Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/02/2025, 13:08

250206-qdp3xavrgs 10

06/02/2025, 13:05

250206-qbq77avrbw 5

Analysis

  • max time kernel
    177s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2025, 13:05

General

  • Target

    http://roblox

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://roblox
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dc0946f8,0x7ff8dc094708,0x7ff8dc094718
      2⤵
        PID:3396
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
        2⤵
          PID:5044
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3348
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
          2⤵
            PID:2280
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
            2⤵
              PID:3572
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
              2⤵
                PID:3900
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                2⤵
                  PID:4556
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                  2⤵
                    PID:852
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
                    2⤵
                      PID:4820
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1780
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                      2⤵
                        PID:3568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                        2⤵
                          PID:2428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                          2⤵
                            PID:4668
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
                            2⤵
                              PID:4052
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17708048582716536758,14667085764490972352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
                              2⤵
                                PID:5656
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4180
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2740
                                • C:\Windows\system32\mmc.exe
                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
                                  1⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4040
                                • C:\Windows\system32\mmc.exe
                                  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
                                  1⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3040
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  1⤵
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:4044
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8dbd7cc40,0x7ff8dbd7cc4c,0x7ff8dbd7cc58
                                    2⤵
                                      PID:2600
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1896 /prefetch:2
                                      2⤵
                                        PID:3208
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1884,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2136 /prefetch:3
                                        2⤵
                                          PID:5652
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2476 /prefetch:8
                                          2⤵
                                            PID:5544
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3168 /prefetch:1
                                            2⤵
                                              PID:5520
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3252,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3420 /prefetch:1
                                              2⤵
                                                PID:5776
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4584,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4580 /prefetch:1
                                                2⤵
                                                  PID:2908
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4776 /prefetch:8
                                                  2⤵
                                                    PID:6056
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,6097229736725959994,2291576207340180584,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4804 /prefetch:8
                                                    2⤵
                                                      PID:6100
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                    1⤵
                                                      PID:5856
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:6024

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                        Filesize

                                                        649B

                                                        MD5

                                                        e084133155fd5fb68c9240e4d99164ae

                                                        SHA1

                                                        1c66ee4bb0e0b3daedb61e93650cb3020b4aac2a

                                                        SHA256

                                                        0c71bc9fef8f6958cb3d78fc801646112a3c19e2664ae93bb6f136a72ffc9300

                                                        SHA512

                                                        cc64338a6fe3b5d5246ee126661ab591231fbb0ad4c8885a71ffad7a3feb73660e5c9bb65ebe7262650e5a38a2f2999e7065c819730aa84f1b2850d9a5de8b4d

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        f3c761a1a08d162603078ff2050efaac

                                                        SHA1

                                                        273ecdc51a4fdb949ec9be95f4786f1889ad34b4

                                                        SHA256

                                                        ad54b83e6b8cec47e5b6a3c6543b52a71175bc4d769a1fa032f291e945bf37af

                                                        SHA512

                                                        14273ed73d262f16f1bf93f3435a6b0898a238d34c6023eeb9b37fd81e509eadc51992c4c22b5807d8fd6d352fc93d222fabc4de41d34af35d82f9e119e6e146

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        a7b5a5433fe76697fec05973806a648c

                                                        SHA1

                                                        786027abe836d4d8ff674c463e5bb02c4a957b70

                                                        SHA256

                                                        c8d623536ebdf5ffbefb84013d1c8ff5f853b59f1b09c80364c32b8ed5e4a735

                                                        SHA512

                                                        27be4c82e26468bbb9ce698ef305320f6cac46c953f88c714a0372fa524d098b9af2a87a88b14a134ff0f5f4b3d671902908622d2c7ec48e2c7bc458d7f5cc16

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        8ea156392347ae1e43bf6f4c7b7bc6ec

                                                        SHA1

                                                        7e1230dd6103043d1c5d9984384f93dab02500a6

                                                        SHA256

                                                        40b28bf59b3e2026ad3ebe2fecf464a03d7094fd9b26292477ad264d4efc1c75

                                                        SHA512

                                                        2479b86a9a31aa2f260ff6a1c963691994242ced728a27ffa2ee4e224945446a191bdb49ce399ec5a7d5d362499716133072e97d4253b5b4f09582d58b25144f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        111B

                                                        MD5

                                                        807419ca9a4734feaf8d8563a003b048

                                                        SHA1

                                                        a723c7d60a65886ffa068711f1e900ccc85922a6

                                                        SHA256

                                                        aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                        SHA512

                                                        f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        a1a743cc0b5b1b15db890679c136506e

                                                        SHA1

                                                        a73d6e027a31018580559fdaef1896cdfd2d0d47

                                                        SHA256

                                                        58a5476476f2cf51218451c166f021797b4327bf2822ce7f235e87826e1afb6c

                                                        SHA512

                                                        87fc085d5b201ba0983fc0bb9ad4a779e50fcb50cee3374fcb1b95f8d221c0bffb235418f543103cf5fd86755d755802d6dd1e1ed26b616b91f7e7750ac2cb0e

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        f824773e199201e5f794a66e9cb625e4

                                                        SHA1

                                                        a4a346ad73edfe95c16a92ea3fbc67f94011b846

                                                        SHA256

                                                        10b35004f86dd3087e4426043cc471b33a7de7ca88da05167893085b40bd06e0

                                                        SHA512

                                                        bd819b61e7656078ae4c9f080e5fa7b52adeba08de453b655f78b1d7747a668318840327a598296aca25732c9a7ae64b8857760c18ba47b1df870c794c30d3a0

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        8f9e3ca9d8dcbb3c2a41420554b018a1

                                                        SHA1

                                                        b8842c32df38035f3528a3dced386636ff9a4c2d

                                                        SHA256

                                                        fb83c7fcf75bc6d1477ff3009ab09c3dd73bb17ff8e7871822cd6fe406db09c2

                                                        SHA512

                                                        d0bda59b45d0e05bf772f3aea90518a98d6fabb14f49bd5febb2193ad98bd964b6f07b969e5fb32a078bd5b6127b2d8950bbe29d1854bf6ea4a0b163e13dfe1d

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        6b764bacf3cb09609dc009ec51e56487

                                                        SHA1

                                                        77edf068b71aed2a27a2d4a8903d50aa4e649355

                                                        SHA256

                                                        c3738565662aab1ed6e7bf771f21ec3ad9c8cd715986c200e570f370a4c6e173

                                                        SHA512

                                                        4e65c2c2f3af927930d70cdffd8e5abfec099dc5715d1cdfcb7d1074d2b3a8b74731dbd2df8aa811b687843c2f766fe9522bc9e68a4e99363eea759383b3182d

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        5a7074b781e199e6973d917293f8d856

                                                        SHA1

                                                        fea5d1a1b9ff9afb046dd5404d7c43023ba7b855

                                                        SHA256

                                                        98a8b1d719c754a8c113ee5e2fa4d99783054e3b292478fed8d85a498f723afc

                                                        SHA512

                                                        3be533e56babed49fe63cf7cf3055c08120373579d6ded724de941fbdd2a9f300cbfe8163b24b59306f02ab6a87b2b8c2769424d02f59bbb011fff2c71b6f2f1

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        2bb1b6887def00558e06e4a90ee20f00

                                                        SHA1

                                                        d789d94bf3671d0b01baa3f14fd1c5dd4df1215d

                                                        SHA256

                                                        03a346aba6d15010e51a238c4902e3b4aebd45bff7bd0e472c36e04ee49b9b15

                                                        SHA512

                                                        e477c02508131b54bd49aca624c7fe5b861900f9e4105c89366b3847e8ee4b3b2f71c9826b3f32ce466c74884a09979226b3b76a7c5ab13a98b1a92abf653c84

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                        Filesize

                                                        264KB

                                                        MD5

                                                        0abf87138b87eee197ebc0993783a7c7

                                                        SHA1

                                                        7806dee08c4e2ea061da8bc260c01b1d8aaf699b

                                                        SHA256

                                                        fdc34e90abc7fd6fc1628708e3e400ed4256b7266b9a5886f356c7ad89c2a824

                                                        SHA512

                                                        31c5c57efcd220e5cad0eb77b38c79e65a3eeb7472fa821076ddf5af8da4c88ec6688c8e12ccb3328e9474646fa844048350b262d083de004168365f6579110b

                                                      • memory/4040-178-0x000000001D920000-0x000000001DE06000-memory.dmp

                                                        Filesize

                                                        4.9MB