Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/02/2025, 02:36

250205-c327wawral 6

05/02/2025, 01:40

250205-b3wvesvkcl 1

05/02/2025, 01:26

250205-btzvqasmbz 6

Analysis

  • max time kernel
    449s
  • max time network
    451s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/02/2025, 01:26

General

  • Target

    https://drive.google.com/drive/folders/1_7sNA-v0GSiM4tD5VfnIqRm3617pZJJe

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1_7sNA-v0GSiM4tD5VfnIqRm3617pZJJe
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff977b3cb8,0x7fff977b3cc8,0x7fff977b3cd8
      2⤵
        PID:4376
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:676
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
          2⤵
            PID:3760
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:3472
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:1524
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                2⤵
                  PID:4148
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3572
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                  2⤵
                    PID:5116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                    2⤵
                      PID:1776
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                      2⤵
                        PID:1956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                        2⤵
                          PID:3496
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1212 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1644
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                          2⤵
                            PID:580
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                            2⤵
                              PID:3012
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15817013128972563254,1211609377596756193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
                              2⤵
                                PID:4192
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2508
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4868

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  554d6d27186fa7d6762d95dde7a17584

                                  SHA1

                                  93ea7b20b8fae384cf0be0d65e4295097112fdca

                                  SHA256

                                  2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

                                  SHA512

                                  57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  a28bb0d36049e72d00393056dce10a26

                                  SHA1

                                  c753387b64cc15c0efc80084da393acdb4fc01d0

                                  SHA256

                                  684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

                                  SHA512

                                  20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7400c17c-64fc-4974-9ac3-aaeaf4bb41ba.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  dde3a8183ed30e60c7983b28706fc858

                                  SHA1

                                  7bf43c26f1415af890d3fadabdf856b492562519

                                  SHA256

                                  64fe2bf719e87d0191141497a68342d4f27ee9b1b6f28f5006fb8d3ba2a51181

                                  SHA512

                                  ef1063857c3df26d4cb11eabecccd45df79d5226a6b27104b064a0d68e3284aa450c6a3dcfa171ed8dca6aa3a2c1d0007987477568415b6167b4c2789a6d73c4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b7aea94-c989-4d69-81db-fc74eaf18776.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  60e4a8caf314b77b64e108c78c57211c

                                  SHA1

                                  e5d00a1385f391472cbb21aae37519984a01d099

                                  SHA256

                                  ff80db4ddc095280e7ce74072c3e6c3dc488f3979b0dd83ec81422786843ddad

                                  SHA512

                                  0a4bfebe94c69de737bc5e741ee663de9877d88db6ac77ed6f472549248403e82eddda3377622107244c27ca67c6901005039432898ddf8a22fb8719f99276ff

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                  Filesize

                                  214KB

                                  MD5

                                  ba958dfa97ba4abe328dce19c50cd19c

                                  SHA1

                                  122405a9536dd824adcc446c3f0f3a971c94f1b1

                                  SHA256

                                  3124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607

                                  SHA512

                                  aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  adbd48d7dcc863243a1fcfc76342d969

                                  SHA1

                                  1de5a15b7952b6a704b1c24e7626ac85c7df4048

                                  SHA256

                                  3f1e5a8ebd9007eedfcd33dee8e27ad120f66342ad040a996a2edb15178395c9

                                  SHA512

                                  bd38645ed49363ab425fa79a37201e07b5a94738831325bb649d6bba25b675dd8036d65f4733c082d91cb33a2557d3a6f9a223e3e1190205974c467f8ac773d0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  9b2924f7946293ed899e5b36507462c5

                                  SHA1

                                  7f9700b27818acdc913949da2311ed87f870a45a

                                  SHA256

                                  728a0ecd0279937301f760042b4fb69604c8ff994937e439d30cbadf02267e13

                                  SHA512

                                  0872edb100114d28d7cae8cca8294692e7c8418da96c77fe23c421611b1f178d5d871dc35566040e12f78c0870f5973bb6bbe0231bfdb2fb93256dc9c99cc5bb

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  f00c9dd31e59eb18f63d8a4d96ee4f66

                                  SHA1

                                  0e952d338145c38b83e43d748eb60d41d112eff5

                                  SHA256

                                  d950d364c068901f8131ab94fd7db76510049aa3543f97efe396db8f051b74bf

                                  SHA512

                                  0f0567bd59f2d39dd85df45c11d146083eb504bd6720938b460dcbf1bf8c7731b2fcb963bfb12e6c4ef2a7763cdbd19ebf4ee2a9de747f385d647407681a69df

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  e83a5190ab9a011d87728025a1064e47

                                  SHA1

                                  14185ac37ee64ee343f5d284bf432f5bd6023659

                                  SHA256

                                  829c08fc3ebdd49b120dd57d927775ac3095324698a5a600c7ad2dee54874610

                                  SHA512

                                  71adc2c6927d90f66fc0ccb148a11d49bb40e29a03e2e6ed887e7a8b346c58ef264f81b119c4bb8987e3f283a13ba47553053a88f2a47dd16503f06af318aaa8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  5fffd571433d1a41cc5e073ffac5cbfc

                                  SHA1

                                  a020727aeed22e023215438fdfb44e503813336e

                                  SHA256

                                  7119f2e05a58bc1bca554c0502b260f664f5daf046d14d35aefab7cbd9035bb9

                                  SHA512

                                  118904f81934ef40706e89c49fda281a9fc47e7ca35c9228014f44b1b0b17dbc4262f15b0a34f1d43d81e56f6fdaf3ceaebece52073164ec2d24b96ce7a6efd6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  82dd1d86de4490dd0329ca5e2ed35391

                                  SHA1

                                  f2fc878fe00b7f1c61f9ab62d7895c43dc1dcc37

                                  SHA256

                                  0a10cb545438f566ee521f3a6b1fe7882e5281f9f096ed1a350cf16704a15a16

                                  SHA512

                                  72ae5c26a88bfa9c5e974208339d89f5c58ce82cdf3dfd413666769b24fd966e6117f81469b5cb9d81568dfb08e3e958f8bb18f435980af02fbad7328f71bcc4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  3KB

                                  MD5

                                  bbf1ed11385e0aaae8f1fa8986ccf996

                                  SHA1

                                  9fb03cb17367fb459d07fddbd5fccdb01f195339

                                  SHA256

                                  54c55871cfde0a515050388f3bed99f85fde46f2d656c6ad998c0455392f48f2

                                  SHA512

                                  3c51b94615943da9a204327ac46be5a2cb2aa3028026e0bfaef4eb51e11677c4e9215aeea322de4f4d99683c5c00fe29a7742d0fc79be2cb036dd015b9e6284c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  59241e7913d86182987d1b188e7c8351

                                  SHA1

                                  3226438a38ff778329a6babda1384e4a1a305e1e

                                  SHA256

                                  65db94ecf63cb698a513361f06121b31b2cfd0683c218e42a6ce430252d9caff

                                  SHA512

                                  aec6db921425b16f72361b4fa83981b69676a1d313c3545e6ade8782c921079daff8bf81e63075a621c791804e1f9799d10f211c70b982ef187a82f79fd06085

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  d766038e7cbcdbc50a1eb70121606840

                                  SHA1

                                  1dee38b62cbb7bc985936b393f26a831060e306d

                                  SHA256

                                  3e64ca6dfbccb02d670737dbfdedfccab7228a2b96c00e0efdb8900ea5db1b88

                                  SHA512

                                  88e67c26e6587a7f045fd31c3120096e3a52e1bccca1ed3969fb33b58d3a321e7cc5b124f3a1ed10496c2cc308aeaca3b249bae40a5a81ee92e26c112f752f07

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  e59d12968f4ae4d2173aa86b73751c88

                                  SHA1

                                  488412e0f6258bb4a449eb44ee976312e3fc97a0

                                  SHA256

                                  5acb1bf0bffe819a7606e407cde3cf12d613c20e1782cde6fc74fe8e8ddeb599

                                  SHA512

                                  13fb996ac7205a0a0fc605bee1a421fb40c55e1beabb55194f084eeeb1e349d040e1c535ac47ca4205b7f37642f479c2a33732f16101eebb685f372415d7039a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  f41c102b0a0f62999aafdce602ef1e86

                                  SHA1

                                  8ee3c580b579e089a6055dcf8edd72472f8675e2

                                  SHA256

                                  80f2bf789215cff16e53f0c6eaac9404699dda66013fcff05d3301eb5831c410

                                  SHA512

                                  2e8a70b95d7437452576b7130f5460dbfaaef76df7988640037f12f98e322d5d56efc2140e9a9f2165faac32d3aca3e75e1dbb2c219ebdcee4e256b60bcf2def

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  af599e35996a03c11788eb7f7caa493d

                                  SHA1

                                  6ea400dcd79cc9a5ba7651d77d8dc91ed73aeb29

                                  SHA256

                                  f6a6b58c8b56ab42d01011ac68cc9343e7bf1997e6da0b722341f721735c2568

                                  SHA512

                                  b96cd4034a573fadc753aaa28600adfadce6f232c1c920ce29c3fce433f814a0ec82d4ec649f0bffb4692141199e18caab2e78a25742311312b3e10ddaac8788

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  5665d6bdd2ade45040313a634fc48b5e

                                  SHA1

                                  9397e82ea5509f1ffd660922bcd893b88e534c2b

                                  SHA256

                                  6ef151d8a35ae386b43a98df9a9c3fb8881c67529e0027f3834195d278569714

                                  SHA512

                                  9cb8500fcf84acefb192bd3750796051d362de5b88cc28414de3e273aac33fa8ea5cfcae4ad3ffee6375c1d134e8ef0464844a28839fa04a331150a949bdcbe5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  751c622ca17cbe01f09822e18aef5902

                                  SHA1

                                  73243978121db49c2007268a664683c945ad58bc

                                  SHA256

                                  d2e6d7d432f3a8ff6d2f1d4439afcd16891d8d8cdf0f4c5b4adf120b04074a35

                                  SHA512

                                  5bca111b9803702a694998543a12c66306fa7523584b39ab360ce2f81ec288e56f93b9df1f7d0261d567519e6112370e27f2bdcc1e0d25efe147dd3d4bbbcfc0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  93bed69c48a4bafa32f79f77e28a889c

                                  SHA1

                                  22fa4a12913882eece4502ccec50b61a9c8ba6a6

                                  SHA256

                                  bd5b9c32197288022efadf4159df40b09fa82fa76f0f621fea8dad487e54c011

                                  SHA512

                                  c33e5a78031f07b68e343dd838b627ecbc8bc4d313f710bf755b87b7279707aa077bd5aad0bd48128c3c46113fb543d31ae03bc8f8dac0ade7cf7268c41d484b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  dc2847189840437aedbc12961945dac8

                                  SHA1

                                  95bcf1d2330c199650aba8bb6d35948eaf389bf9

                                  SHA256

                                  88f40e2fed1cebcd1249f60d778e03c632f22da2d9517598040c1f4061332365

                                  SHA512

                                  f869d0343119aeefdca9f5f59d9e6e4e7a58c535b7589cba82906fdea423aedb074fa02d4e25e522cacb6e6cf971467472400c794c095c6bf9d27873ada1ed11

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  749a763757dd951191bb604744f99117

                                  SHA1

                                  d2d419f1f9284658d5af86ba7f69bbe35c65d17a

                                  SHA256

                                  dd45fc746a3dd03bc50cfe53dbbc6d50cf064a53a062e24d531b7d22e2fefd47

                                  SHA512

                                  1de4fd31c245630e9573ef7b7dee2387187c3619113bb3247b1b6ad6c07f5b07c0f7061ac29ec5baba239767d8ef27d2a2365cea5ef32de57af8adc35a769f9a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  02b954f2a4ff5547f5dbbe121cda1f1e

                                  SHA1

                                  2b4789ba95e129272979697dc4563624f1d1bb74

                                  SHA256

                                  f0c232f4c8fb0ff989f9511f25ed6032edeef0dbb24a169e8c8f24660be12592

                                  SHA512

                                  e801d248cd45c962d4a871dca66e1c355e17720ca72432360f0c38dbcdba518443508493ae5803ab0fda2646a0ab87dffaf059b2f377949716b200c87dfac31a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  505f419469c6ff97dac34e11134c2725

                                  SHA1

                                  0ce49b36aa665ec3603e3cb7e3adc551bafc7150

                                  SHA256

                                  13e4c98d416d3b69f8543bf8dd6f60109af30e681bf4db867d8d65faa58dd872

                                  SHA512

                                  db32372de9d08178bb787eca7841d4e59794e3a64ded543a509daa4843d7ef13c653f082a234b7cbc791f7bdf4fb3ddadcd054160d0ba3acaf67dec80113a27c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  76e6d01834b177334ac35b5bd9350c48

                                  SHA1

                                  4ec311ee7520a373fa8abddd2ff692d3a0fd3193

                                  SHA256

                                  f736125857691feb7aa5d0774d427c3a2692f436352cf0acfd6e8d37fb5240a1

                                  SHA512

                                  ddb90099e0ab63fee269e7c3f7ba9df8d1024c7d5cb1c353aec297494d927c51adefda69778085fe82d827f0ec5025ef886894ec956603a0094693d098a68524

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  ab825bd3b48cccff520afc5f595f4cc3

                                  SHA1

                                  793752a4ce4f8a05a742bdc816e313c29ce73b71

                                  SHA256

                                  f3862d274c6fd0078f8c16532080f8cfd9a839dbb25d728bd6f6d2cb069bc170

                                  SHA512

                                  28d1c9f4df5e2b0753007eb11d0c186e7e0fd7ec20aa234cae3a0de95acce5f247321b6ea2efacef0cd4c3169972d8ded99e84a63845f49226a4927c9e06e172

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  a7a5054df3ce8f54c7e3a4a953b79ac8

                                  SHA1

                                  9f90e4e53c59e89f2189e5f49e7ac85a84bc3d04

                                  SHA256

                                  1d10febf5fa35de5db42648bbbd3aaac9a05344da63a06a91e4eaee090198468

                                  SHA512

                                  3c2e80e7bc9fa144023e90ead68e87c0ba293de5528557fe256f03199ed89e64911a17ce065aef75ec3b531a8de10d0c7c1748ce758d7e5bb64202164993fbf0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  cfe3804d865d81b1f677da32e310b21e

                                  SHA1

                                  e53d4b4f33b3071c97d14b619a35696e4a84cda9

                                  SHA256

                                  e3360bc0124facf8dc4e6c06a2fde48605e60c9d237d651cd9ff606132e354d5

                                  SHA512

                                  43aa6e9fdbb753335e82a7ac7bb8fa5c24aa23b882518f740d68c7eb2997991d5032aa138fcad998180db8ba747ed461063b5c4a4267578b61d9ceb1a8a61fb0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  de203c5bfdc7592182dc4b6e95f44364

                                  SHA1

                                  ddc47e55d6c2a52006f1c909f01c89523cfd2493

                                  SHA256

                                  26f79ef31fd023988238f19ce8bc28e9e4aa1ea128696993c2274f5aeb402629

                                  SHA512

                                  846e410cd45f60425a3f1463317f7da1a6407880c7e42bacfc5100f3c5fc890c0bf9db0df428cc59bac2333b95492dd4bd462b65a381892e3bd1f332ba09441c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  5d6653724e57da4d1cbd9f5e48736aa5

                                  SHA1

                                  8c56a4aea8586b6736a1e61b410c361a7cad881f

                                  SHA256

                                  ac30a4f509b9a3f2e9b80043547c0cac6fbb08c1c0d03f149d2c308549a10101

                                  SHA512

                                  a96a4d95273947d8be4a744eb5c2205933781af976609de11676d962296cc26fc21b778db97e864e010b1bf0d5d355a1a8aea8dd624d57cf10cd1a409cee46d1

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  b65981b655b509ab1719ac7ddb49aabc

                                  SHA1

                                  17dcc04f8bdcd46016e3c519a1f71a906f928a47

                                  SHA256

                                  2f51961264d3e31ca8a136a784f8611b10184cc22e62e02184b705c01cfe5804

                                  SHA512

                                  ccaf6646e9e66379692482c3d7670b1eec74c6ecbd29e815fe28c25cbabc842e3ad295a0a2a3f2a6f922333567b76c6b40e14d4945107479efff38c666a40436

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  53eb31ddb608f74d7cc6329e4ef560dd

                                  SHA1

                                  3c2946ba80833155d30bd75581cac0742300d7b7

                                  SHA256

                                  5748e05f25fd9e9615cf632995f192a8c9cfdeb7f063c700c1a190eea965e73d

                                  SHA512

                                  22f29af2c6f922b613c7d5409faa5bd588048c6dbe2f17beb33b99ab2a583e0fddba8084dd214ae8d60618dd3459c28580fe84a3b8840227fc535d181856d8f5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  f9f122126fc2f7cec8f6393b8924e6b2

                                  SHA1

                                  7877d661fa014bd048116313a804fb0882062485

                                  SHA256

                                  f9d7dded0672da293ce8cb43b71e8d517a9c7b936a04315b60543fe984bf1d99

                                  SHA512

                                  c8f5746aa6572ce5404015452c8d8532fc39037eaa3ff1c84379e1b9f3c460d227fcf69dfce13a1e7b8cb345b53a60cd0c5169e96a9cdf662767220df8c11303

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  f2f1770ee10f54c0ca35866594c545ab

                                  SHA1

                                  05e20d9e8ad122c3d8adbbd9872a7a558adaa44f

                                  SHA256

                                  15a7086bbb74706c1a3b0e15234e9292613579eb7bd0e418af759bf9764ed9d5

                                  SHA512

                                  ab7d83e0123e4132526ff9f8429a4a1b0739e12d62568c4c8f252a634ffe5f3903cf23257ebb1bb7e50d5955bf81ee7f13d946e22fc660821cb7c3f0a43b4082

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  ea1078781e97ccb7ffd1fbb836f8f683

                                  SHA1

                                  9a92e0a0962247c1adad768911002f3d903145cf

                                  SHA256

                                  1adf44b4070d91e75c6317bf858867d99318490f441a4e1b82a5ea6807965609

                                  SHA512

                                  eee9c64b0188e4e7bad4a4e6661d33be72fe625d2c949cf59ad5b2f4ad275415642c693db7f85bf4a3c88c16c3e7576c949398192bb2d7bd98f5661acf163ba5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  89ef47da2e2e77e0330ad815902697ef

                                  SHA1

                                  dd7a4dd13f269691824ae1f7cdd1f185cb674a0f

                                  SHA256

                                  44c56a496ac937cc2b60add740f72bbab5f9a2575373fdf2169008989cfa8237

                                  SHA512

                                  94975d48fabf75db6d8598d4ad598b12e757c46fd134c233d1878a1cc03e4362b8995f7efc9be81311e39bb1f886aa674714f68395c16ea81c09e626158aabff

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  a4e43909a76747fe3ec5822f595fd694

                                  SHA1

                                  8a7cc09e3ab8c71f7379c2722b7b405dc6524553

                                  SHA256

                                  04614f8e1df0c552ac4f5b393156d34018b8bfdda3e3715c64470aaf9b70efe7

                                  SHA512

                                  3553be77bb7857cbb11efd2ae1b8040bda3ebdd2428e0de5c729de550831be6ad8c2e6e2e70ccbdcb3128f5af9ac4f07002655e16bb5635901a6e9de98204cb5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  5790165744d8b02840a344956a1a943b

                                  SHA1

                                  4761df97392c3d92dbf193d8fab9296ebaaf91ae

                                  SHA256

                                  5106ef989a717b5c24f9c939ad61c33c3f7402b832da619e5b7c89986f56b979

                                  SHA512

                                  31e0b1c24a831c076d565a2b1a7e8cd37e010bd4a87652eb300cbf88561b55ee70b47e29a762216b6d41ce783e27ce3787ae699ff09eb2706082e3e5be203ff8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  61ffb19b9c283771f78be6c1cfb7dfc1

                                  SHA1

                                  2b53a9205207cbd93ba93dcbc75a607d58e22d22

                                  SHA256

                                  eed305c5d11b48b9ec6249343b9818ea3c161905ee81d01419995716d2f72a61

                                  SHA512

                                  c9b93c71b6688d52f993daffadc533ffa4dd7980ca6a7b7a56e04da07f025ef69a1c6d278417d21e6b1d19e682c701cba1b3a8c027e4bbf7e3e5d59054e40c46

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  a1c10e3848747374ab67d91b7aaff86a

                                  SHA1

                                  db7c946c7607c96076e14a53460d8733d6f32d75

                                  SHA256

                                  31a5b38eea5bead806590318b9235f92eae8fc2892616cb30c206216adf7837c

                                  SHA512

                                  1027e5b03a04a3302d91ed2ca735e58a0c0aa628cb498bd9b3b16ea0c3e4a25807554022dbdddf65e0d5422b813436e90538d4628bd720ee1d2b701d43c96a7c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  8e379f04fbac9aed0255df54aedcfffe

                                  SHA1

                                  aea01ab134a9a40790568c4c5826ef251ba30098

                                  SHA256

                                  0dc910f1db6c305ed6c85356343f97132a263458a1108070ba223a1252da69cd

                                  SHA512

                                  7415313c0880764fa9f42284ddc0a4ed298e6ca1d589f525750fbdf5dd7b3f940898d4ca747b355187cf873430e96df0e835b8e063b102ab81f3bc016ee42bc4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  22a94284f677e0945fe1c1ba99e7cccd

                                  SHA1

                                  feafa3e12853080c698c49915d3bcf13afc605d8

                                  SHA256

                                  9b79ad7c94f7f62b8c50c28ccfa3db99281f50b7e5054ebb6fd21799df10a224

                                  SHA512

                                  f1f405a62ab4def62e642ae3f86f6737989cf6a5a1c8afdace853b4dd02d2fd9c70932657e201edd06033bf0ec1d12e0eab9828b8deb8dc97ebb509feeb55980

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  6b0c7e16cbb3797ec34770096be9f4ac

                                  SHA1

                                  0f1913d31f6cbb117b6f40986cc340b5bce73c00

                                  SHA256

                                  a7e3a2c6a45475e6874524be40049707dc34590cc2a164020f4c971789e846ae

                                  SHA512

                                  88186c0cbe1395daae5c454641a29d69aa277b70b9df6e5f22008bd5a6c9d23a6b083b36acede7736b79de8f948de61e6f19eaaa3d336141420de41c0a891745

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  05ef6ad3330a5f60f108e01a998d371d

                                  SHA1

                                  d2467df7d8ce1a30a0374839765000647d2fc99e

                                  SHA256

                                  0ee9ef7e741b5c0f5d2a9145967be19cac12ae31ccbf756548991674b8d1cc1f

                                  SHA512

                                  1c90bf28d40dba38988794827e07a9850a271b8b087d0e104e3ed223cba11f386c7e7098b7287f640e49906da2d7690c4ea1fca2dbe6050612963fa1c8ef810a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  3d2c121f42ce06b18d5ca58122d89bef

                                  SHA1

                                  22fbd74a4ff962448e2889f8909703c1c88f9871

                                  SHA256

                                  d83f1b902f8ed7b76897d9ef3176c98c779ab6a78727cd990fa21991e53f81c1

                                  SHA512

                                  e4bc76339a5faccb553db25ab4376727e9e604f80e806a909a70391a29a4240109b58a266ff22b21242957302194db82d79e9440a35d2578b95ef57ef13eb749

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  b4892a17ee5d19b241bf93287046cc4d

                                  SHA1

                                  a2d9612e0c12090058148bd504e9f773a66bb851

                                  SHA256

                                  61e67b5d4333af9cf5ad715445aa872c8ce69761d4ae26bfb1b7fa99a01d63d5

                                  SHA512

                                  9603389f68b337b976f37d0d38f32df1a899c7612a9d8e3a5ce7d37f62f8b7fb5ab4356ecc7814a3fc9fdafe8821b168f3e74dafb5ae42465961836b15f74bf8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  bcebb9a95d71244eef2c280882eccb5c

                                  SHA1

                                  cfe06561dae9274fe2a3220c12c78a2283411e29

                                  SHA256

                                  bd0eb2c205ab92186e59e656c5d7921713b9a2349f5a38d875e8fc440e2a4876

                                  SHA512

                                  928d3d48c6333a9cc9033443e67568f87fd7b191f12dcb567c905959eab98ff79c140d70196389a938bc161926820e82ffdce3befb159ef6abdfb3f1bd88f4f1

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  bceeb89e65cdf3e20bf4d8663c6a8545

                                  SHA1

                                  a0a9253a7cfbd93b5212b44272f742cc7890b596

                                  SHA256

                                  d14f7eb0b314776b09ae91de9ae6f235f19568ba188bf7c06c6fd9c24c3c95a0

                                  SHA512

                                  5d22c5657ef4184f0e57e5109eafd22ca8ae26bed9cec11cbeea176825004244a0b8f5b91e8bd8adb84edad452e168c6b9f375d4094dbe1e940f9122d224c015

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e02e.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  481d6fb0aced0861ea6a0bbb70510f4c

                                  SHA1

                                  aaf0727d1e1f591863387797fe5e1c57c3df9aad

                                  SHA256

                                  ac6f0deb3fdc5f39b46e03bcbee54c7287070a7e4d56fede45e935a26579d721

                                  SHA512

                                  860bd7b90628c90d7cfa27e998b7849e71ac848d8db52621c87f8c447886d68d433f0ba0bfb502282233bf169dbcc0d84547b3746a2f7173f4f2383145603840

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af58ffb5-90bf-4a47-8c51-65d03541f56a.tmp

                                  Filesize

                                  3KB

                                  MD5

                                  5f8f20c167909e4e3f485e6c9da97cfe

                                  SHA1

                                  d6e9106a145eea1c11522938641cfdb8939190bd

                                  SHA256

                                  98e03ebd91a5a7e7bd8c67373a170cbd2e07e7ee28391add1199cc0e6d2a3de3

                                  SHA512

                                  cd1a8be19d3c79e6a8e2a567b7fe9cfd751c0cb60863dd883ddcdbaab1a1be641702d84380eb3ee22308b8ef4f8fabf42b3b42d20795bcab5eee8d72adfd8247

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  482ac7b1a5574fb3310f6d3c4e156292

                                  SHA1

                                  e4a488a9f071b4f8237cf2bb4a3440d626df56e3

                                  SHA256

                                  1051904d1bd77fb982e82c03b6ad4990c0dfccf52075b1e37f06650884ae30ec

                                  SHA512

                                  82dacb9b9268777443c7228d88a933cc390052664477a37adbcab2e96c3c9985dc18e6ecb3c3728e3332894306c4c1c8cbea5025baf804346bb0af705d949f52

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  84bd70008fc34f589b30f4d5f762d817

                                  SHA1

                                  02c32004c67688e3bf6e3f39e8384b31b5525ef3

                                  SHA256

                                  3a3b0fc256f2d123fc04d3089bdff24a3bdbe710ec83c84a841d580f769c5b39

                                  SHA512

                                  3ebdeb19e7e59db07ec5ff12b9a658f127bead2662dde2f007a44198f40cbfe072c50371ff072ff4c69fa6f84a590e662fff15bb43e2caaeebff15d4f3edc373