Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/12/2024, 13:48

241210-q4kacaxjas 8

10/12/2024, 13:46

241210-q3gstswrgt 10

10/12/2024, 13:44

241210-q1vxnssjgm 8

10/12/2024, 13:42

241210-qzx1mssjfj 8

Analysis

  • max time kernel
    157s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 13:44

General

  • Target

    a.html

  • Size

    1KB

  • MD5

    d5fb513907e0bf30fd3a61a2ecd4dd51

  • SHA1

    edb774f15d961ada35f581d84d8faa5a47422850

  • SHA256

    6764182453f39a713e142b15b917a28f06bdf57cbf75f537a38dc4213555598b

  • SHA512

    c7f8e36e09fbf4d7b47c764090e368d9fd0eda8b30f60ea67c06b92c3af01b7749285f3ddafa109c08dbd14b0a78f1f82cfa4f18721ec66eb551c90567b60755

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a.html
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa046f46f8,0x7ffa046f4708,0x7ffa046f4718
      2⤵
        PID:4816
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        2⤵
          PID:4184
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4284
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
          2⤵
            PID:2688
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:680
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
              2⤵
                PID:4868
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
                2⤵
                  PID:3920
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
                  2⤵
                    PID:4100
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2420
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5192 /prefetch:8
                    2⤵
                      PID:1792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                      2⤵
                        PID:4592
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                        2⤵
                          PID:5088
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
                          2⤵
                            PID:2248
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
                            2⤵
                              PID:224
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                              2⤵
                                PID:4016
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
                                2⤵
                                  PID:3940
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6456 /prefetch:8
                                  2⤵
                                    PID:1412
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
                                    2⤵
                                      PID:3900
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6512 /prefetch:8
                                      2⤵
                                        PID:4680
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1644
                                      • C:\Users\Admin\Downloads\WinNuke.98.exe
                                        "C:\Users\Admin\Downloads\WinNuke.98.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2292
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6796 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5028
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
                                        2⤵
                                          PID:1072
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 /prefetch:8
                                          2⤵
                                            PID:5036
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:100
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:4256
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:956

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              0a9dc42e4013fc47438e96d24beb8eff

                                              SHA1

                                              806ab26d7eae031a58484188a7eb1adab06457fc

                                              SHA256

                                              58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                                              SHA512

                                              868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              61cef8e38cd95bf003f5fdd1dc37dae1

                                              SHA1

                                              11f2f79ecb349344c143eea9a0fed41891a3467f

                                              SHA256

                                              ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                                              SHA512

                                              6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                              Filesize

                                              38KB

                                              MD5

                                              53214f37c15ce68a217e2915c835b235

                                              SHA1

                                              912add71f2d55aef34ceed48859cac16207759e3

                                              SHA256

                                              5b50f1bacf12105016c72bb57bdb3a468b274fc21d4485d1922a14e2e127f803

                                              SHA512

                                              7289364baa2d22ebe8754a3b0c0ee75e707d88cb925a7a2e871644899bff3a91afff924eb5f3bb1afac7ec6d5fc571dcefc20c5bbf049a1bdc1e0a8515f6fad9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                              Filesize

                                              37KB

                                              MD5

                                              fc8b9283e9c3686899120581f73dbf88

                                              SHA1

                                              5d2c3af2bf4a2054daf15098d95992c9aac1bf17

                                              SHA256

                                              27d6e4815025d7fe830001e206a4dfee19b496f302332f195ece6295f5d1f216

                                              SHA512

                                              9dff216af5570c81213c24076f9afdb150b52df46d0143e199d12cc1d05d7e8b21e096b129d5d722ab0b51996a41cd70f0b2f06a65f9cd127c5700fc6ce49319

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                              Filesize

                                              20KB

                                              MD5

                                              e42ba21fc6ad46eef7210e6a17cbcf29

                                              SHA1

                                              65df7e97d6ec546a85a16beea1a8533788969fc6

                                              SHA256

                                              f41a6b281e24eebdca7fdd637658685e2c4159b9da7c1017e5b9bfafa6821d8b

                                              SHA512

                                              e9b1896224703b80e26411b65a418878d77713a023a8bfb49707f7569359246d9ce1e2307613a1ecae7bd64a78266916d4586aba1b30fda2ecffe05322427ef9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                              Filesize

                                              16KB

                                              MD5

                                              ab8c6959f7d35bc393a98b6a2db5ce13

                                              SHA1

                                              1289068381b91cc6170c810db2488bc3a46f242a

                                              SHA256

                                              0178bed6aaaa7c7aeb61cbdaad645ebb6701968d04d1778506755251ba37311b

                                              SHA512

                                              ee194274097d7b275292633a9258d5dfb0ccaf28a476e5fac10a34577f3206cadfa0b9c9aef1e7f029ca0d0bbf18e220ee69aaa4e5f2077c167ff0d0803d8d91

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              912accfbf2cd4b0b50f223374cab3d9b

                                              SHA1

                                              0e0128ac73af687abc129cc5cc1c2ace6e4be7b2

                                              SHA256

                                              409b51e7fbfd7259a69c055a71cf9019cf9ccc581d15c846df64b1c77d73ff03

                                              SHA512

                                              f2bd8d5c18fb176b9b1713a2e539dd9bb79b50be24c0a8af5be8a32b7443a2ca6337ed4cdee5c05d555959f4e458ac1a97280d4f2a29516a5bb17d4129d7829b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              ecc62dc48ccfdb85cb21fbadc2b8b46d

                                              SHA1

                                              781cda6f1de82857720f3b32bb9fa26d877a187d

                                              SHA256

                                              3dfd549bb54cd9bb605366829b99acbde5fe678e3f22e8dbd8d00cfd55b76466

                                              SHA512

                                              83c38e1235a28fef637346055b16a2cdbc45face36bb3add4c70e8f8aa424fae27e088e7deae11e8851eed25e514d4cd38a15e9c1d06bfe389e84a2316f9077c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              37a330794aed0c87a9fe59859fa17242

                                              SHA1

                                              6267fabd658c276d12eb66b668021458c3e29387

                                              SHA256

                                              d158c87fa0b44457782894065f28d53613004fc8121ccd75b423e714242aef65

                                              SHA512

                                              0fb76f0ce34de8aae4d14790bd8fc82e1914c9c3047996f23f7eff57f8f33eb97b330a6be2e3dab711acdf1a6c6151f3992613bb1fb19cb8bf48c53a8ba327f5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              496B

                                              MD5

                                              406d40f57c41b87d19b999ebfe5296fc

                                              SHA1

                                              7d6ce47afbb25a87565cebdaf0a1a2f4af4bfc10

                                              SHA256

                                              0d179bd1f38ad65839441984c85dac651e393eb75c561885911cb8cce8be6974

                                              SHA512

                                              a763d98c4e196a8f81244761848a52ab25cf2b4dcc91ff8a977828a7f3639f05248463828221b575942a4c99dc5b720703339e4cb59e11a301fefa6236e660fa

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              496B

                                              MD5

                                              143a86e07d21dbd759f13e19188d0192

                                              SHA1

                                              dd15e312a9574a79a326f72e0d986bb16d03024a

                                              SHA256

                                              d4dd0c997a57ebcd61db5812a428c6f70d60e2818f87a0f6e31f5762ab66d5ab

                                              SHA512

                                              c4b4b4dbc8ef829194003e6c7e7cb5a4f01258a093dfbb130d262756c637dab5d25f465f0daddab484cb267183a81476909ba6e6ac465e5d71bbf19b1bfe0495

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              807419ca9a4734feaf8d8563a003b048

                                              SHA1

                                              a723c7d60a65886ffa068711f1e900ccc85922a6

                                              SHA256

                                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                              SHA512

                                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              579B

                                              MD5

                                              18b7efc4ea2d077f03fc16faf8171a91

                                              SHA1

                                              56bfb82051794cbe13189ba65c8eb68438885a7e

                                              SHA256

                                              2223a63978ea315b6001d5d022d37ccdcad5ed87aefb1938a4e730ba9f2d8154

                                              SHA512

                                              9447bdb2c051df6969829cf718b912aa4f3edb0e9a193edd28330d4cd88b52f1ca5265fcd94f1c65781abca52be8fc33360091fec73781082b649e5b693312ba

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              34a59d52fbe4d9b8cd881f837ec3d755

                                              SHA1

                                              7ff6df41d9a03b63812885f6732fdd317da560ae

                                              SHA256

                                              2c17cb8b0df312529bed2f51c7834dd6bb8ece27966b844101e4249faaf1a608

                                              SHA512

                                              3c13e0c7f940651a66544e1a6230e32f2299f631f3612994c6ee35225d3df93407d515cc4f18eed5814b6012ac9fa3eec3bf58a3addb9614634abbcec9957943

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              94dd0f3c28e37f7778cfa0705fff7637

                                              SHA1

                                              6f4db0e41857beff4148e0fc0c2fe3b9f3c8ae62

                                              SHA256

                                              3be622daca048009b04eadf659b0f5408ab2258b7154c2bc7bb276c5a99c700e

                                              SHA512

                                              6fc9a4f1cb5b8eec503ad2b7b4507ea8d869f2ff9154dd754ee2d34dbf4c4dfed69a9744071e88c544a116f998f3d5983d8a50df7f180266edc98942795041cf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              da644fad6f1b9a514668274f32235aa1

                                              SHA1

                                              97fcd5398faea08f630931aaded316f33ae8e0c6

                                              SHA256

                                              1d41213cc9cbf47f4cd137e638a3c338df7f768649e50d79ce320c5c8b3c1899

                                              SHA512

                                              ac01bec0f80d13a669a824a6a99652254bdc100ba5475ad2d98a8c579fd063de542dafecc5da388c6591a9bb1e2359e16e8e9c31d9cecc6bf69928eac6d2db67

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              3348eebc7e1daaab6e7ad7fd797e4391

                                              SHA1

                                              2be94a92bda1f74d7ab4123254e133f18d60efa4

                                              SHA256

                                              5997275802cee71031ef5b6e296bad9922386405303d28fb10c24d280be9f8f8

                                              SHA512

                                              42c02e6ed97c0d21b6e4fef08aee09e0d956759ba1f43d3ac3c31ba4b343a55f98dbbf2e5fe957f54872c8be4ed3304395187124446b598912c5616bc3944e65

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              95e0ef1820ed3a137ada9ee89dbf3b9f

                                              SHA1

                                              ce529de4b362e681e3884c6dad8c850b0cce15e6

                                              SHA256

                                              5e58402194c2c0c018471dfc2d0be8903e83939c33706f59e2e1d67dd077ed99

                                              SHA512

                                              2fb3a757ac0bb2b2f4542546a8e24f2b1d900128f22502336c6a1e5f23f3455e47358ba4a6ca84fb21d601e22167beb89f941d56284c125174e89b1b066876e2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              1cae894a4f1a25a0daec61b44af807ea

                                              SHA1

                                              19ebd30d493ed8013ed15464c0a77a6699daa32f

                                              SHA256

                                              df7070f5dbf479a08a16b76454b8ec80d02fee9197f2c5b9f90c591c744eced5

                                              SHA512

                                              59280a53ac74cbb5ed52afc7a12f8f475ca29908bb099e11c3b78273465181c689da242afd87fa764bc578f0dfd9daf8943ac8acb468c8d0c094c7f4d2bb7330

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              4c7e09ef37e42131709d45b3d6893246

                                              SHA1

                                              ea784d3710f8953015ea6357a1b979f86a15e010

                                              SHA256

                                              54ba03a6df973db960339e4e10e7f23e0e396209ed0e771e9e54b88f0206fe3c

                                              SHA512

                                              74bc2df71e2228c99d3ecb2914530f15496248e7259e92f9d6bee2bec33e3169d9dd027c2682e49c0b6c562e828b91df54d8b32e2f2df2b1ca531abbaf554ccf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              3857d366bec54375a719288f42043777

                                              SHA1

                                              f25f5ddaf2fe1382cdf58edfce78e86e4d7f9947

                                              SHA256

                                              90f320e7ea58f34486358aff16ffdb77af52c17957a090662b95c177b695c354

                                              SHA512

                                              afa08f947d2ffd011e994fa1be1b4bafc4728c8fdf522598e792f069fa2b33dddd40bc0869ff309982442cbc602e977b68f124358663421886793038bc6b726a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              fa483eb20123bdb5c4919d65af5a7111

                                              SHA1

                                              ba83aea70f24e0407b3eded9a74464ab7cb5aca9

                                              SHA256

                                              30ffaed43aff7159bd3fe22aae8e46b8fc7135195f02fca586d63568084c7010

                                              SHA512

                                              50dde72182eec83c3b74b8ea5c3eef9bd268cd886e2a74402798ab4d0fb9ca729c82f35468bf3c5aced718daa4db5ef29a5e58e4144a94a8ca55306af6ede0e4

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              acf5a4699a88b7f83ca246b347eb40dc

                                              SHA1

                                              1edaa16165c7fbc7124ffbc46a7e51f874693bb5

                                              SHA256

                                              144d26a5f3f9a1e7d1ebfb319c34757a5cb1cb39244c3aceb72885817b4ba001

                                              SHA512

                                              977b9dd444743bbf186f8103523d87b13ecc77a6a516d2d908df81ce19cd1241566eabcc2fa973b2caa81b6c81def32e15172cf5203d7a1efceb2c9c51314e37

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              f529995978985c7649bda44293e2f87a

                                              SHA1

                                              595f55817a8b38e1074d0b2c02008bf8e79e1791

                                              SHA256

                                              4a886cb32a90a186329cdb7a908d0b9f24ab3162cf6aa98461ae0c018d853045

                                              SHA512

                                              819578d5befb0e3cca1b83c85c8e6742df781a237835b4028d8d19f1a4190556c786b847dbe4d33a40b679ad73c1c830df3c8ca50dd91342bf4990eb6e47e440

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              df805d3c519cb397c81fc43efce70315

                                              SHA1

                                              cb0317f55fee18a09e1db79b42e7dc123a7d3eb8

                                              SHA256

                                              7f1b4d8ec3551d879ac2077e93d21eb1aba3b7df2ee39559636c6d1ee26dfd86

                                              SHA512

                                              8317b9b2a5635eea66b08bdea120e1cec4a66f8a27258620028b17cb7487cca4efd3ed6feb4f889d89f60b586abfd9920ba90b614d6a55bdefcfd853e281485c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              5eb9ddc16642589a7f5ba03a84afa072

                                              SHA1

                                              70c0ec7092cade3fc90b4e84d1faa7250e687be0

                                              SHA256

                                              306e8b5563517d9732c2961a7d58e60a6a12a66d486409227115eda6926ddfa7

                                              SHA512

                                              cf02cb36ff4f1094a96df947060336779465d59cd76125e5c9e451882806a00cd2210ae59ea8b5bb177b89b2b51ed90d8022a58d4ec9927468be63eaf00e3c67

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              b74053840e326763b3c2247738605e39

                                              SHA1

                                              1333240300eba4f7d30e9f251abc4681065083c0

                                              SHA256

                                              3248b9460dafa2c9821372005bee6e680b32b9eec4c19e25eb7faaa26e27b7b7

                                              SHA512

                                              699a559a1fab9c163eec7b2d7830aab64b523bfb5a9b461ed26e8842b8ccdce9971d9095fbbc4a260489d77aba7559d135a687311a5ee0b07222c337833e59c7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              62dcd84ac6326ec3fac3bfa7a5a67284

                                              SHA1

                                              bb2d591f0fe329347104d3b22e139880f3d88ad9

                                              SHA256

                                              b9b60c74d4ebf041e09a95ac4671c1dd5f0f18592c7ac632364f5e9fe681562b

                                              SHA512

                                              da1d1170c70c0c51bfc44b0ab136b2afc53e7f70e0538700ab6ef610312f01557fac6108a7633cdf2680e994af5b17a9afd6c863631791e07fed09f4fc8cc415

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              874B

                                              MD5

                                              8c55fd2b75b4914566245ab4b98fb8dd

                                              SHA1

                                              dc4dfe190156b0af067297be5abf0e9f6261e016

                                              SHA256

                                              7b98c87a72af3af1aadbf1fda0a67fee1de343fae07b7be865b9c964989d03c6

                                              SHA512

                                              aafc400623399ff1a59df39f98a141f421f2df1b8487bae5195dc846984f74bb3007a4220a9d8ce616d96709378d46d2c4ee9774172cc2bb5e847a75708471af

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              874B

                                              MD5

                                              3711e662a2610a97857753bad063ef7f

                                              SHA1

                                              93e747d3add55e83e857bf0efe2d94b94861ad0c

                                              SHA256

                                              bf95a2884ce8f3b6fdf26d55c84a46589282dd55f942f24d827b8c44db011e82

                                              SHA512

                                              c521dcab32b56392ccedc4421533f3790af28fbc62e3825c452c5690e884884e2107fbe5fd69fab3ca39834bfc9805c6627cf43f7de8bfecb1405f312f148b6a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580673.TMP

                                              Filesize

                                              706B

                                              MD5

                                              b94e22c2a5162b30345360e6b2704a5d

                                              SHA1

                                              b76ad5ae3ee84e60e26208eabe10b14a4690807c

                                              SHA256

                                              bceeb52ac4a5b96e64b60c88672fc6f4a5e4cbbdb01be7cc1b90da4acb9a0580

                                              SHA512

                                              2b214e7580db3d5c22b6365140a33aee5459dde94189ff89995e3ee3963cf26cf4f3395fc6bb5c6eb274bf41e2c1c6ae3100fb463ada975b4ad220713fd331ca

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              9a83717e13edd0a833f481b445481c92

                                              SHA1

                                              65c6e3dfd82ae69dd695eba5cb92bbfa59a66d33

                                              SHA256

                                              bb5574926b0a97adc7f44cb2297ff8e5e0bec64011f1958cbe1e6e342f9adc36

                                              SHA512

                                              e165f60916feb0c59ad5ac4debc72c60263ed7bb894bdfd43355ed22554d4510d1a692ad6ff6e71f2232ae3d94249237f43e1acbff97dee75a0e2c799d53664e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              d0ae799a44153886131be6d9d9938315

                                              SHA1

                                              14c7d188e983c93d23aa63da893aeb8609cc4716

                                              SHA256

                                              db0cb9f56c6b7b3915b50ec09ddab060655bfd81a3e9d7fc9ab5b5953e03af24

                                              SHA512

                                              4d5cc6770abe72f2e95af445bd39e612b9d7fc5e443c88a8bc07b7a84c025fa894e8aa3558129130c88b7c739fa2924bb173f465ce44b5d4c0c0a8cad65f2197

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              61b4175f98a49cd4730290b516b83fec

                                              SHA1

                                              cf24705a52811c93a88499d644f6f64a4d42480b

                                              SHA256

                                              ac97885f6f3f01539fc2cf37e7f2feab3c7bb4247c8166653ce40c096ca8ad4c

                                              SHA512

                                              ffd267df02692dd9819d4a9b9efe53596734bebb30982499eb6ea94759ea72832184850ec1d42f27b81d21b212e73c7c66c20c1f09fccc13328e5744edb7b35f

                                            • C:\Users\Admin\Downloads\Unconfirmed 292545.crdownload

                                              Filesize

                                              5KB

                                              MD5

                                              fe537a3346590c04d81d357e3c4be6e8

                                              SHA1

                                              b1285f1d8618292e17e490857d1bdf0a79104837

                                              SHA256

                                              bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

                                              SHA512

                                              50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

                                            • C:\Users\Admin\Downloads\Unconfirmed 511345.crdownload

                                              Filesize

                                              2KB

                                              MD5

                                              a56d479405b23976f162f3a4a74e48aa

                                              SHA1

                                              f4f433b3f56315e1d469148bdfd835469526262f

                                              SHA256

                                              17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

                                              SHA512

                                              f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

                                            • C:\Users\Admin\Downloads\Unconfirmed 697850.crdownload

                                              Filesize

                                              32KB

                                              MD5

                                              eb9324121994e5e41f1738b5af8944b1

                                              SHA1

                                              aa63c521b64602fa9c3a73dadd412fdaf181b690

                                              SHA256

                                              2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

                                              SHA512

                                              7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2