

                                                                        a3288d8f1974eb3b80f8836f8d49bfe896222669c97900f317038704a779af6ff7366bf84d4f61826455c0560ff1044efbee052b9535a20d4cdc1da9cb9ef04a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        8KB

                                                                        MD5

                                                                        97fcce8d1bea9a5c6dddee2f0ff48373

                                                                        SHA1

                                                                        b480ce8d4feb5829f372f555d4bd5ce5c0d6f338

                                                                        SHA256

                                                                        6f0d0c0ebf07ee4f8aa1d6f2f5bc7043d263fa3d4f6d2c4efa1a54ae0bb15887

                                                                        SHA512

                                                                        52c3b7ed31bddf918feb6b7d7044b35a877ebe15acd0af65fbe08ec20ae984bea74e24767d47787a2df6c6c5e6828acc614be2986497a4c404d06e31ee209ace

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        8KB

                                                                        MD5

                                                                        23a7de503e7e750eb829b2605aa0c0e0

                                                                        SHA1

                                                                        67cb4829472502e0f4df1eeaea0c663b3bf775dd

                                                                        SHA256

                                                                        39065bfbcb9d5d77c813d4ee1c848e623fc9d0db7ce1aa5d24c30302508821ac

                                                                        SHA512

                                                                        f20ca4deab4c2e5e3c1d411f18d5cacc5e692d5688e2a2aea5b6a1f44cf7b8c7367ab381890f1c34b1a2cddb534716b4e45bbca03f3388210ec5c1637a333c6b

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        08769b88e77f73bdb86e2ab56d1d0009

                                                                        SHA1

                                                                        a9a5f0d51b723bff8cd0f819eff8624f8e732e9a

                                                                        SHA256

                                                                        6ab8c8080f4b68e91ed36a0b417e478cd32e661ff0abaf21a875ac97785158a8

                                                                        SHA512

                                                                        0296698159c879558222a5d9c6c5d3b0b7b7f67397c4ba02b613c011ea60a73dda7f4e127392a1f85746fab1ee641d15c03caae1af1185d062a51429c0f777b8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        c819eaa8ace810b910fd47ab3f89445e

                                                                        SHA1

                                                                        905e85013062ce8ab63076a199df4a36988c3eb7

                                                                        SHA256

                                                                        2901c90729ebe15b10cd83eb4b0de44ab4ea73b464122d97241f30cab3a7bdd3

                                                                        SHA512

                                                                        ed541d67b508671374df311763cd576296342f277c05d04a95393eab5cc5fd562a2c9b431ff997d3c9ab8f9408c26950ad3a2a2d5c65a160acfb7d4ae305f4ad

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        ac63c2177ea23367859ef1786f91f613

                                                                        SHA1

                                                                        7d47ee283b2d06538d72106bff073baba092bf1f

                                                                        SHA256

                                                                        c27363f2c752825af4507d723e5ce02c8fd10bac98cce32a2644568207839aa3

                                                                        SHA512

                                                                        f345a9d8d73af828df8f7ecc8c46ec0f73920a8e49decf4e06819aaf7ac3a9f83e9cf4c9351f5b98bc6fde845df0ccebe3d64dd97dc18178c1948a871043e24c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5854d2.TMP

                                                                        Filesize

                                                                        875B

                                                                        MD5

                                                                        1eee2f22ec21979070b0432510a09472

                                                                        SHA1

                                                                        65f436c784c02d2e4b48ed4fc15d21f6e5aa39b0

                                                                        SHA256

                                                                        98ee7bee55f060ef5e88c5cefdc683c8d1c8e346158d73181e4c944e2bcebf8a

                                                                        SHA512

                                                                        2adaf33535ae8ab47c37802918124e142fd5078b55f592bcbbbc432ec93e60a82b18ffa208f1c2f3bcb97f8366ccf2ffa280ba68c18ea2a0d44f793deb849cd5

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        f713ce94946da3724a3a4f60f91591c2

                                                                        SHA1

                                                                        d7a4e6ec91d90c58c341e383da42314142c5aa2b

                                                                        SHA256

                                                                        16bf783e01246cb43d5dc804a962b47ade3a8704da7dd9c435ae297c831f766d

                                                                        SHA512

                                                                        9840fcb4f768806a22a7c872404d8bfb2c5340993f10cd4c0a4bdb6b07e242eebb4c073d75afa34d9e71f2ab399d11416678199aaff129b9a19c787ac7caa281

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                        Filesize

                                                                        2B

                                                                        MD5

                                                                        f3b25701fe362ec84616a93a45ce9998

                                                                        SHA1

                                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                        SHA256

                                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                        SHA512

                                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                        Filesize

                                                                        12KB

                                                                        MD5

                                                                        4af1cd9ce85fe682ef97f08ef4e54037

                                                                        SHA1

                                                                        0526e296396698a0d35895852a47a517747d6e15

                                                                        SHA256

                                                                        8278bd0735eee32109d96ef32eb69dd26c46dd28d16ecad775702fe26bf2d5bd

                                                                        SHA512

                                                                        7a7879a0b1bbfd3f55747b10aa88dc013659b66bfb6979a07400dedabf4d07d16b2e761b7a1ee6b01fc19971c7970fd7a1153222f2f41b4316dcaa31aab8c25f

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        78e52c9be0ab5e99f4e2644b9fb20528

                                                                        SHA1

                                                                        ba191456e56705d7427450ff3877b8c0d3602064

                                                                        SHA256

                                                                        0ff2bdae4abbef7786dfbf52203b7b2c9632f59cdb30dbb3d00f779c229857f2

                                                                        SHA512

                                                                        9647e11fa8a9d511e28551448aa6e22ab19d078414a2bd80c023e2cc4a9e0166b5f8dece103ef74cfaeb6ddc558af5a9c13b310789c2872e36eaf68cbf48f458

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                        Filesize

                                                                        16KB

                                                                        MD5

                                                                        1842a4acd0d965084d4fa4ff4a39ed5f

                                                                        SHA1

                                                                        9924d5a7b2c17513acdb942ce5bf5edafa1cfa2a

                                                                        SHA256

                                                                        d60078da4270aee5eb9c11d5b222eea03b1b2ec9e453ac633b4973fae109e0e5

                                                                        SHA512

                                                                        b1976eded081c6a00ab0119389e6a880eb71cdf90e0cc18ac61406f691a79ee5879fff2bd6d443a4df1eac0be61daf9a1375cdaaaa7993739e3da6eb39f29ea5