Analysis Overview
SHA256
eabc658deece003f4e76ef76fd0932a0a2d91e63725bb11daf07dc7052689b76
Threat Level: Known bad
The file Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe was found to be: Known bad.
Malicious Activity Summary
R77 family
r77 rootkit payload
Drops file in Program Files directory
Unsigned PE
Enumerates physical storage devices
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-05-14 21:37
Signatures
R77 family
r77 rootkit payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-05-14 21:37
Reported
2023-05-14 21:39
Platform
win10v2004-20230220-en
Max time kernel
132s
Max time network
132s
Command Line
Signatures
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0a26159a-6094-402f-a546-74fecc6d37a6.tmp | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230514233918.pma | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe | N/A |
Enumerates physical storage devices
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flingtrainer.com/tag/resident-evil-4
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcec2b46f8,0x7ffcec2b4708,0x7ffcec2b4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6149b5460,0x7ff6149b5470,0x7ff6149b5480
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | flingtrainer.com | udp |
| US | 172.67.177.160:443 | flingtrainer.com | tcp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 52.152.110.14:443 | tcp | |
| FR | 51.11.192.49:443 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | assets.msn.com | udp |
| GB | 23.48.165.29:443 | assets.msn.com | tcp |
| NL | 173.223.113.164:443 | tcp | |
| US | 8.8.8.8:53 | 29.165.48.23.in-addr.arpa | udp |
| NL | 173.223.113.131:80 | tcp | |
| US | 204.79.197.203:80 | api.msn.com | tcp |
| US | 52.152.110.14:443 | tcp | |
| US | 8.8.8.8:53 | 64.13.109.52.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 52.152.110.14:443 | tcp | |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | flingtrainer.com | udp |
| US | 172.67.177.160:443 | flingtrainer.com | tcp |
| US | 172.67.177.160:443 | flingtrainer.com | tcp |
| US | 8.8.8.8:53 | 16.42.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.255.255.239.in-addr.arpa | udp |
| US | 172.67.177.160:443 | flingtrainer.com | udp |
| US | 8.8.8.8:53 | 200.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| NL | 142.250.102.157:443 | stats.g.doubleclick.net | tcp |
| US | 8.8.8.8:53 | 157.102.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 52.152.110.14:443 | tcp | |
| US | 172.67.177.160:443 | flingtrainer.com | tcp |
| US | 52.152.110.14:443 | tcp |
Files
memory/3592-135-0x0000020025130000-0x0000020025164000-memory.dmp
memory/3592-138-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-139-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-140-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-141-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-142-0x0000020042B80000-0x0000020042B88000-memory.dmp
memory/3592-143-0x0000020042C00000-0x0000020042C38000-memory.dmp
memory/3592-144-0x0000020042BD0000-0x0000020042BDE000-memory.dmp
memory/3592-148-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-158-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-159-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-160-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-161-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
memory/3592-162-0x000002003DBC0000-0x000002003DBD0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | cd4f5fe0fc0ab6b6df866b9bfb9dd762 |
| SHA1 | a6aaed363cd5a7b6910e9b3296c0093b0ac94759 |
| SHA256 | 3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81 |
| SHA512 | 7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676 |
\??\pipe\LOCAL\crashpad_1760_XHYVGZZRXSMMPRZV
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
| MD5 | e5e3377341056643b0494b6842c0b544 |
| SHA1 | d53fd8e256ec9d5cef8ef5387872e544a2df9108 |
| SHA256 | e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25 |
| SHA512 | 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 1d40312629d09d2420e992fdb8a78c1c |
| SHA1 | 903950d5ba9d64ec21c9f51264272ca8dfae9540 |
| SHA256 | 1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac |
| SHA512 | a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | 437fc3ab366adb766ea1ba168acede1a |
| SHA1 | 42d5c9c32c724811d40fc6ad7b7c4722edd73cd4 |
| SHA256 | 1133b28e26f46766c346a4b355f55cabb7df6bd8c278debf9ce7eb65aba2208b |
| SHA512 | b042c5335dc8f7ff097c8917266f314a10cc86bf7da6cfa869085e6c0466302ab183517763824dee8003544dcdef6c08b4fd9c8f191412303c365fe15b7e66b6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | cfbc16e33dcbef6f773f0f79af528f45 |
| SHA1 | ecb8d5e8107bc671dd57fb2a137c00bffa419f1f |
| SHA256 | f0937890fb1053069baac97b7992c6d22cb74cae20317fc05d51070d96950ffa |
| SHA512 | 59ac2ead1eb84edffb06867850beb1e63f72c5b5415abd2fd4e7c2a1922c368f612d2a0288c00e32d5da47c4a77968ffbe72660a8d1f577f44fb20df9c11a4af |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 72554d384c3b2c0fa7e0fe27f7f8cd7e |
| SHA1 | 9f17d54a3d45886bf306d1ad05f61b016a802061 |
| SHA256 | c4f6025a08b2f039b3965ea84d5d45b7fb5f8cecd8d478bc1d55e831eade70ee |
| SHA512 | dac83acf3018ecc2f2d0a12693f13c534eb9d96ae89b3852ba24b5201fd822172ea7feae5f01c078c197ccf56dd45f0f43a79db97ea2587d0fa0f389ad7a2e5d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | b18f10d32d237323efc457870ef12e9f |
| SHA1 | f67d3bc008faba349cda9164a8d60e79a425221a |
| SHA256 | e1bb1a01aec7bc41d7a0a4fca28f8ef4413c60dfd4a839e5faf41d662272a65d |
| SHA512 | 765fa9838dc201ae3071804622408bbef3f3792d3ae912aff50d4316a65bcdcbf28459cce4c2bf55455f8211a80dfb12858d6612eaae5741f8f5bc345b6519b8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | fd83df544eb13d9fc060fcb15868f3c9 |
| SHA1 | 6cf9bab2e858f48b129f6a0e780fb3e7ea787779 |
| SHA256 | 71fc5adb402e998f96a621a29a2d372e624b187a2d93b23f9b951bef67de7573 |
| SHA512 | b1816db8e4a20845514f2b044a41f61fe0b9ee41ea6113f1a0668155f2d2c56efc9f6505a0e216e44a94f82025717bc1daeaab7749d1af374718c6a5db3613e3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 1463bf2a54e759c40d9ad64228bf7bec |
| SHA1 | 2286d0ac3cfa9f9ca6c0df60699af7c49008a41f |
| SHA256 | 9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df |
| SHA512 | 33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
| MD5 | 333454bda01ba45f66e1a4360a29a678 |
| SHA1 | 746a9f7f05008fbb7b93823bb6921a8e5ae4efad |
| SHA256 | 9dda7af758e6f090a23008206fe3cd0f2ccf56488cc957dcf3584a6d5f0089d8 |
| SHA512 | 35d35bfd59e06002dbd2f1457ba874b0e88bc0d891910ac5bd1d5212fb93a2d877bbbcd46481fc30fee671fc80615c4c188ac796b9af8ac01bcaa1d8cf6ae42d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
| MD5 | 475f3b2f4b6829f089f959d8291c69ab |
| SHA1 | 10cfe4b0bad5e7fc4c1bd4c4f79f9cc32ed93c99 |
| SHA256 | 4f40a7d3b7ddf8e77c9b9556b37cdbc062bda1e20757b4c709adcd3ee624b219 |
| SHA512 | fb2b2fb4b86dac393e35c42e66e327af699fa1c6baefdeb4ce9f95298990faed0ad556475d16ba6ad31868412f6179d996cff7c15329f4ef92778be592e9d712 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
| MD5 | fe970a61a83588570c1913a79bc7e7ac |
| SHA1 | d57efc6b197ca294f5c4ba4c4c940f457f431427 |
| SHA256 | a471fe27162867fcdedb0e25a0377cb9c7cdd00bd2e497c953a36941577f9714 |
| SHA512 | 43b03c39fe9c25da07f67bd462d70d224634af8377adf395d8d1c9d3823f498e3958ef48024ed41da315aad474a2345d21ee5221154b3ce53082dd9b87e25b14 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 41030666ef123b714e8540ed37d0f5d7 |
| SHA1 | f927694bb6e95df745550bf939765d8c4114c26b |
| SHA256 | adc6beddcf04664d1301e12cb7d7bd93aa73b955e24ceca9b01a147410ba726d |
| SHA512 | e7bff93bb5e02b5a562d6b081e5a5ea7473b4e459eb12f45af9b1bfe3f8f8e1a9eedcfc314f8543e49b92069067e5ce7e7673716967062ae79cba1a73f300d83 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c44421d3cb3f2b6792b7dae2b1766031 |
| SHA1 | 39bcb205307f979c499a235b2d56322af4809838 |
| SHA256 | f2fb68dfcb28c807d6e4e5a3b0051e9dd6f551bb7e2054acad02c144382f53d9 |
| SHA512 | 5d8aa27591a6dc2936a6b0b2b642ed9573a69210e879c2fa0f2fdcceb9ee2d86fa7b86200c6455be8a2e1e5b8b262948524ba1e967bc15383abfe3096f61415a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 1e79203d0f70092bf25058099947d5c6 |
| SHA1 | 20d5e2bd3a2ef807207bc3981bd5494c34839c0e |
| SHA256 | decca6fa6de1f0dcc2b46a7c45e62d1754fda43b509d92393c628d56930851a6 |
| SHA512 | b06c5cb26083e2ef7a407be262f37d83d9fee4788e30a94ce258639f7c1fb2ccb4e37ca9b77e4fb30c0fa0a9e80f94a5b9719efd2499c87deafc87d260eb0568 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 1a450187ca2f1f90b1bb17ad7dd147b6 |
| SHA1 | 3019b8c77c4e5f457a70e377e89e92faac7f0a98 |
| SHA256 | 8df9efb8fd7f25549f5478b7cf8c75d832a934045996b7418f0e769f0b076bfc |
| SHA512 | 6f952ac8a7312045dc0e9353ea53019a92ec86145151abbf82f628b6fab3a9b4b0b7f36d075161b54ae8c99e19a69e6e8a2003ee320364a66a85bab14a123b0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | ed4c2248750d47befa0ddf5c46bccf0e |
| SHA1 | 2f1f3e0c19507cc516fb8dda93756791652213a5 |
| SHA256 | e5cf27dde98d93f5bacfa7c194ea6be7ee34eac2bb4318de4e35dc388333b92d |
| SHA512 | 85e11295f92f0b40eacc104651adc4174827e690e579ff15dc66645602da197dbe0fb6941f9b8a8651fafe74c73a04117f11ff62b24b1c1f22d446f9a26e65a6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | bc6ec36ebafbfba03a3f0d85954d7be6 |
| SHA1 | 9b2b66ffbee538c01871e4dd160bdb1116d68d66 |
| SHA256 | 8e8ff537b25e85ff7f50db7417fa5b63e4d96c54f05bda926880538f27347761 |
| SHA512 | 486098ac769770c3cda75613837b32faf383a25ccd689859c9094592a4459556952edcfdef606f41ecc07edf72f29ee42ed34ec8c529f9608ed0cfe5c90081cf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2c7fae479ce85d9765ad9a3a91ec2d4d |
| SHA1 | 4af3c28886f28cb82f582116c9059c232b766f3e |
| SHA256 | c6d711464f46e537ebfd1fb236b82f085cdae6de033da26a35adcb2bcc56ddfb |
| SHA512 | 8021329455c6d56d637c894ad4150838aa2ecd5fc6c9651ae4b1a3bc0c263267fac65fc61ac2ec0fb8e5b09ab559324425c31e24b59ab0f3148ca81d4b0dcf90 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 91040ecebb8e5d4355ae1354da24af86 |
| SHA1 | e78a051e094bda104170b72391cfcb0f7b463645 |
| SHA256 | 7a1fb2aaa9c98687d0cbb8160f4f2656031774a86408f6cfe07149a410b1ac20 |
| SHA512 | 69c3b253c221490832137529d6bb3ebed617394a06352d808d2f5ee5813f0564aa9d6e4fc50e46af360ceceb2a3244151c55fe2e0f86b26f7206a26681099664 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |
C:\Users\Admin\AppData\Local\FLiNGTrainer\TrainerSettings.ini
| MD5 | a733986b23235e9df2ed8652044f4718 |
| SHA1 | a6b37ab6584096eee4e0bb79013773eb752bfe83 |
| SHA256 | e34c9e06cdd656e5b901c1eedd6d28aa595ceebd80e3c585218980fbd5a9c473 |
| SHA512 | 635f58eed8f3af8e3b167b9b7825589e17f2aa638449961a11c4c54538c8d262fca7a35001dc3bd1a86aabe7030ddd03e66757aa6b3882ae7c8f99c8aa3389c6 |