Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 13:10

General

  • Target

    Free robux.exe

  • Size

    78KB

  • MD5

    224ffc7642433a54523e38d9bd28a7b4

  • SHA1

    45ce3d4b4161a916b6c3c1126fe19bf1a0ce9490

  • SHA256

    e81c03f063eb81973ecbc690961658b9d613e1648c3612fbc1ffdd41fbf1f7b3

  • SHA512

    1960f6a2bb79f258c0e78d056caf7a384eff84bd50439eff68a85cdedab416d2623607cc98351d457b5f2cb1e89096ca99a06b8210ec749dc44f050427ae1eb3

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMzNDc5OTg4Mjg4Nzg4ODk1OQ.GYogWp.NMtpgtuN4Hf6PsEomIL-OoyUKqRkEVtf5alRts

  • server_id

    1334800372321222707

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Downloads MZ/PE file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Free robux.exe
    "C:\Users\Admin\AppData\Local\Temp\Free robux.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5064
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87e8546f8,0x7ff87e854708,0x7ff87e854718
        3⤵
          PID:4476
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
          3⤵
            PID:1968
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3648
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
            3⤵
              PID:4840
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
              3⤵
                PID:4080
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                3⤵
                  PID:3904
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                  3⤵
                    PID:4752
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                    3⤵
                      PID:3776
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4684 /prefetch:8
                      3⤵
                        PID:2328
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 /prefetch:8
                        3⤵
                          PID:4676
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
                          3⤵
                            PID:4544
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4480
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                        1⤵
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:1736
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86c5dcc40,0x7ff86c5dcc4c,0x7ff86c5dcc58
                          2⤵
                            PID:4416
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1880 /prefetch:2
                            2⤵
                              PID:4948
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2220 /prefetch:3
                              2⤵
                                PID:2772
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2472 /prefetch:8
                                2⤵
                                  PID:2536
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3200 /prefetch:1
                                  2⤵
                                    PID:2860
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3452 /prefetch:1
                                    2⤵
                                      PID:1784
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4564 /prefetch:1
                                      2⤵
                                        PID:2080
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4744 /prefetch:8
                                        2⤵
                                          PID:3368
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=5064 /prefetch:8
                                          2⤵
                                            PID:512
                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                          1⤵
                                            PID:2248
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:3988
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3160
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:3308
                                                • C:\Windows\system32\AUDIODG.EXE
                                                  C:\Windows\system32\AUDIODG.EXE 0x244 0x31c
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3544
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:400

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    8c76af55119b92d356d15ffe98a210d2

                                                    SHA1

                                                    2174c899beb83cbf2cd549ab430612e6ce769048

                                                    SHA256

                                                    283bf58804c733f376bc9213e79bf126e9a9d05408e44edb991cf7f27f80906d

                                                    SHA512

                                                    81ea3faa31bb90f3c5dd3d9b4b29844837942f7f55bbf61100736fd072018cc03caa448230a3fe438de7f52cd9ff0f23f3f1b2d7758b866b2b8c18f8e3171c9b

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                    Filesize

                                                    2B

                                                    MD5

                                                    d751713988987e9331980363e24189ce

                                                    SHA1

                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                    SHA256

                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                    SHA512

                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                    Filesize

                                                    356B

                                                    MD5

                                                    de7c0f820981c1f80bd72fd9224ce14b

                                                    SHA1

                                                    7539d8dfbf1b7d61777d1058be85be11e9404079

                                                    SHA256

                                                    acd4d3aeeabe08b723763dc80a1072929ff46e69e04d5ba63c6a9a4ee8c41e62

                                                    SHA512

                                                    bee7bd1caf9b89205731509c4a4e64ba020c724c4c9cbd8102830b36ea5067745e0099cc2b2715c5e88c9cf6c1386db290e88d8f81ce3cb02ed7e72e356ca79c

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    a127b376b45d77f19a030bd59be75990

                                                    SHA1

                                                    2d7873c916afc377b003f4164e81cb77a3cae0a3

                                                    SHA256

                                                    500a3356ef0be8e79df188bd6a3f3f7023fc55e0ead37d0804d31e49d924f4bf

                                                    SHA512

                                                    d0baa05c7269e587ee0baad935c7df8b4101a5e16d0737d3f224bbe14bec849b9bc0a6da19454f74194ac3ba79835d98846298844c2689485e35e19c122dcbe1

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    de6897065bc94b93d5d696fb7c7a5bc2

                                                    SHA1

                                                    4ac1c448266e07a9c28b15c8a4b210995a6b2732

                                                    SHA256

                                                    31ba85dad86b4edad8842508f571200f39617d6aaec3183c404f65d8028cdee7

                                                    SHA512

                                                    d5ed5257d817cd04d07491d14583b7aa04e254f9177896641da5cf37323d38d4a50860f0677d4f6bb2e57c5abc72bbbf58827795838f08f5dce5c3dccb70f958

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                    Filesize

                                                    15KB

                                                    MD5

                                                    c784f472a9578f9ccf35c232720385c7

                                                    SHA1

                                                    c1f8b4f00d856df1ff6fc4cf9d873dcd06475b28

                                                    SHA256

                                                    d4c79b19bb96a4572775643a390c0d7dee38726a88209dcb326fe36dcbf3bb50

                                                    SHA512

                                                    243c3ea506f03af8531417abc8f24b9be34f58636ac7460ef97a156ad5ef17d8a53d3de1a5c550b18bf75a5d5471693423c9c0c065579a473b6c18c314410fa9

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                    Filesize

                                                    242KB

                                                    MD5

                                                    ac83c7369c61901cd0a95db837a919e3

                                                    SHA1

                                                    64e3862fd9329217c5f95e39e2ccf9533e6d768e

                                                    SHA256

                                                    7bd1ada028ae6c04900833c64c4aba501b92d447f11e02aabfd36cfac5293301

                                                    SHA512

                                                    4c70878f0be41194d74053312279abf06a65ef545d392270bca991ef625a48b83685ca707854e9ca12b66636d8fd3969f4dbde6b321fa78a90705ef4d41120c3

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                    Filesize

                                                    242KB

                                                    MD5

                                                    ec3d154427958268f7e9c68556e4f006

                                                    SHA1

                                                    f295b5cf0d62d81ccc85e97854d2e220363ed240

                                                    SHA256

                                                    239509410ebb086a5c813195bb17bf1173b76880777c1a88a600a7d38c93538d

                                                    SHA512

                                                    dfbfa0f2f773b43e2acd230072fa1235f3d588ffd7ccd9eedc99ed7085b40f90f2147b9663a8f7653d1c65c325aa640338482fcb41a0bfb901af05d890b2689b

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                    Filesize

                                                    264KB

                                                    MD5

                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                    SHA1

                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                    SHA256

                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                    SHA512

                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    709e5bc1c62a5aa20abcf92d1a3ae51c

                                                    SHA1

                                                    71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

                                                    SHA256

                                                    aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

                                                    SHA512

                                                    b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    bc29044ff79dd25458f32c381dc676af

                                                    SHA1

                                                    f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

                                                    SHA256

                                                    efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

                                                    SHA512

                                                    3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    456B

                                                    MD5

                                                    bd3af1c2823c67ea40a0adf5c01e00e7

                                                    SHA1

                                                    58d394710be24774db8b802e1c6ae438cf8bfe5e

                                                    SHA256

                                                    7b02ae3707221fa1d2d5a54970098173b1120a1d0aefc1df75a3c972de45de4a

                                                    SHA512

                                                    e5a5020ede05a022c85500bf136c3120f51a27d9647ea9a3585a5dd0b005745b85f088719ef7597d95a3a1d4c1bb46b518da2e557aab6c250d9b824f0148c8ac

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    0710d124cc5ff1e1abeccd651e6e9878

                                                    SHA1

                                                    782b50f97e95d63efb900ba4b2b386534904d0ae

                                                    SHA256

                                                    32a22975216479e28859228ce69918deac709e60e1f786b0a73e83d886ea2b50

                                                    SHA512

                                                    07f59e2d4864adab45b476154e8a93dacd09a657982842ced4b527817c5ccaf8b4bd19dbbc23fe5431a628164014e2fece3f03392b30e1085d3f20f990ac7264

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    a187bf15cf3fe3e26e7a44d80aa259ac

                                                    SHA1

                                                    3f8943d52badfd8d35ada0dccb247e388e695296

                                                    SHA256

                                                    ad97e218f2516a422b2fdfefdd1a22cc2ae09213b05966dab2dd1a71c7a47bfb

                                                    SHA512

                                                    29afd125062eeb3a6c61d1ebecae960d42b1cdf0b633ae8a5daef506e4624bf2cce810444ca677dcf627af41328f3ae7baee0c92bb522d588000d2e159ab69f3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    a6fbba73b9c8fb6186dfa6b16466e7af

                                                    SHA1

                                                    334b5f98ff8d842e5aae23a38088f8b29802e66f

                                                    SHA256

                                                    eb4f8c18ca136f7ac7301e26a610b19983852d90b597c5565a441476bc381422

                                                    SHA512

                                                    ade95fccae9612aa5ff3c306000f9c7a6625312ed66f76117a1ff5f89b9bf5e7886241490134b76958c4ce1d05ff562b1f7a79b9bb07d1046270638bd6bd3641

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1ef7849a-0475-42a0-a455-1efe5182c235\index-dir\the-real-index

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    472210a8475e680edef72aab6599d3c1

                                                    SHA1

                                                    5ce15190d20e10316af50350589d7d0b373d34b9

                                                    SHA256

                                                    2c38ecaf24319e4b8db52b6380bc4efafd1799cdec1c767afcd266e364dd960f

                                                    SHA512

                                                    7ad011ae8c40da6fb405ed9da0c97c4c037093bb7514870d7648b3e9b6c64a01535d84ed1c0356d71abfac30867f272f81dee390a69858d9e86f53efa6f816e7

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1ef7849a-0475-42a0-a455-1efe5182c235\index-dir\the-real-index~RFe599486.TMP

                                                    Filesize

                                                    48B

                                                    MD5

                                                    caff7ded3e71babf4ff4482ef4124f3c

                                                    SHA1

                                                    c8e92fe61e4f4aa87a551ce9009dba5fc5566758

                                                    SHA256

                                                    5060457ca4ba41fd83fbe635c3d9f7d08dc853ff6b2b1c3b15e80706a5fc34f3

                                                    SHA512

                                                    171ca0ec3dc2e2b431b6c3eb63878290ffd8d9618be9f875fd614eea018e3fdeb3d43094f460c4bf112447c826886d8b5d15422c1c9da1a6738cff7a26de150e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    146B

                                                    MD5

                                                    fbc9dc6329393c3571dfccb0dcd05a63

                                                    SHA1

                                                    e5d9413e6f95676830913ec777e44790e0c94eee

                                                    SHA256

                                                    11a2d6520d2784ab856d59dd3034cab85688686a0e0f8dbcc652c499559947fb

                                                    SHA512

                                                    fcf9d0472b0806fc3534a190ede8a8d3ba5b0276f53d187b695195b987473450028d2d6cadf6b5ac849c21cdf036a0e4b35b7f69aebf438bb2ecff35806b0bc1

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    84B

                                                    MD5

                                                    877922d78432177b66dda4f589f7ee7d

                                                    SHA1

                                                    84795a418c2bfd2906081c147914485ba4118210

                                                    SHA256

                                                    a3c24fd4679d565e8f492ef9db66647758fcd809ffefff1e4753f3795ad6917d

                                                    SHA512

                                                    3611d4049394749bfdbc53d3e635335e50c103fbb208a6df31a8715cc907e5450386c7f37922c2ff0038321db58f53246a3632e1c459b581d2d6ee250b92cf7c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    89B

                                                    MD5

                                                    ffdc1e57bf924a4b5bab1ac3a5f7d318

                                                    SHA1

                                                    e32269f817159a382068b47068e7934ed85a86cf

                                                    SHA256

                                                    d93d1ccab72d8817387e304ceadef5af455d310e1589018b76dcaadc50884414

                                                    SHA512

                                                    0e9eacf3f3584b0df8e07c6d36eb753ba1ee149b172743e3ae7db7e0575b8f40819198044cf74ce8e4ea59ab57ec6550a7980b2b32810f04e30ff397df319d12

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                    Filesize

                                                    82B

                                                    MD5

                                                    4ad9c82c2be39b50a6a4b43c8fe3c633

                                                    SHA1

                                                    66de221168f88dae1153540447394343d7dfbd52

                                                    SHA256

                                                    460e1589a92e25edf68dac1b249877bacff0f18da05e4e1814d438fc4f56c971

                                                    SHA512

                                                    24407e24fdc82ee816d9218f4e4606b55d0dd0e91b2bb4a7e069971ae29de1706ed291bebe0b30471e15cc9331496fe548e217ee1d5cfe125aae0a8e33267ed7

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                    Filesize

                                                    41B

                                                    MD5

                                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                                    SHA1

                                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                                    SHA256

                                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                    SHA512

                                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                    Filesize

                                                    48B

                                                    MD5

                                                    05337bbee89b3ca3cc0a36c8eda145ac

                                                    SHA1

                                                    168990cff707fae2f3f6b75ed87a307167396e40

                                                    SHA256

                                                    e95a5768c60649c934e1ecf32ff3b408ebe8c7073a9e5cd6b6711caf63359145

                                                    SHA512

                                                    a1360edd6a4dc29e9488da31656ba9741972565408141a94051a9502774d46faa1ed9383d348261b73b32e451b340ffec528c2388824dd2ef6ff17149d1e2625

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5994c4.TMP

                                                    Filesize

                                                    48B

                                                    MD5

                                                    6370d4a28bee82d423ccb0f5dd0922b2

                                                    SHA1

                                                    533fb5f214eeb519515310158712c213fd2d5726

                                                    SHA256

                                                    3d7ba0837c479c0208a352332f9f18daa0946c98abf1d89e8578f442fd10578b

                                                    SHA512

                                                    b734948c0fdbebe248b019f3a9cb7bb1f4ccdbbab6ec28f5b613e665d384bb74008e8617663de393ebbd38efcb6bbe6d9997c0cc86497f1b48ecfff89686a848

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    206702161f94c5cd39fadd03f4014d98

                                                    SHA1

                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                    SHA256

                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                    SHA512

                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    26f041a2b1ffbff9c32c6b5ee79c1c13

                                                    SHA1

                                                    8482ad2087fc601bba37371e8209c7acca87fe4f

                                                    SHA256

                                                    50736d24b4c624f40994f8dc8361e0e9d5525490af9b34069a83d6e3e7e383db

                                                    SHA512

                                                    a84e0930a281d259a2d335c5cf2d9d32e9182dcdc98c4ce6a2acfbcf1974ef2b247a83a7d60c560355aa58f1e4a190f4eae249ae760569acdaaddbde360ce8c9

                                                  • memory/5064-0-0x00007FF8701A3000-0x00007FF8701A5000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/5064-1-0x00000214E7040000-0x00000214E7058000-memory.dmp

                                                    Filesize

                                                    96KB

                                                  • memory/5064-2-0x00000214E9710000-0x00000214E98D2000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                  • memory/5064-3-0x00007FF8701A0000-0x00007FF870C61000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/5064-4-0x00000214E9F10000-0x00000214EA438000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                  • memory/5064-5-0x00007FF8701A3000-0x00007FF8701A5000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/5064-6-0x00007FF8701A0000-0x00007FF870C61000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/5064-534-0x00000214E9BA0000-0x00000214E9C16000-memory.dmp

                                                    Filesize

                                                    472KB

                                                  • memory/5064-535-0x00000214E99F0000-0x00000214E9A02000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/5064-536-0x00000214E9A20000-0x00000214E9A3E000-memory.dmp

                                                    Filesize

                                                    120KB