Analysis Overview
Threat Level: Known bad
The file https://hpdevices.cfd/#[email protected] was found to be: Known bad.
Malicious Activity Summary
A potential corporate email address has been identified in the URL: [email protected]
Detected potential entity reuse from brand docusign.
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-08-16 01:49
Signatures
A potential corporate email address has been identified in the URL: [email protected]
Analysis: behavioral1
Detonation Overview
Submitted
2023-08-16 01:49
Reported
2023-08-16 01:53
Platform
win10v2004-20230703-en
Max time kernel
209s
Max time network
207s
Command Line
Signatures
Detected potential entity reuse from brand docusign.
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hpdevices.cfd/#[email protected]
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc04d446f8,0x7ffc04d44708,0x7ffc04d44718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1768 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5968708389891949921,4203472873403631753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hpdevices.cfd | udp |
| US | 188.114.97.0:443 | hpdevices.cfd | tcp |
| US | 8.8.8.8:53 | ipfs.io | udp |
| US | 209.94.90.1:443 | ipfs.io | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.97.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.211.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.90.94.209.in-addr.arpa | udp |
| US | 2.18.121.76:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 8.8.8.8:53 | kit.fontawesome.com | udp |
| NL | 142.251.36.10:443 | ajax.googleapis.com | tcp |
| US | 69.16.175.10:443 | code.jquery.com | tcp |
| US | 104.18.23.52:443 | kit.fontawesome.com | tcp |
| US | 8.8.8.8:53 | res.cloudinary.com | udp |
| US | 104.19.167.65:443 | res.cloudinary.com | tcp |
| US | 8.8.8.8:53 | ka-f.fontawesome.com | udp |
| US | 172.64.131.9:443 | ka-f.fontawesome.com | tcp |
| US | 172.64.131.9:443 | ka-f.fontawesome.com | tcp |
| US | 8.8.8.8:53 | logo.clearbit.com | udp |
| US | 8.8.8.8:53 | image.thum.io | udp |
| NL | 65.9.86.4:443 | image.thum.io | tcp |
| NL | 65.9.86.50:443 | logo.clearbit.com | tcp |
| US | 8.8.8.8:53 | 76.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.175.16.69.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.23.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.167.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.131.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | docucdn-a.akamaihd.net | udp |
| US | 2.18.121.82:443 | docucdn-a.akamaihd.net | tcp |
| US | 8.8.8.8:53 | 4.86.9.65.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.86.9.65.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.84.9.65.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.121.18.2.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:9229 | tcp | |
| US | 8.8.8.8:53 | devtools.azureedge.net | udp |
| US | 13.107.246.67:443 | devtools.azureedge.net | tcp |
| US | 8.8.8.8:53 | 67.246.107.13.in-addr.arpa | udp |
| N/A | 127.0.0.1:9229 | tcp | |
| US | 8.8.8.8:53 | pelrosedevice.buzz | udp |
| US | 188.114.96.0:443 | pelrosedevice.buzz | tcp |
| N/A | 127.0.0.1:9229 | tcp | |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| US | 8.8.8.8:53 | 0.77.109.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| US | 8.8.8.8:53 | 15.173.189.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp | |
| N/A | 127.0.0.1:9229 | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a7ad9bb1054aa03e39b3554833d0c3ec |
| SHA1 | cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9 |
| SHA256 | 0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189 |
| SHA512 | d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276 |
\??\pipe\LOCAL\crashpad_1552_MXYMRSCRMMNHVFWS
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 68258a0cb434c9c74b7c0a02a1427928 |
| SHA1 | deaeb905456eed545bb13130e3479269f1763767 |
| SHA256 | a0a12709931f93f707b94070ab220adc122da5ef1cefd262c11ce80e8fcf5de1 |
| SHA512 | c2187c7edf391e955fbddd046be30a4b544ceca1e8a31c6061671344276806893a0534ffbf2313d96bf274476571a4b9225e92cb1f24e6f39487b1b6bd28a884 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d55cc538e9c4cf8a9c88fb745fe2535a |
| SHA1 | 8d0d44de3e1747f6ec1d5b6660b57e0184893dfa |
| SHA256 | 6f74f5e89cab4851421d7666e75d3f6bd499fc84e701766b5a830fa1a54a8880 |
| SHA512 | 003542c332243f26079206a343ad27e79c8b1371f458b317d258f8b2bc5373203a2867f510a13caf118f6546f092e47de89a5c45fd332b67932f3a82e85e5e66 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 9a8f78ebef5212654381764a520fb825 |
| SHA1 | 063ecf5106bf15bad2b6dfec79463881343fc5cd |
| SHA256 | 2e2589ae0be65b65e8b8cf2a853e0fecd66d8930f28503b173a951a092730be9 |
| SHA512 | d06560e93a8bf7168c0f9895bb4dfb0d24dc763e36104de64a7e2969cc0986ebe8be237181c8d7ace089bae8c25ed516a674225ae5a7af37161e5aed25dc3aa9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | e62cc4051e1f8eaa0abda5d730a2496b |
| SHA1 | d15346e40b196bc313cbfe5ac96b3c90b83345be |
| SHA256 | ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb |
| SHA512 | 3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 210b518ce2b3caf073aa78b4fdac0fd2 |
| SHA1 | 78a8acaf62d6805b1ee97e6bd73c14a06d915d3d |
| SHA256 | 0dcfe052cdd03aa118ca8e559c2b81286a4a09eaf38e91b056040dd1afde12cc |
| SHA512 | 340df5a9523d0aebaafc01e9f7d7d4f74a3aed436a3a066aa6a22edd7caeefd1a476e54eef6e06f0f15d12a6a7b8d99c7ea4f2541ab23d3978955a335cc528b5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 3a1118a48e890c7fa4b95b0dd0c496ef |
| SHA1 | d7022f44cadc94d7768545b0cf3e88d7b2510854 |
| SHA256 | f527d1c19e602f75e2212de3af70490d82c674df1c98ae2803bdf9fb2f9101dc |
| SHA512 | 3ef6cc2c990b906961066ea60d15474209f99fb695814d39529376cc44d8e9525671089f957391acbcddc0c6d83de6e24f8ba5a709144daa68af4df8b2b66cd5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45d28792-ab75-4e2f-aad4-f86693a7ec07.tmp
| MD5 | f93183555a128f1f05b647477a7ea195 |
| SHA1 | b1b4be5ce0393221dbc210d8ddf9b54038eb7695 |
| SHA256 | 194da0e8ea1156ee397e6094245234e601218a589f3caed0129193baff191def |
| SHA512 | ba9c0a6bb269d57ec8dd39e296fdca802691e6eb41f62750ad4e809d8edbbcb9afaf6fb11138afb0691695e311e908aaab8ba9ae0db802f0c3eefc037b431900 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 1cb74393250bc0abb6bea2fce300693e |
| SHA1 | e0bba60e866ae5ff5e3ff889ac48a52ad92d8547 |
| SHA256 | 1e6c203015474b422f606f78088601ad13e0be3dc70681ab890de409c29cbdfa |
| SHA512 | 996086e13fdc1d462243650126fca60c7f843d4bc97fe19622c7c36daaf1b97b98affd007a0e924a8a7b3a9c5e410c451dd5733a73f608adbef36b6da409c524 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5861d2.TMP
| MD5 | 3b2678e37c10b9b939ca3f658cdd4ee2 |
| SHA1 | 5b60d331d58b179a3d65a2de603954e1d677be4d |
| SHA256 | 2a7569a55678b861b4ce2cce28a55c207f55dbd2f9f158e223d3b1af6f9da5ae |
| SHA512 | ee3fe67b5cf7117c80d36bda8122d84c6b865bf8c5a9208b820a6e544ad4a6596a18d23f300861df38bed984138b82f3df509bf8a56d570218c25b515e5a65de |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 29c2492e433b09901eef4652bf91c940 |
| SHA1 | 231199fbb7dd4eff5bd486716fe30c1464ba5e7a |
| SHA256 | 3fc49e7bd750323a8b1af632d5039c04b6a2c44495325a2a46914ea1991ea69a |
| SHA512 | f2fc088258d85ed2bdf276fbf90893c5eb6baf3706368c90ec9d274aec3db62cd0cf51d8e2727372122683ec9b90dea7c007ccad8305e7a7fc0e6f8cafe7db2e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 0561ade6ecad344a6de87b12fe93c2df |
| SHA1 | cf04bc8be09c7674c80456ab30acb6f8ab5d5d81 |
| SHA256 | 8c12a7a373d1dad9a8fae0a37805c2a59962415f16d7e177a09018d8bbea989e |
| SHA512 | c037e554ea84e5a6f2ecdd8c97ec1d6681c3b3d4fc024ad9017518864ea56f95bcccee3c1a01a070c2cca045965f32c1456568c5e7e79890ebe665f69a51b16d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5c689252ce72152f72e5925c67cfbd9f |
| SHA1 | ade4451d5c73a0361814207d10cf1f8b7e00bca6 |
| SHA256 | 3386744a7128dd7292898d11e3580771fed137d7dccddcf0d2f0af9021f25189 |
| SHA512 | 16218b826192d1832e7f523ea344c43f29bca46dcac67b84a5a51e82abe6bd734c1fc9bbd2f5da06edbec48eeb11cd9ab6da9905d96b2e4d3b853b51e4b717a3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | bbdcb82018c60178e6aa259f168255b1 |
| SHA1 | fb53a56001e45ac4ff52558389fb4167d871b0d2 |
| SHA256 | 28e59f5ffd7eba069d1b318eea61aed9671868eae05bb21a4ca123f8013cee67 |
| SHA512 | d7e83bbee8a7cc41051735daef049c2dff22b38b4d16c0b767f9764df3c68fe87828fbaa32f93db5c7ee9277d6dcdae563d8bdd3e09ca7f9061ba562394b7a41 |