Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2025, 08:08

General

  • Target

    Bootstrapper.exe

  • Size

    800KB

  • MD5

    02c70d9d6696950c198db93b7f6a835e

  • SHA1

    30231a467a49cc37768eea0f55f4bea1cbfb48e2

  • SHA256

    8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

  • SHA512

    431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb

  • SSDEEP

    12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unexpected DNS network traffic destination 15 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • cURL User-Agent 6 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:4564
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
    • C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.11.exe
      "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.11.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/8PgspRYAQu
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffda9d46f8,0x7fffda9d4708,0x7fffda9d4718
          4⤵
            PID:3304
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
            4⤵
              PID:3212
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
              4⤵
                PID:4516
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                4⤵
                  PID:900
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                  4⤵
                    PID:1204
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                    4⤵
                      PID:1076
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5148 /prefetch:8
                      4⤵
                        PID:2728
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4552 /prefetch:8
                        4⤵
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4564
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
                        4⤵
                          PID:1384
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1348
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                          4⤵
                            PID:1028
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
                            4⤵
                              PID:4608
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                              4⤵
                                PID:4564
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                                4⤵
                                  PID:5100
                              • C:\ProgramData\Solara\Solara.exe
                                "C:\ProgramData\Solara\Solara.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:456
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4360
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1608

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Solara\Microsoft.Web.WebView2.Core.dll

                                Filesize

                                557KB

                                MD5

                                b037ca44fd19b8eedb6d5b9de3e48469

                                SHA1

                                1f328389c62cf673b3de97e1869c139d2543494e

                                SHA256

                                11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

                                SHA512

                                fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

                              • C:\ProgramData\Solara\Microsoft.Web.WebView2.Wpf.dll

                                Filesize

                                50KB

                                MD5

                                e107c88a6fc54cc3ceb4d85768374074

                                SHA1

                                a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6

                                SHA256

                                8f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8

                                SHA512

                                b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe

                              • C:\ProgramData\Solara\Monaco\combined.html

                                Filesize

                                14KB

                                MD5

                                fd98223d3a143a6a21aa648a38284761

                                SHA1

                                0ebe2f8e3f32757cb3acffef995232548952fa2d

                                SHA256

                                e47ade9b6b7c60e2eaffaf4429683adc0a10e2c9cca3752583f672df40e0bd99

                                SHA512

                                a4100bcc20dd8fd45bb853cbafc7bb1ce2a88c9809de7d67c6617d8b2dc01e2cba8170a8e1ac2716018f4796ee767a574853d52a557053a771add013f48990da

                              • C:\ProgramData\Solara\Monaco\index.html

                                Filesize

                                14KB

                                MD5

                                610eb8cecd447fcf97c242720d32b6bd

                                SHA1

                                4b094388e0e5135e29c49ce42ff2aa099b7f2d43

                                SHA256

                                107d8d9d6c94d2a86ac5af4b4cec43d959c2e44d445017fea59e2e0a5efafdc7

                                SHA512

                                cf15f49ef3ae578a5f725e24bdde86c33bbc4fd30a6eb885729fd3d9b151a4b13822fa8c35d3e0345ec43d567a246111764812596fd0ecc36582b8ee2a76c331

                              • C:\ProgramData\Solara\Newtonsoft.Json.dll

                                Filesize

                                695KB

                                MD5

                                195ffb7167db3219b217c4fd439eedd6

                                SHA1

                                1e76e6099570ede620b76ed47cf8d03a936d49f8

                                SHA256

                                e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                SHA512

                                56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                              • C:\ProgramData\Solara\Solara.exe

                                Filesize

                                613KB

                                MD5

                                efa26a96b7af259f6682bc888a8b6a14

                                SHA1

                                9800a30228504c30e7d8aea873ded6a7d7d133bb

                                SHA256

                                18f4dca864799d7cd00a26ae9fb7eccf5c7cf3883c51a5d0744fd92a60ca1953

                                SHA512

                                7ca4539ab544aee162c7d74ac94b290b409944dd746286e35c8a2712db045d255b9907d1ebea6377d1406ddd87f118666121d0ec1abe0e9415de1bba6799f76e

                              • C:\ProgramData\Solara\SolaraV3.dll

                                Filesize

                                6.4MB

                                MD5

                                ea941865c88edbc63d9f8e7f690cf03a

                                SHA1

                                c3c2a6ab54b6ed8023fa492afa744ac15ae1f239

                                SHA256

                                9d017e4532eb760a48aaf663fc70c732f06839a027c47b447f804fcb424e59bf

                                SHA512

                                7383dcc92a9c8d469ed4c0d05240667d139c5b502ea80da521ed3750301fd0f805e38ba2df28e1dd45e359c7975314a5f99f17de69113e3ae34d9041ebbf07a7

                              • C:\ProgramData\Solara\WebView2Loader.dll

                                Filesize

                                133KB

                                MD5

                                a0bd0d1a66e7c7f1d97aedecdafb933f

                                SHA1

                                dd109ac34beb8289030e4ec0a026297b793f64a3

                                SHA256

                                79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

                                SHA512

                                2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

                              • C:\ProgramData\Solara\Wpf.Ui.dll

                                Filesize

                                5.2MB

                                MD5

                                aead90ab96e2853f59be27c4ec1e4853

                                SHA1

                                43cdedde26488d3209e17efff9a51e1f944eb35f

                                SHA256

                                46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                SHA512

                                f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e737eac-3d8a-4b3e-a72b-201cecc459d3.tmp

                                Filesize

                                10KB

                                MD5

                                c1cf9d93cb1e8978a0111aaffb5f3eea

                                SHA1

                                c82955e1fccb9edb7188468d80dcf3f0f54ec31f

                                SHA256

                                dcd9bfcb0f30c51f6cd667c3b0b3482df12f6a77cb2fbde432fea2810833efa7

                                SHA512

                                e91f216cd065c6c1eecfea19502f4e7a5246e4e09e2cb19bfc309a0b723dfdae7f33acbb1d85bd2308b77421e681aada8df839b55e1b311565e74f30bb65a2b0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                e443ee4336fcf13c698b8ab5f3c173d0

                                SHA1

                                9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                SHA256

                                79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                SHA512

                                cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                56a4f78e21616a6e19da57228569489b

                                SHA1

                                21bfabbfc294d5f2aa1da825c5590d760483bc76

                                SHA256

                                d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                SHA512

                                c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                576B

                                MD5

                                5da48a4ca490e23c4c64432459720b4c

                                SHA1

                                3c44fcd398d3e68574cbd52d75d93f38977f1b28

                                SHA256

                                22234b4c55687fc246cadeba4c398ef072c9b552d765770ae06444be28c5a693

                                SHA512

                                eb5ef243f1d8064e5362d5ac14fff0e0744b5631f64152668d9d211d0dc45fb2985f0dfc22f08d959a3c1e1c56e3bdeeffe451c2ec32be619735d7a46ba6483c

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                255B

                                MD5

                                ff9f825925f89085b6c4809612c14b39

                                SHA1

                                3cd291d4b9d7bfff93177f074aa75d7034ce0d4e

                                SHA256

                                118d159f05b7fb0b7424c2374470d9e77857047f4a0663e944e2363ecf04b0fa

                                SHA512

                                735ec4fd0c01534dd09a61b341ed00a0bbb7488c1e267d736041d96e0f6a62c8b4090ded41986464cf82b472831c6d10f9fbf688e20340f6c293ba5332e05d58

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                1c40a849d9e2b1ddb64e086fffd9d970

                                SHA1

                                7e9aa32595750e09a236b2209c42ec909eb4ec49

                                SHA256

                                36c78bdb7366aa9d2b2d94c6a5aa18238908e19f7f22ef6240ea4b080ab0ba02

                                SHA512

                                1a19f08edfccb67812991876f319be313594175e660297485a414abf119c4ba65abf99814f3e7071d61fad2e9df2bbd7de76ffc4ff48a3babf3de437d560d1cc

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                7b0529a0b1972f999d35af47162499fe

                                SHA1

                                ea08e24dec525b0d6ebc28dd27c7d07295b4ddc2

                                SHA256

                                abb143ff68f499293c418928a444bd570d3ed6d5b5cdd171a44669717bef73e7

                                SHA512

                                77da25c58afe997a4af5ef869febf8f7e1e490ca45193b727e5059094e027d776c7a42429dc05b8b212e324b0a2d5b4d5b5fc7181c625efa5860c10bcec744b4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                f4d1f1dd815e3996d77db8d02133cc61

                                SHA1

                                99745dc056cce17b9a9c18cbc502e21f4d55a483

                                SHA256

                                4fbd15cba7b2fefe8120af1e831c3c67ae447b69fbddc825ac68bd4b1d34726a

                                SHA512

                                4cca841924dbfa2f92f1e2e61b9ed85cc2cd47a55e80b8a04fe6f4d97a7f73416d468e01a9671429b781a108c3fa18bd4dcfb12c9aecece411a426c205580bd7

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                5cdc67519c9ba2c556e034eed245dff1

                                SHA1

                                59953b041f1d895e099cc17ff614ccf89ecb66b9

                                SHA256

                                3113ae63cbca07aa0e462820d913e7243b69f4056cf78064441ed7795885a38a

                                SHA512

                                27f336122ee08a6a0d03cccb7562b9c0ebdd90ba524517d3f7a77be102999dbfe407efb99ce0646047f87e21d5cb943bfba2b97a3b998a99bfef491646631e47

                              • C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.11.exe

                                Filesize

                                2.9MB

                                MD5

                                6ba3f4d057686fee3f1f792df10d5869

                                SHA1

                                ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1

                                SHA256

                                1aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177

                                SHA512

                                79e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285

                              • memory/456-274-0x0000000180000000-0x000000018108B000-memory.dmp

                                Filesize

                                16.5MB

                              • memory/456-275-0x0000000180000000-0x000000018108B000-memory.dmp

                                Filesize

                                16.5MB

                              • memory/456-267-0x000002B4B4810000-0x000002B4B48A0000-memory.dmp

                                Filesize

                                576KB

                              • memory/456-260-0x000002B4B4650000-0x000002B4B4702000-memory.dmp

                                Filesize

                                712KB

                              • memory/456-262-0x000002B49A490000-0x000002B49A4A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/456-276-0x0000000180000000-0x000000018108B000-memory.dmp

                                Filesize

                                16.5MB

                              • memory/456-273-0x0000000180000000-0x000000018108B000-memory.dmp

                                Filesize

                                16.5MB

                              • memory/456-258-0x000002B4B4590000-0x000002B4B464A000-memory.dmp

                                Filesize

                                744KB

                              • memory/456-257-0x000002B4B4AD0000-0x000002B4B500C000-memory.dmp

                                Filesize

                                5.2MB

                              • memory/456-402-0x0000000180000000-0x000000018108B000-memory.dmp

                                Filesize

                                16.5MB

                              • memory/456-255-0x000002B498630000-0x000002B4986CC000-memory.dmp

                                Filesize

                                624KB

                              • memory/2948-26-0x000001FFC6640000-0x000001FFC664A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2948-21-0x000001FFA6C00000-0x000001FFA6C10000-memory.dmp

                                Filesize

                                64KB

                              • memory/2948-199-0x000001FFC2A50000-0x000001FFC2A5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2948-198-0x000001FF84890000-0x000001FF848AE000-memory.dmp

                                Filesize

                                120KB

                              • memory/2948-196-0x000001FF93520000-0x000001FF935D2000-memory.dmp

                                Filesize

                                712KB

                              • memory/2948-32-0x000001FFC6E50000-0x000001FFC6E58000-memory.dmp

                                Filesize

                                32KB

                              • memory/2948-31-0x000001FFC6630000-0x000001FFC663A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2948-30-0x000001FFC66C0000-0x000001FFC66CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2948-29-0x000001FFC6E20000-0x000001FFC6E36000-memory.dmp

                                Filesize

                                88KB

                              • memory/2948-28-0x000001FFC66D0000-0x000001FFC66D8000-memory.dmp

                                Filesize

                                32KB

                              • memory/2948-27-0x000001FFC6690000-0x000001FFC66B6000-memory.dmp

                                Filesize

                                152KB

                              • memory/2948-20-0x000001FFA6560000-0x000001FFA6840000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/2948-25-0x000001FFC6D20000-0x000001FFC6E20000-memory.dmp

                                Filesize

                                1024KB

                              • memory/2948-24-0x000001FFC6620000-0x000001FFC662E000-memory.dmp

                                Filesize

                                56KB

                              • memory/2948-23-0x000001FFC6650000-0x000001FFC6688000-memory.dmp

                                Filesize

                                224KB

                              • memory/2948-22-0x000001FFC65D0000-0x000001FFC65D8000-memory.dmp

                                Filesize

                                32KB

                              • memory/2948-201-0x0000020000000000-0x0000020000012000-memory.dmp

                                Filesize

                                72KB

                              • memory/4056-0-0x00007FFFE13C3000-0x00007FFFE13C5000-memory.dmp

                                Filesize

                                8KB

                              • memory/4056-19-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4056-18-0x000001499AC10000-0x000001499AD12000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/4056-6-0x000001499AC10000-0x000001499AD12000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/4056-4-0x00000149FE6F0000-0x00000149FE712000-memory.dmp

                                Filesize

                                136KB

                              • memory/4056-2-0x00007FFFE13C0000-0x00007FFFE1E81000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4056-1-0x00000149FE250000-0x00000149FE31E000-memory.dmp

                                Filesize

                                824KB