Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2025, 07:42

General

  • Target

    http://marketplace.visualstudio.com

Malware Config

Signatures

  • Detected potential entity reuse from brand MICROSOFT.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://marketplace.visualstudio.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b4718
      2⤵
        PID:4896
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:2308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2864
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
          2⤵
            PID:5092
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:1940
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:4540
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
                2⤵
                  PID:1124
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                  2⤵
                    PID:1680
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                    2⤵
                      PID:4732
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                      2⤵
                        PID:1440
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3464
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                        2⤵
                          PID:5084
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                          2⤵
                            PID:2964
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                            2⤵
                              PID:1712
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
                              2⤵
                                PID:1080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                                2⤵
                                  PID:5020
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
                                  2⤵
                                    PID:620
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
                                    2⤵
                                      PID:2096
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                                      2⤵
                                        PID:1552
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
                                        2⤵
                                          PID:828
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
                                          2⤵
                                            PID:1512
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                            2⤵
                                              PID:3372
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4748
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
                                              2⤵
                                                PID:392
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
                                                2⤵
                                                  PID:3976
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                                                  2⤵
                                                    PID:4184
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                                    2⤵
                                                      PID:4376
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
                                                      2⤵
                                                        PID:4032
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
                                                        2⤵
                                                          PID:4228
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:232
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:1016

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            85ba073d7015b6ce7da19235a275f6da

                                                            SHA1

                                                            a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                            SHA256

                                                            5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                            SHA512

                                                            eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                            SHA1

                                                            010da169e15457c25bd80ef02d76a940c1210301

                                                            SHA256

                                                            6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                            SHA512

                                                            e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36b6f671-6a59-4d3d-954f-7a3334dd13c2.tmp

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            d233a5a459399230daee5c6c55870c0f

                                                            SHA1

                                                            263aff287add6504b23c04004fd5297e387801f9

                                                            SHA256

                                                            6adfa27cc8807a0fab413874b431d50acf8b7fb24b8a6aefe7921113baae14d3

                                                            SHA512

                                                            0b4ab646acdba7de1075c87934e6ea86802b4aff4339edacfbc73b0fd09a5bf4fa843a3c8958c7cba91225b31749d093b5e1fe6aa48f3fbe16dbc14ff0025e7e

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                            Filesize

                                                            110KB

                                                            MD5

                                                            a445c33b2031d0b578477e099f96e1b2

                                                            SHA1

                                                            58448f2892886556bcf925aa28a1b93964d27553

                                                            SHA256

                                                            7cb659b6178db5a4c858c7b7e405accfaa3af745ce8bb68c001d9dfea67254a0

                                                            SHA512

                                                            de36e77436a72336f4fa06c736ddddfd3b45b5c9e46d83f4ba374c3c4577bab3d110dea3638cc97a2724da39b234f2b134dde50818c4d7d64b1084754a64f80f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                            Filesize

                                                            23KB

                                                            MD5

                                                            11581f2c579626703f87b1400030fde9

                                                            SHA1

                                                            872762abda91d6bf615641e61be8312259b7a885

                                                            SHA256

                                                            4d71ec24b2d3fc6977f9fb48eeeba5fa5c43e4af68a08e74a0dd16e6fa4fcb62

                                                            SHA512

                                                            1fb315c50f4731fc2e9c15eca6837346efb3a611cb3d0cebe1b1f2908be66e199b5df14021ef489f918b7a8dbee7b8b3c95f17ca290e09010cc2ec28bf790d59

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            dc2d5fb9081a5ef4daa01a646f48d042

                                                            SHA1

                                                            be74147d857b8988eaba8e5b02da5535f2a1fc42

                                                            SHA256

                                                            7e06cb38189933934bac4379f0f67fdece35589b496aaab20b096c73ed0d62ea

                                                            SHA512

                                                            a04d569879dc414e10527b027e0bff4268a60c6d9ac8967c3466c215d3474fc1f64d2ea4fec3105af3f83b35423a0b83dbe828244ab01ca322aa430a37c9f79e

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            528B

                                                            MD5

                                                            f50c78af74fe4fc1a0b0bfc14478422c

                                                            SHA1

                                                            cb7c4da5a2f92995f2b3cc99bace6ccf07e98205

                                                            SHA256

                                                            c295a670b56853eab28b2ca6be68a61c1e2da143a3714c7f02c2740c09033667

                                                            SHA512

                                                            789bdf2af52a1e8ba7ec3805fed6d1958fb3942f8230065f02d49e07f90e87223a54b925ccce9d9b3df5cd0feafffdc4dff77de0b32771160685758018f95179

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                            Filesize

                                                            352B

                                                            MD5

                                                            3b784a1d9523594ee66300f6ac91238c

                                                            SHA1

                                                            c5935bcc5068e5e49e30525b7ec0fa30010675e1

                                                            SHA256

                                                            95e295f814d0a2a35ee4541cb0102d5a51f2ca2db4e7b600d49d446a424e7edf

                                                            SHA512

                                                            a7cf6b6709141829ec67f1a8ad736f8f7c6b816c8707f05c9cff4cd53b49a4e6e4ebb954088bc843e8ed4eaef36fe7eaf29de0c41ef80331cabaf1b1d15d40ae

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            2a905900213665052996b394c44a5154

                                                            SHA1

                                                            43934f9b25008f1adae2b1909e89c8d7fff136fc

                                                            SHA256

                                                            d4a1fb72c4716543228eac22a3cac041093578087a0f31e6f741faf868f3c37d

                                                            SHA512

                                                            e47dc1d1ba029be663dbe40caa7740e8b9def9899ebebfcda70e53526bdfb17dc04112e959a12478539eb481a161fa6cc4e7d65472352e51ac0151ae4eb732b9

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            1557cd4e629438a104c456cdfe53b22a

                                                            SHA1

                                                            99488e296538e18044efc57f39dfee4edab1656c

                                                            SHA256

                                                            7a62ec71598b78a41f169af033b8bc953d8d689c62c3578d76e54ecd8435f08e

                                                            SHA512

                                                            cb02ff27a77b1f8ba354be79f9aefc0764ffc056a85f9dbfae8ffb5bf8d976a1be466efae573af093e6553a976cbcefde8a38441fd1bb52ed09e34f4782e4c2e

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            d3d3d1dba571d39ed5585b97b8cda8a4

                                                            SHA1

                                                            2bb2dbe47e71afa329a311ba01e67fb706e89084

                                                            SHA256

                                                            64a1fdcadd87e302af7ff19fe3c55c94238389350a12d1c3fa31c16fd7b92448

                                                            SHA512

                                                            34d301c3ee0955c2cf767d528a948a92882189cf883191311dbad89410c84492e563e3c6595593ed85f6441b2a56a0fb3d3cb64dd644d9d3fdc913c6a6548c05

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            371B

                                                            MD5

                                                            3ba96b80c48c63249978760aac174e19

                                                            SHA1

                                                            b872c068f96589bbf8031957c13abcb7e53e68ad

                                                            SHA256

                                                            0d969898dc9ee857dec6438c75baa9119173f899620d2a665874960da95373fa

                                                            SHA512

                                                            ccdbd534c54c5c08874b52a0b0ad90d47799fceea55963a96d4524dbb2ce2797647eeaa5db310f5e9bec687579f282784cdfdefcb17e576c0c71b9c10c57d6c2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            371B

                                                            MD5

                                                            c12cec9ae227b8a3a1cd675d2ff46218

                                                            SHA1

                                                            eb4635d52ca4e7c1c381523883b043062be2ecb4

                                                            SHA256

                                                            4ee0c0c3bbc4a24831a7547fd787c6ce593127c3f84ed12830f29fd10ee28116

                                                            SHA512

                                                            b000561e4a7f555f6ec252325995a3ad42c47b7690a340c55759743972393db3cade5b8eb18ceed8d53f55271ccc6091a0ba9b01af809830fd1b6fae5caf6a57

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            874B

                                                            MD5

                                                            d1c1c4ed21a3d37917d86efc0a717ce4

                                                            SHA1

                                                            e5819a11395a745544e2f2b20525ccd311e89e22

                                                            SHA256

                                                            f5393f4f3ecf4c48110dbaaaa14d9f12e5b6fd68656a2fbd46e71b099d2b8116

                                                            SHA512

                                                            93fcd4744b8901cef4deb7d6087bb092241d0f5e2c82fd52f34a70ddcb0ad6058d00cf23f8a9d2119809349fdb7f392f69e75fcf0afeba95bcbdd92ef96e10fb

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            371B

                                                            MD5

                                                            01881a48d1ced16986ff0e2883a18a93

                                                            SHA1

                                                            ffc0fda0cf94cd8a5bdf9d7ead846b8537fe9fa2

                                                            SHA256

                                                            5cde5c843646941dcf0a75efda44998d858417bf1719a6f8f01aef90d6b09684

                                                            SHA512

                                                            d43759e6c1d70676ffad9a6b519d9cd4a57dcf4d7d6ff92870c623c64ceb756d7b84452be6c0313b0aad876f92ed6c85cd74a9a603214f5e4348f0791c7e15f7

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            874B

                                                            MD5

                                                            a71ff49565178f115ab64b5369463a98

                                                            SHA1

                                                            112fca97efce8bc04158a8ac262c9d6c313ddaf3

                                                            SHA256

                                                            827026cef99eb97410b5b081cac25aaf99b27bdbe1513a9bb73e4584962f0244

                                                            SHA512

                                                            9629cd3afa521801daed7859c4b55e02d2f3099d33c053918ce51071801f04a2e51fe8e92a9042881a97c236fbf2fa8bb553cbbc368421b2e2d45b0b13fe4bb3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            874B

                                                            MD5

                                                            e75c8f59c2103426dc27678d3d295303

                                                            SHA1

                                                            94dab5075685801e200d6937495e49944cf1488d

                                                            SHA256

                                                            9cbb0fec20362399404dd7d5b162668e775061d58176c56b10295cae27f11f2b

                                                            SHA512

                                                            5d7ed477f3ea03874133fe33fd8cff17e57415810bae78d499bcb0ff33b2552f28146f8f09cee15282d3142bf85be827b4412fc58d05a833309067fb136c51c2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            371B

                                                            MD5

                                                            b427f7d8c88488f0bce256cde10f9346

                                                            SHA1

                                                            50ff8f3f9bc51e0729d850f6c02cfb8163743e9b

                                                            SHA256

                                                            e0813bf3ea999e14275d9b40f6793f01a5c68a774796a6ded76bd7aea143157f

                                                            SHA512

                                                            3c584efc37d50722f4fadd90622e4504f98dfe0b9033131b0f531aa3d997d56d1b259431f4631294011a769229d9dacedf2f98c989ec76f9d4fb03edddb24f56

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9ab.TMP

                                                            Filesize

                                                            371B

                                                            MD5

                                                            1018b278c4d6d7ff9b7957b8b9c78930

                                                            SHA1

                                                            fc482857218a3a28dccdc33a13f660bc2cb3da70

                                                            SHA256

                                                            e401e56d978598cd8c1965cdabfb4db32b6059df3cbc3a28cda5155b36b49c8f

                                                            SHA512

                                                            c030c26ec3cac80831dfffac43727800d8018c8e9122eb184d74437520dd32ecae553e7a7822ccabafa83f8de3c1a2d19e64ac04f71702e4d532198bf94333f3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                            Filesize

                                                            16B

                                                            MD5

                                                            6752a1d65b201c13b62ea44016eb221f

                                                            SHA1

                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                            SHA256

                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                            SHA512

                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                            Filesize

                                                            10KB

                                                            MD5

                                                            0ccea395c730c0e9c74071b76475be01

                                                            SHA1

                                                            b185e234625b174098c4e5ae197e601369982256

                                                            SHA256

                                                            3c62c4d33eea17f23d7aef1e773584c4bdc2ba4cd4ccaa07ff67475fd1668300

                                                            SHA512

                                                            872518638035079b512ad904593237e213150e69b59be4a80c26acf07147913aa9c86315f38ed299f2c99d7f3a2d3f1b44229b2efb4ec735224c86f591c152b9

                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                            Filesize

                                                            2B

                                                            MD5

                                                            f3b25701fe362ec84616a93a45ce9998

                                                            SHA1

                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                            SHA256

                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                            SHA512

                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84