Resubmissions

27/10/2024, 16:00

241027-tf5sxszeqq 6

27/10/2024, 15:58

241027-telzeszepm 3

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/10/2024, 16:00

General

  • Target

    http://google.com

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe50dc46f8,0x7ffe50dc4708,0x7ffe50dc4718
      2⤵
        PID:3904
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
        2⤵
          PID:4836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
          2⤵
            PID:2144
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:3580
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
              2⤵
                PID:3572
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                2⤵
                  PID:1240
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                  2⤵
                    PID:3304
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                    2⤵
                      PID:3312
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
                      2⤵
                        PID:4528
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                        2⤵
                        • Drops file in Program Files directory
                        PID:2692
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff78a5f5460,0x7ff78a5f5470,0x7ff78a5f5480
                          3⤵
                            PID:1388
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                          2⤵
                            PID:2116
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                            2⤵
                              PID:968
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
                              2⤵
                                PID:2624
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
                                2⤵
                                  PID:2988
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
                                  2⤵
                                    PID:1172
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:1
                                    2⤵
                                      PID:4032
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                                      2⤵
                                        PID:1284
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2600 /prefetch:8
                                        2⤵
                                          PID:1696
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
                                          2⤵
                                            PID:464
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5064
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6312 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2356
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:900
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:1032
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:4036
                                              • C:\Program Files\7-Zip\7zG.exe
                                                "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23582:114:7zEvent22027
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                PID:1100

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                ccff51f965f8f4176e4ad112c34c86a7

                                                SHA1

                                                eab249ca0f58ed7a8afbca30bdae123136463cd8

                                                SHA256

                                                3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

                                                SHA512

                                                8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                c29339188732b78d10f11d3fb23063cb

                                                SHA1

                                                2db38f26fbc92417888251d9e31be37c9380136f

                                                SHA256

                                                0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

                                                SHA512

                                                77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                Filesize

                                                67KB

                                                MD5

                                                fb2f02c107cee2b4f2286d528d23b94e

                                                SHA1

                                                d76d6b684b7cfbe340e61734a7c197cc672b1af3

                                                SHA256

                                                925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

                                                SHA512

                                                be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                Filesize

                                                62KB

                                                MD5

                                                c3c0eb5e044497577bec91b5970f6d30

                                                SHA1

                                                d833f81cf21f68d43ba64a6c28892945adc317a6

                                                SHA256

                                                eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                SHA512

                                                83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                Filesize

                                                19KB

                                                MD5

                                                76a3f1e9a452564e0f8dce6c0ee111e8

                                                SHA1

                                                11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                SHA256

                                                381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                SHA512

                                                a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                Filesize

                                                63KB

                                                MD5

                                                710d7637cc7e21b62fd3efe6aba1fd27

                                                SHA1

                                                8645d6b137064c7b38e10c736724e17787db6cf3

                                                SHA256

                                                c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                SHA512

                                                19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                3KB

                                                MD5

                                                d5d672bdccd9e87d1d0ae157743513b2

                                                SHA1

                                                eeb1d86e21a17fd049b3c124206ebacf88869774

                                                SHA256

                                                807d908fbb92757c3aeb1b592c62ff70ac3136b9b23ae2fb5fe4dd33ce72992c

                                                SHA512

                                                a35964059967cbecf1bd54bd04bd175f449f7b52d074749a474125f136a73cf72909e7d6b2336a4d1a20b28322aeb5bb746839b3ee11871aeef00bec0ad60a43

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58684a.TMP

                                                Filesize

                                                48B

                                                MD5

                                                d50c0858c81368524d58ad6b230600ca

                                                SHA1

                                                9da4476cc69b20651a7008ab7b3c4f87b697371e

                                                SHA256

                                                da77f0edf253e3cd7107e1c43a6cec81faf5f798a149bbebdb89b00ed7a886ac

                                                SHA512

                                                2c57ffcaeb765a3c162227e75b0e3c57ebf250e22a3d1eb021a36e0226b37b01a672713d29438b57272a496403f812389a9ee59f796c53b51ddcbf8d2be697ee

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                Filesize

                                                70KB

                                                MD5

                                                e5e3377341056643b0494b6842c0b544

                                                SHA1

                                                d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                SHA256

                                                e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                SHA512

                                                83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                2KB

                                                MD5

                                                cabc74974627d54470eac58964a285c2

                                                SHA1

                                                3cd9bd507992336c43da6157dcd9bd9746061aea

                                                SHA256

                                                4b759903c2b0515aa408d93ed4483cab997c490f212483f8fee3a22212a8bb73

                                                SHA512

                                                3a2c5db63850e604768c9476805e6f3782a7a69ad509cb0ffdbae33535bfab59ce6cdc1c2a6a4960004be1a5460b83b21743f4b4ad5c0b6b5c564f4dbe7806b0

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a94b.TMP

                                                Filesize

                                                59B

                                                MD5

                                                2800881c775077e1c4b6e06bf4676de4

                                                SHA1

                                                2873631068c8b3b9495638c865915be822442c8b

                                                SHA256

                                                226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                SHA512

                                                e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                14ff5e1892d96600debaf89820d8a205

                                                SHA1

                                                af406e20cf3ea720e0ab9b3d0d52121f8728281d

                                                SHA256

                                                6f1d2bf37fe3e98a944fd3fb166f38226298ea2ecbc3cc428a7c7a2ef9464924

                                                SHA512

                                                6e6ffa3caaf39a0c66e25a4107f427a4c1b2aadd91f9764009f4fff64a145cfa93c47a1fb7112ce8d32b5f96aa31006da7ba9303ebb3b54f3b22727215326bbf

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                5KB

                                                MD5

                                                056d4cf4097976b0378ef5ec3c739c70

                                                SHA1

                                                1e0e15af80c11798015d0fd24bd9ed820a8fa347

                                                SHA256

                                                c54d19d7ebfba277b1e8b631c3808d0c9fdb6b4a35cb87f99109f7ca1a142ba0

                                                SHA512

                                                263980cb69cfbf478cbde8525c7b4a2b2e94f684bde8d8771d0bdd63dd119fc333b96a2699162f335b48b036c4d97759344db2332244f2c1fe1a7ae47ba44834

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                814a04a8cfac1666ec72335b50306a54

                                                SHA1

                                                73d7a27dacb95c9ec1ef4692415499282ff3c729

                                                SHA256

                                                6870e6b24819d5c9cf41fa7f9b44c2d155c6c55a7802d49ee0dea1a09914e142

                                                SHA512

                                                8935f0f56c372e06116f4b7f424bc77d7c96da2b176645032aeaa48b2ce2bbbafbc16ac9bf60422f45696976a8ec9eb7a9ef74e58f9c56c2927424ac42de149e

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                65d607e29fd445d0e37f15d9e50d0dab

                                                SHA1

                                                0cacfde3c213234f4322bc6a55e6aea2b8dd9422

                                                SHA256

                                                49245d96bd5475c334e9fdde9fc4c671e43644af1525b64e881f59f5170ccfea

                                                SHA512

                                                dda4937acbc2e2c8f02e9882bf7d64ee3ae0d3b113f577179772c7fca4ca6ecac4a1484cd03ba4cbd91eeb76f6b83f62755f59fe601acffb802adbdcec522ed4

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                Filesize

                                                24KB

                                                MD5

                                                26978f38b0bce48572b90b762b7d937c

                                                SHA1

                                                8b8b88012fab1d37fca79575a5db81674b424867

                                                SHA256

                                                b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

                                                SHA512

                                                501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                Filesize

                                                24KB

                                                MD5

                                                86aa28ffd286b08415aa197216684874

                                                SHA1

                                                d99924976c73e3220108817ad6bc1d8b1795ca2d

                                                SHA256

                                                a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

                                                SHA512

                                                a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                706B

                                                MD5

                                                375d22b281e5b388eba545e0accd0277

                                                SHA1

                                                e4c3ea57065af91e9d05f0b5eddedaa93f38ca7e

                                                SHA256

                                                b327fd58b2cc68c31b9f8a29226d36ac4ba393edefa56388ebcf1d1055c3b227

                                                SHA512

                                                808cbc7580740b9e9c4213f8dff9250c0341946bdedbcba251d0aa1d2db94c48b3afb2cd45aef42ce18da838e514655e916e8b14e32d2b1b129eff0f36a0c673

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                e8b2f16b33973a584513b0270249531a

                                                SHA1

                                                ccd86349345cba866aaff633d8871cc6e0e0834c

                                                SHA256

                                                7771f9d7e423a621491a614a50ca75de6aabfe9a9b575e64dde1ee7d9c121e04

                                                SHA512

                                                92ded361ecc45c86b50c5e1bd3e98c6edea1be8c931996cf35deceed8bf993ed2285fdea5f0f4ef8b3c600a861ff2157720e4556f30dcd13a2d293ed119d8feb

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57faea.TMP

                                                Filesize

                                                204B

                                                MD5

                                                ef8396e00a44e6e0ee76b7f021d5100a

                                                SHA1

                                                c057edb11ededdc17691fcac1d117a9d0c6f706f

                                                SHA256

                                                9e35426d07c9a5a3eb4dda92d93ea818b1b81a26a8a613f7ed91d38cf8880f03

                                                SHA512

                                                3cc240fcc9a23c262cd75b67a102877fef5483a173e9037b6c84368229a1476c3f461383797e6f0e0646a1d8d2f24517cc2ee3707ef66af800ba6844a0d14889

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                206702161f94c5cd39fadd03f4014d98

                                                SHA1

                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                SHA256

                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                SHA512

                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                Filesize

                                                41B

                                                MD5

                                                5af87dfd673ba2115e2fcf5cfdb727ab

                                                SHA1

                                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                                SHA256

                                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                SHA512

                                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                46295cac801e5d4857d09837238a6394

                                                SHA1

                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                SHA256

                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                SHA512

                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                8KB

                                                MD5

                                                bf5746a6db804cc4c60ed1e50bfdf0ab

                                                SHA1

                                                aa4270707bc35805613d7d3cebe5b2266cdee19f

                                                SHA256

                                                7b21aa7114db8e6423dd27b5ae43b17d6211380ea30d78d99b1a020ab4ab3f49

                                                SHA512

                                                8ee8cb87a880f78ce04317ddba68be4e96cd6194e8cdc6abf7f01b6fe523db6fa52b0156fe7fb5b551beb81a20750e4a12164873bbc90303e627128f3f964ab2

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                d56b165693c08b7958ef02764a79dbc4

                                                SHA1

                                                a1f0bfb9571afc38b3cdd097d16e06975879b360

                                                SHA256

                                                4adf557f92537be55252775f75d5f4670a2258dcd630a6b10acab15fc732df23

                                                SHA512

                                                a105e216f9e5601d048c6d682037b6909be1a41893b7c584be23945aecca34e057d378ad7296aae13ea9228c78c69d6fc938e5c4fb5e739da33de72ae4ba085c

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                Filesize

                                                3KB

                                                MD5

                                                55feb0a829daf68216a911311ad02ccb

                                                SHA1

                                                c830f565edc9222125f041e8c0f55b53a0379011

                                                SHA256

                                                2bc3eb30f4afa1697da707f195b07ad685f51c165675c39b19be0a0efc2753d4

                                                SHA512

                                                f6e9a1f3db4a393244af50e9fcc955cb55b54b23e1856c1d0fffefb366f3e66fc8c0b5784812463c9555b6541079a8a7e7e16bb45bddbdbe241a2048f80c6d5b

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                Filesize

                                                3KB

                                                MD5

                                                06d931bafb5e89017344ad99176a335a

                                                SHA1

                                                2507d960ad547dd497318e90b9d9acbf88b2581c

                                                SHA256

                                                9a8d2cbd68c835e5d41f4f7a5e58975aac5b09ea5bb7737b8b67b779edba01fa

                                                SHA512

                                                fcb7dd18508d291a2f79b7384075157e0e0bdfefc2b61f06097ab318a32d89c6178d19ceb3fa51e62163b8a2b1c64ab971f172704f104e19b5a162a2dbb36125

                                              • C:\Users\Admin\Downloads\Unconfirmed 475535.crdownload

                                                Filesize

                                                12.1MB

                                                MD5

                                                c8bf514a334eaa148cb3c6135c2fb394

                                                SHA1

                                                0e47a89c3729db5a6f195c6abb04e5129d788df8

                                                SHA256

                                                9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67

                                                SHA512

                                                9879a258f429ef492cf495dbddd4f2b9c9fbc061e325aa8ad870ed05049b7ad595b26d223d20c55fc99f403fc9b5d0235353d71bf5d9a39ee4462838feb247ff