Malware Analysis Report

2025-06-16 07:20

Sample ID 240601-3xmhcabd5x
Target demonditzy_tag.mp3
SHA256 778f324b9de6cebb960cca0559324538e9ac3c073ab614e8166eb3fa95cbd061
Tags
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

778f324b9de6cebb960cca0559324538e9ac3c073ab614e8166eb3fa95cbd061

Threat Level: Shows suspicious behavior

The file demonditzy_tag.mp3 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Checks processor information in registry

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 23:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 23:53

Reported

2024-06-02 01:38

Platform

win11-20240508-en

Max time kernel

2689s

Max time network

2609s

Command Line

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\demonditzy_tag.mp3"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\unregmp2.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \Registry\User\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\NotificationData C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3001105534-2705918504-2956618779-1000\{26015429-4893-4ED4-9EC0-379C8D0948FA} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe23000010009bee837d4422704eb1f55393042af1e400000000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\efe51be18da84f708d12ab274d0036a7.MOV:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\unregmp2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\unregmp2.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 3252 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Program Files (x86)\Windows Media Player\setup_wm.exe
PID 2968 wrote to memory of 3252 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Program Files (x86)\Windows Media Player\setup_wm.exe
PID 2968 wrote to memory of 3252 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Program Files (x86)\Windows Media Player\setup_wm.exe
PID 2968 wrote to memory of 3484 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 2968 wrote to memory of 3484 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 2968 wrote to memory of 3484 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 3484 wrote to memory of 904 N/A C:\Windows\SysWOW64\unregmp2.exe C:\Windows\system32\unregmp2.exe
PID 3484 wrote to memory of 904 N/A C:\Windows\SysWOW64\unregmp2.exe C:\Windows\system32\unregmp2.exe
PID 2044 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 2292 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 4424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 4424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2044 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\demonditzy_tag.mp3"

C:\Program Files (x86)\Windows Media Player\setup_wm.exe

"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\demonditzy_tag.mp3"

C:\Windows\SysWOW64\unregmp2.exe

"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon

C:\Windows\system32\unregmp2.exe

"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa8b13cb8,0x7fffa8b13cc8,0x7fffa8b13cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3624 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3588 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=paint_preview.mojom.PaintPreviewCompositorCollection --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4960 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6880 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 162.159.135.232:80 discord.com tcp
US 162.159.135.232:80 discord.com tcp
US 162.159.135.232:443 discord.com tcp
N/A 224.0.0.251:5353 udp
US 162.159.134.234:443 gateway.discord.gg tcp
US 162.159.134.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 status.discord.com udp
US 162.159.138.232:443 status.discord.com tcp
US 35.186.224.25:443 api.spotify.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 162.159.138.232:443 status.discord.com tcp
US 35.186.224.25:443 api.spotify.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 35.186.224.25:443 api.spotify.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 25.224.186.35.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 35.186.224.39:443 dealer.spotify.com tcp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 162.159.133.232:443 images-ext-1.discordapp.net tcp
US 162.159.134.232:443 images-ext-1.discordapp.net tcp
US 162.159.134.232:443 images-ext-1.discordapp.net tcp
US 162.159.134.232:443 images-ext-1.discordapp.net tcp
US 8.8.8.8:53 232.134.159.162.in-addr.arpa udp
NL 23.63.101.152:80 apps.identrust.com tcp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
BE 104.117.77.210:443 i.scdn.co tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 216.58.204.91:443 discord-attachments-uploads-prd.storage.googleapis.com tcp
GB 216.58.204.91:443 discord-attachments-uploads-prd.storage.googleapis.com tcp
GB 216.58.204.91:443 discord-attachments-uploads-prd.storage.googleapis.com udp
US 8.8.8.8:53 91.204.58.216.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com tcp
GB 142.250.179.234:443 media.tenor.com udp
GB 216.58.204.91:443 discord-attachments-uploads-prd.storage.googleapis.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
NL 23.62.61.97:443 www.bing.com tcp
GB 146.75.74.167:80 www.twitch.tv tcp
GB 146.75.74.167:80 www.twitch.tv tcp
GB 146.75.74.167:443 www.twitch.tv tcp
US 8.8.8.8:53 167.74.75.146.in-addr.arpa udp
US 8.8.8.8:53 static-cdn.jtvnw.net udp
US 8.8.8.8:53 api.twitch.tv udp
US 8.8.8.8:53 assets.twitch.tv udp
GB 18.245.187.16:443 assets.twitch.tv tcp
GB 18.245.187.16:443 assets.twitch.tv tcp
GB 18.245.187.16:443 assets.twitch.tv tcp
GB 18.245.187.16:443 assets.twitch.tv tcp
GB 18.245.187.16:443 assets.twitch.tv tcp
US 44.234.242.118:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 44.234.242.118:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 8.8.8.8:53 16.187.245.18.in-addr.arpa udp
US 8.8.8.8:53 43.39.156.108.in-addr.arpa udp
GB 146.75.74.214:443 api.twitch.tv tcp
GB 146.75.74.214:443 api.twitch.tv tcp
US 8.8.8.8:53 pubsub-edge.twitch.tv udp
GB 18.245.162.86:443 cvp.twitch.tv tcp
US 44.236.131.42:443 pubsub-edge.twitch.tv tcp
GB 146.75.74.167:443 k.twitchcdn.net tcp
US 54.202.197.88:443 irc-ws.chat.twitch.tv tcp
GB 146.75.74.214:443 gql.twitch.tv tcp
GB 146.75.74.167:443 k.twitchcdn.net tcp
GB 146.75.74.214:443 gql.twitch.tv tcp
GB 146.75.74.214:443 gql.twitch.tv tcp
US 8.8.8.8:53 passport.twitch.tv udp
GB 18.245.187.75:443 passport.twitch.tv tcp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 42.131.236.44.in-addr.arpa udp
GB 18.245.187.68:443 edge.ads.twitch.tv tcp
GB 18.245.187.75:443 passport.twitch.tv tcp
US 8.8.8.8:53 75.187.245.18.in-addr.arpa udp
GB 216.137.34.137:443 d2v02itv0y9u9t.cloudfront.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 143.204.72.118:443 static-cdn.jtvnw.net tcp
GB 108.156.46.4:443 usher.ttvnw.net tcp
GB 99.181.79.18:443 video-weaver.lhr08.hls.ttvnw.net tcp
GB 99.181.79.18:443 video-weaver.lhr08.hls.ttvnw.net tcp
GB 52.223.203.214:443 video-edge-d92552.lhr08.abs.hls.ttvnw.net tcp
US 23.160.0.0:443 global.poe.live-video.net tcp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
IE 52.95.115.196:443 aax-eu.amazon-adsystem.com tcp
GB 18.154.84.35:443 sb.scorecardresearch.com tcp
US 8.8.8.8:53 0.0.160.23.in-addr.arpa udp
GB 18.154.84.35:443 sb.scorecardresearch.com tcp
US 8.8.8.8:53 35.84.154.18.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 54.202.197.88:443 irc-ws.chat.twitch.tv tcp
GB 99.86.114.46:443 clips-media-assets2.twitch.tv tcp
GB 99.86.114.46:443 clips-media-assets2.twitch.tv tcp
US 8.8.8.8:53 46.114.86.99.in-addr.arpa udp
US 8.8.8.8:53 vod-secure.twitch.tv udp
NZ 54.192.177.32:443 vod-secure.twitch.tv tcp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 52.46.143.56:443 s.amazon-adsystem.com tcp
NZ 54.192.177.32:443 vod-secure.twitch.tv tcp
US 8.8.8.8:53 32.177.192.54.in-addr.arpa udp
GB 13.224.246.122:443 d3aqoihi2n8ty8.cloudfront.net tcp
GB 108.138.212.72:443 dqrpb9wgowsf5.cloudfront.net tcp
GB 18.245.150.73:443 d2nvs31859zcd8.cloudfront.net tcp
US 8.8.8.8:53 73.150.245.18.in-addr.arpa udp
GB 18.165.198.31:443 m.media-amazon.com tcp
GB 18.245.150.73:443 d2nvs31859zcd8.cloudfront.net tcp
GB 18.245.150.73:443 d2nvs31859zcd8.cloudfront.net tcp
GB 146.75.74.167:443 k.twitchcdn.net tcp
GB 146.75.74.167:443 k.twitchcdn.net tcp
GB 99.86.114.46:443 clips-media-assets2.twitch.tv tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 8.8.8.8:53 177.76.201.54.in-addr.arpa udp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 54.201.76.177:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 8.8.8.8:53 i.scdn.co udp
BE 104.117.77.210:443 i.scdn.co tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 20.42.65.92:443 nw-umwatson.events.data.microsoft.com tcp
GB 18.245.143.116:443 panels.twitch.tv tcp
GB 18.245.143.116:443 panels.twitch.tv tcp
GB 18.245.143.116:443 panels.twitch.tv tcp
GB 18.245.143.116:443 panels.twitch.tv tcp
GB 18.245.143.116:443 panels.twitch.tv tcp
US 52.26.2.41:443 video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 static-cdn.jtvnw.net udp
US 8.8.8.8:53 api.twitch.tv udp
US 8.8.8.8:53 cvp.twitch.tv udp
GB 146.75.74.214:443 api.twitch.tv tcp
GB 18.245.162.86:443 cvp.twitch.tv tcp
US 52.25.185.210:443 pubsub-edge.twitch.tv tcp
US 52.36.107.195:443 irc-ws.chat.twitch.tv tcp

Files

C:\Users\Admin\AppData\Local\Temp\wmsetup.log

MD5 fe5fa91959f3855e29ad9a33dc62f7b4
SHA1 5b4f8c1a06f837c75e3d043a5a3c3988d45892b8
SHA256 1a77c94c3303cac873782fdec38931c9ece529efd18dbe8501c9062bf525bda0
SHA512 b13c9ad077db211747a0d42f59bc7bcd6f889123898db084e596b96e191db2523a00c2b83bf79733d5ecfec5fb6f534db451e7c34ab21d565b4e35335f483b46

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 d35defde3ad3faecd5955399986c9785
SHA1 7762067bc38abb0654f552bd5967404c57954ea3
SHA256 69d351f5546d8e20aed4549148ce8b8344faa65fb64e00b248028ac408922319
SHA512 cabff3a74b4b18b87b389f74c383dd79f33f17504a239deb35bb0ccf0d6f9e20b638d136ef8b3b7390f48a16e4f9398f264cc714766c8f7c032124a8737d84d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8294f1821fd3419c0a42b389d19ecfc6
SHA1 cd4982751377c2904a1d3c58e801fa013ea27533
SHA256 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
SHA512 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d

\??\pipe\LOCAL\crashpad_2044_LFFPPVGVERPUAYWK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 390187670cb1e0eb022f4f7735263e82
SHA1 ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
SHA256 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
SHA512 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b174f0a48cf28e8f4cc6404e31502208
SHA1 83e3aa5707669084ceddd541bbbf95ddd670b304
SHA256 74f224ef813108b4ae210aa948df549c46dcfcf35a2e25366c6ce5326e1b6c1e
SHA512 02e40affa557ccba8458d10786cbd400f8cf4d7d7ba587e1c992aa97edbabc5f0ba242ddf02ef84d8e1aaec4093bc3f082613e022535751af13ed27557ecf37b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 da671321edeefa22aa4052865ba5b6f1
SHA1 9fb3d982ca735a4929c438a68135a963e54b1221
SHA256 83de55c7186a70e00713db7676b45fa422866ce93e052615c1b19a833e29fb84
SHA512 e02f7403983430c3958185d0097909ef730bb1a9503064375eae91b3372f752713984a90a556e7e262706061ad4e9761bb9b901c4ce3d1658b95297bd65371a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e534392e-40ff-4366-bc29-6dbb78ffa81b.tmp

MD5 fb76585b939099e2add1399152898627
SHA1 7e5adf12e4ab8b15d774f3ce8ad77b0ef9fe6320
SHA256 45f18cb10ea709fa8de5b1d32260c92bc828c321a2277200a38f2bb65c52ca63
SHA512 8a8a91bdea8add3d8f13643941e80c0c8847486e3c2ca19fdd4f9dd661c334fdd519cd0ca78bedfe6706f17332436970c0294de2c8056e6379dc5eccda23e00e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0d86cff2f13c0a309dbb1f6a1f46be57
SHA1 355aee7d4ba83fa5c692480c14db5000985f1537
SHA256 0d8e24a22f89055699ecb6f020eca4cc097422dd3e5009da097a642fee03ef4c
SHA512 afe8290c6f15e1170cecdce83a8318f3624bb1f18e6adf8cd8590ee95de0dd347a1587ae98033403cdee7be4ca6851e3934e0cfb858f6a3c87057c7af15ba2f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2e1ef67001d9296f3a310266f0813ece
SHA1 8d04c8f57de2ce4122b3db1de6b43d7613bd5044
SHA256 cea4a4e2abb3b746a48b5670470dcdb2b7aaea9d3d713aacfd2cd552a250f3fb
SHA512 60b8b5aa11334bfb34c1d30d4906879be8adb45f8fd472094a14350f57b3058011657ff80cd0ed94f6a31094b197e11610b805d6df55891aa583fca95ee55279

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cb2dd.TMP

MD5 7908a8664df783ff85c0cd6cd6dfdb75
SHA1 3a3687250f603fb0fc3e3526fe3a08a25446f61b
SHA256 bb9277e36d8c0f34501a4aa963e2f4a0984e228b729614bf09a342015ab7cc0d
SHA512 5c04fb78279712ebb339099ae3e35a028bc7786ef8058b080435ced63e66c5c7b6e2824005a90f8b7cba40b94fca9a69363458565fb9303be225ea8916e14334

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aa1d7e153fb32f07d9a0869418050ac2
SHA1 89e77a47d97053513c6c49ebecb1fe97a4513be5
SHA256 7f01a9c1d5c980cde36bd3f307642b6fe0c086b64221570cd1475f1dc663ae9b
SHA512 f6c19ab6835e424cff5c1886127152a4ad18173f59a727d51df5d4c0768bf8df8ac22b82aa53d018c85114ac57d38f7cb76a9e0cd9b91ca2284a31084e8b32cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1f08e17e4a565c397281ef44ca8bde09
SHA1 ebfe9d16096f58b7b827b21f494fb1a88fd82209
SHA256 042f74c1a232b36c55b169c3c68e2e093382f1321a8c0ce2591dfd6b937db6b8
SHA512 9eb38ad13e0e2c1f22291d8c3d2283f4de731c28653897a450fe007dba77b81d10a488e44b67d5533632b3f0a28a58f336ef31bf04cbd0037e5fad429e9b0d94

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7328226a6682506c69212c1f4129c3a4
SHA1 11f4017a5472e5852fe03ac4f7800a11c0db1996
SHA256 e78b1809fd90685a408c671dbde32cac0be99f402c14e8bf6d9dc5954981b542
SHA512 0b041dc7a229653fb058af28cde7cca27946dd6b5177a99e7f146587baf4272ca9d5e67a712f21003f7600e5623f0ecc1737947878d28309782442147449ad05

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 26a60cf5604972c8247b55765c42e36f
SHA1 acb3bad0220949e50b133ad385c230634d9d724d
SHA256 551598ad8959f3235fd2ca448db9f7ac27cfe5e69af40e3268eb7c6d86e8b032
SHA512 71834438fc4fdecacb397659ba18e294c31e96fd36b89909ffa4f5cdde10736272746c59640e4b8f7b2f58d040a72b444919e6d35e552e10fef01bcc554b2e4d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0baddc780430dc1bf2ece23bf6048ada
SHA1 5386d3300b80a50d683052059473daf2885277b0
SHA256 de0d6deb33060a647664c839450973e49aecd1e5ab5d308d80faf8420cbce7be
SHA512 acda968cf4e35450f8e14c4b4722fac4bb7625a2f0bf3e3ba84a30938e9f540bdf2b558bbf6a82431f6af57a17f407431294f391421b5e0322bdf3a6f1e610ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5a7a366f631bf4b2f191869bef091e73
SHA1 14927941caf5bde66dc9a152905875b8fd0d08c2
SHA256 641e2ac96058a4480de24052c39d842a8a063b8b8225ee7e523846a13542e4fd
SHA512 86d3737af879de68a3c52ec86044f18600dfeb7202eb3d0900cbd2dcc98c9a4c944be8d383a5fd3c79e74513747d727bad991136179938e73bacdacc1a6af39f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

MD5 704118ca770e7f03c5bd9b2667b4a744
SHA1 e3ded4a845906e5632f01164cfada29e6e39da10
SHA256 1ef295984cda24b8229dfa040265ca835bdd2d8633a5f7ea509260b80393e972
SHA512 31b71e694569617900c6b506c370e1c8bfd5abfb720f503d0a9a2f24c773660bc05d67319128ef958dec77490e38787ee4b92266a0d9745d16f5cc4c47c725b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aaaa973612be5915bf232c64b94fb296
SHA1 1fb08d1b60becb9a642ed818b68d99aad4c5d0a9
SHA256 3a62d93521a3eb135dd9143ef1c3875d4977e453ca1c9df0510a6d07c8388079
SHA512 55012049675c4c16f2a7b780d0a9bdb01fc2affa343e6b1dcdef9624e7255a085d72c42fc10cb4ec14712a2af06d4264d647f8de3082853c3cee44cddd0c971f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f80f9fed96770fdf6b03efa28b129a5b
SHA1 4aebfd65fd227c4ab02f13108e604e18fd87096e
SHA256 0ec14004d5c7d30b883748ee33bc3f8c1d85cc9eacd6a862f30e914ca6dfb2e7
SHA512 f0b1013c0bc521a49abd32fb18873f1c0be79a901e7dc27bf150f2e2468493094983e400c2b7f7d45043e3f99d0316a328c721abf2dcc25a885e2d015ada00c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 060a76352dcf70bede1ff69a07416996
SHA1 f543e661a0979fb4e1a0f4b230ebf40382abc478
SHA256 cad86366f2c5ec5600d870418eecb52e1281c9355c14bc55f4d1972a65fd06c8
SHA512 08a20c47537267b71584d153bd0b56cb471c1c2eaa8afc4540811010c654b7db9872fe5ae20bc0727ca4a84a86e47d9cb96320664e31b85362b480d4d0ace6ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1f59dafa86e6fcc6ba89ba5df2c15c36
SHA1 b6606e998effc86d69f62e4779981a8cf3c39f61
SHA256 76ab5a9a1935accb73605bc58629891b6b7541bf6f0f72b61c5c292eddfc32c2
SHA512 2d21283e0c33ba60f1dd423d98310031af81b9e8877dbac11e7cbd4dbf8ad90fd3ce5e94f3a793b8f764d166aea077387992504f3cb710b76546350d16fee209

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 74374213b6dad5afd949ad9c7bf7fa97
SHA1 3937d051141e23df2e29f31a5cbc1369822aea3e
SHA256 cf30e2b307b00fe35d0122a24de6d42680d8850116cb6714856396178f550e74
SHA512 8d6be1dd799e2f98a13732ae2532a21372d066a470b65cff771f271fbd31278dca9ea57af56247276a63d586c925fd8c679076c578596226b4382c9f5156df98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c39f5840a7c2443d3bb105aa2d351ef1
SHA1 d6cda274cc4f302a65d13b40c3c6ea919b820fa8
SHA256 b2442cfa2f7b4bc1c814f7969997365039dce416907b365457368679d59154f3
SHA512 8548d2df6720637993ece8c418299f7d8c47dd9dd48864a3e5621d96201fd234b0344b9194960d2029f19599192bc6f35785ed7e267160708928dd2ef4c615e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 08d099d4e2cfa5829a844b5bcbbfc8fd
SHA1 44157f6b76389655a22a0dad5709e70f9f2db6a9
SHA256 9cc363d7de2d5516c6899f4221fea5226929c5bb67ffb2ea3de8f7f109fe99c3
SHA512 0cefabb2661b34a862a86a26055983158541f50eeba49e17b82626481850ae1984fec065bf3cd7c435ab420408b5a62f595c22b1956dead431290e162a850c29

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4a0df607e402b69db64c2122f7110a59
SHA1 3e4bc4dd755aee76995facba000a9ff45839f88a
SHA256 6e2b38860e387954230f34620d956dd939f0a4ef76a7cb2619a45c736facf936
SHA512 74b66a8c73adb9fcb1dc2d09fda03884f182ef615280a46bc2694a78b42ca9e7f73b417f1788c8a84e7bcaeb6dbf93dedfae9f9bd73dd52b9f00587bc43ae676

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 58d0fa22b0f6d8ba7de5e6e57d3de8f6
SHA1 6cea27bfea3622c1c40169cecf498f8a61a47f42
SHA256 5376d687e3ce706399afd206a98a68cd3b70c530f78681d07d75029d1719a3ba
SHA512 f46de8c8e8e673f49e542405f24ec3d4f6fc9e10feed97c30c900df9799ba3313cee0a536206df71025f202995ae7989ffd525816f871999c2d5a22ebf8853fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 17433dc5c6489e26612985305c583cc5
SHA1 8458da04677991b06066195019d1b20d972c2ca7
SHA256 3ddcdbca459ac23814ee3dec2e6e24edaa6ee03e4c8cce0fcc12aed7615863d1
SHA512 19f7fa1f853a7c8a5c4b15c26f0ad4219d25aa8f10b685d6fc510efe0a0e03ccf4c435e6ec522922803bdaff2a42c224e8a325e4055c2633b8c30f22a6e371f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

MD5 c3f751b0c1bc835f0f3935be3e7ef60d
SHA1 86252191383b740b26b552a8f23f0aadf283072c
SHA256 dbc86f12b6ccac445da613fb3ef92ca1b1834a9990a7fea7b4463854177a2db6
SHA512 d6a98cff858586a49b7879f0bd2100ff48a06a0d15bedb6bd4c85a18b128b610d7e796836a38130b51866087b538d2a573792bf9fff6deb46c21fcfc73e27e6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 63f0ae5d3d820e96f2f11b938c09a42b
SHA1 dd67d3a74fa524d74bc9d2622ef7264d5b9d4ae5
SHA256 0924663a6b59139ff053f1b4052ee2428ffad95004e2fef02b57c7217e01bb0a
SHA512 f9415db8d001f33f60e246aebc121ff6a20161e96aa3e5dac638d4d52ac591225612b2862f5c5e74801ef09d63617250e28f9c09207b7e151801691f1b38e714

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

MD5 672aee3e0554a517479e62d4fb8dbccc
SHA1 b6e6e0e5b9c00bd4267415bb3c6d3f862faf7b55
SHA256 1b26f034d51e6b9c0c82257b4a9d37f6ec96889cd63e643f6b2a52295b80fe01
SHA512 7f8ee0df86a2ae2c7202ab0200d35c5185abff57c4fe50f3b3eef8f409d7696f7e09a7f38de108bdd172f69ddc13d439aaec1e5e7b0da3d3d797b8b2043da993

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

MD5 2c28194eabcdaa3ece25538d6ec93d24
SHA1 9ee3b4fa6b334a163c2a037115c0e4d31465dc34
SHA256 3dd1156b65420bb173a7b3a085c31bf247fb9c4bd5f17d0e18ca6aba7279b1f7
SHA512 c4f3e6b70cf460c02d4771e0ec5713eba0974989df48f9770107f5429e42a924c63e6d11a15451043a74ea2aa704548422566d7287e05cfcb93753aa6810bb24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

MD5 47c7aceec68e30f20d975526cf62bf8c
SHA1 04bf75e87acc00687ec4b9b3c8b571f5da454cb2
SHA256 f12ec4b1224457d9db8c4ea7af02e201ed4526a38bc0a30248b341bd4652996e
SHA512 28e2e27113f1270e8510e8859608d1aa1f9e3c8233eeeed67c39347692e370032aac44ff31313b0c455dbc0ea412b77c85295557ebe5e0ca60d1d142e4580348

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

MD5 7ca67ce3c43ed345541ea534507604df
SHA1 2576a058aae59d2fb1785aeded48c0bf1a9b56ba
SHA256 619ddabe68d36a59929cdaad1a41e38ca46e4ee172f0824cc5dfd02d855dc4f6
SHA512 6b72c4c789827cc3bfcee4c439018eddc9d864a1bb461c9c0f6ff0f9b550492306dd5af35f11b39aa6d6fde98415cc04f6ce64cd64c6a6a8fbb291e049f2f06a

C:\Users\Admin\Downloads\efe51be18da84f708d12ab274d0036a7.MOV:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 65c04099fb2f0a5e6fc61d3fe11b846a
SHA1 0f3f5b4c8521df24a6e7c17aa0accc30308b0433
SHA256 a743440cc056c40b879358f70aeecdf5741aabf65877e5f06e5991ede124f86e
SHA512 6f41034fad3123a7f66f8bef482079a9a820dc278cf4c6031e55871b0a390e6b2b5b79dee1609d2749ff2a9de9424553fe51cf99304b0fdfcb65a7a1a5426995

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9518cdb0ae9da0f3756f879042018490
SHA1 e77aff9a040ca24da4956dec875308adbfe4595c
SHA256 bace68af575d1ab8c3882e7d2307f09d93203b864ca8bd3080e675fb47798b95
SHA512 1c9b712a29b5231e1fdfd06fc7b3b013c7692f83c2cffd698b64e720faaa4320de195c85b47b05959fa0054e386543c8d0818d4fc1ba4ca37470cc555d3aea52

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ac6b65dfb9ece8062ea117919cee1ffa
SHA1 f9f353f5ddc807e3182f3a3b0ecebe37e9c6302c
SHA256 424cdd1a59cd2bf7104cf4a46b7a4ad7f807daae374b1a7a0cc26b7e1cd2afb7
SHA512 d1eec5b2fb8af73f743b863ec004a6d96801db43b9e78a70b764775f517d749d9c72c55af8602d92c0d292ea1bb182ab6d7980178e907704d8af235b576dbd52

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2d38d04cc49797b8491069546bfb9a25
SHA1 34720050fcf774c4a4a3cad3f041b0b8471c7d27
SHA256 a6fbd32385bbe1987d88a112e623ca3c91b86e04be845080ec259eb1c22f7cca
SHA512 2de63647f5b3d18e5991ce22c1fff8f98ef7561c554a4bd54ea590f7bb4fa76cd95b1ffdf4e74818d5c5e846c1b747fa89e0b94dd2b0858edc13585c5d5ae70c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b901cfd70ebf6a21e39fb64729c080dd
SHA1 d72679d9318c56dae507ecd6522e76dac19ea254
SHA256 72fa5a47477b6655e031d47110b070918c284485c7e8086f03a603d62bf4a67f
SHA512 256ad5ca1d35894dfe466af17d2226c9643530bea92192d694ee4fdfc41dcd4dfd7af6635c1ee18ae185f3de1090f67bcac1f82c737b74451be53f1def167b12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0c4e6ab90bf193415d6025d2ee1154d1
SHA1 321ce0b82212fcb57ca6788985b09eb2d65499f1
SHA256 3c42f7cbfabdbe1bdfadcf0f27165260cf2f6308f481bf674434ba79fcd987f1
SHA512 59f6410d55628ade8a399866f900d1aa11a007c3a53a0a439d9d2c06b5145995634f27b87d44a5947d2862cf5794a951a7b127d64fcec9b946c8e3dbb4b1b355

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7897c56846a18eae68270a73d6c6f4ed
SHA1 6cdc6e75f449c97d58827196ed34443b12f6f6d5
SHA256 ad6ea1092d9101e3409797b137ca6f4e4db6dfdb6e82de8d6b1b11cff5065c87
SHA512 a85637487166a0deaa4d09beb79ceb71759a6aef9dd2c37a57782ce91bb1d3515138b5a9a22481135ab7f0db0d7aca55da25b442e0f9feb4b1f9fa2d595b4ed8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0a30d7386b72ea6b5181bc2949d4d5df
SHA1 3b6392f65799bfd1ef0f9a01e54d6d05a600fcee
SHA256 44453390bd3e3f692d4e4a693c770b58ad99907bbc4ee96ba983034f7dfa16e7
SHA512 32d879986134e262ed2963c6615eadb6ae8931565000d5d52f689ca1a2b39cff18b956969eb64248eec6dd4d60445398e6a1750b0cc6df7b3e0cddef67a17e65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a9bdb25572c101e3b0303be05d43b476
SHA1 0bce891c63c03f00c48ad7d9809b0c7b315ff8f4
SHA256 ae64efd841a1aa02b9d09083163511ca351dcb0c1c6f4162abe28fd78cabc017
SHA512 67a2076ec22534792f6845b8cd1470702311a51af1ab12839e042031f80c7dd6333d8cdcd9e4977919f92b1dcc5ad38ca476ca1832612fd646576381fbbfc5ac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e2cdac9e1a7458dc226e6459c7905817
SHA1 e7293601656235163a249546bef4af776fa859b1
SHA256 d6ae44e5c61885f84ba0015f740fa54f0e40cb42e7c1dc4877b19dcb5664c791
SHA512 01c0cca839b1b3bf5626e72618c876093c1a4a520be20abe3d78bb9d6c953bb35cd691b771ba00d5a31d6d0f67a672c4fbc872fb373b95febb8e060eb1b3b274

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6341b4337863c95d76d66e5002929c7d
SHA1 ebef81fbe7daa32fc6361eb03d51c3d397eb0ece
SHA256 79dac3c2340dcf5f506534a1ccee4641de8a37cf424c27a1b7f00af2fbb0c966
SHA512 8a2d10d4cfc76a89a2a84920e97cb251d58285b234bddc8520152eea768fe8b9bcfc1129c21963a13586db4c64d7c1407843e1428c3a9e912876e97d49d49b6f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 737effd5f2658e49aff6e3d0f5a3b8b4
SHA1 d662956c973e43f5eb5bd9a44d3568dc742cb64b
SHA256 cf03221fb121a149542eac9b543343226945908e23fb4c8c3635e17992dabc14
SHA512 92d9e33abf32cdc6cb6d8180ebc42917808cb18215cca06a137f13a003bac9787615909fa583ea4a81ffb01632787aca25f5fef38e78f20a8c9b88e6da41eefc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

MD5 5e093dc68d6ada4c10b2ec4cc1207b0e
SHA1 58d01d3f95114f2bf44c0f5709019c274fcf11b2
SHA256 9aac52fb9968c885bf1f82adb262e27aca02733e482960fef5644a023d4e0b5c
SHA512 df588b3262ae7b4f4d256729b1630f4557f9182916ce4e3f7d3a3862ff1bc27a0c101eade3e3f98cce489190850151390e264a4c6682f40e01954bccb3a14c52

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

MD5 f1ee4d9af1d92a44d8d685836799f02f
SHA1 61fa1057b0b8fdbe4f0f8c7623389938b5818ecc
SHA256 886c56e742ced09eed67a6731a79f7ed4abd331ba27f16da5bf0ef730678508c
SHA512 6d2ee6109d3bebeb85c834a3c4d67c2c1ae1c1a7b953884659107f0938f495f56d44ff25f1fab7906c62e60354b0a1489c6cb547bc1f34b7c970d406ff0eed82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e04123d70c6f14c4832d1f3e873548a9
SHA1 c9c9483d4c2b07c3c21e60f59e8d7b706d122f1c
SHA256 668af3bb050dd6d8bd8e36baa8b7b8ac459d1caf304389fd8ab13f6da3993094
SHA512 fd12e1dbdc5a98c21993a33c9f898bf9b23bc188a00ba06d32925b0372b4f4b53be241ca6d0b005b09a1566138368d9eec54743b633ce80e36f36a083ff8e36a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 31b553c0f3e215a6bf9c7403b8f68214
SHA1 3e50e088b25e5d68266a104a96915a70ccebdc5d
SHA256 bd6163d328d8ceb43921149f5b09a6091514b633bafbdc64abd25041e220054d
SHA512 827c7d82d3d2cac17dfca0eef2bb38b878afbf48865f07985929542740bef3d1d439e9a00458f6ff68572626ba0c09cfc1ccf5783cc5c6b04491b62c91921004

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dbfb6842768dc54a8ac738e00cf22ebe
SHA1 086c3ad516b42d62d9f4653c4a584aca218cbb0c
SHA256 f0dfc6086f4d047397ae7a002f747202959debb812e3ffd00eba3c5d0b1251e4
SHA512 2bb9c7f320b7949bd6e47b4705a7c98df22ffbe554b6beb5cc5e6ee0e276d9b3465a334f8b82f683da867824638d9ef8c0bb9ca9969b9c4c47cba2746ebb57fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.twitch.tv_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 673a18710eab72ae32221f3f4c5ac282
SHA1 0a81a688043ef3d02342bad478672ef60ec11882
SHA256 8f352874eda47479c8f2877a2b2b22fda1f331e956286040bda0c35d9c8a3fea
SHA512 09fe6bdc68c7c2783a33e2b73068378d38050807d75db3a3cea8f9e3ec2e1596a1bc163851fa2684c31866daa850beed9172782bc0e09aa40714c3d49f8c1e2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 508da34b5cc5dcda8989d05a3e124189
SHA1 ac0aa55c640a61551c872b4f9779da46088aff93
SHA256 1f259de01b529d5d77ed8211c8e038caf726982fc55f0f36e5ec6a7587837873
SHA512 0d6fef05b2f1478d056c684f7415ddd833071e16e9b4a20f6f6e056f6bb68c455230eb7edd8c933c27fe241748050b171c8cf448ef44d5e25320c69cbb7493d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 16df64ae71ccfffddc8a6f89bea64d36
SHA1 6cb527a6f310e24843bc6dc684dd68b9d20f076c
SHA256 880c36ce45ef35e1c73e1ad73fe08d507ff672c82d734506db050146e867bfa6
SHA512 0b34c39b000e94de302fc190ebe5db4a83951cd0fda1aabe8988dbe9dfbe631a31a8fd7a3d96c71b046499201e364b52afddae4a97d887c1c2ca6d091b1c586b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

MD5 f7fd2a31469a2e98da54109f68be6717
SHA1 0f2355af80c6268ddd131f2156568a5f991cb57b
SHA256 52c34d7f4f7a6c06aa81d412ec842522d59d4cc0f5244aa75738834d38e61dc0
SHA512 1d8dd525cda04ee99e5e684878f1abf214ec8f6d6d7c44a1a4d7eb656c50fb4dd84ac49556eb71eb68c67520033679a6de52e6bd26bf61c3d7dd4558c86a0b02

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 1b0eabfe3da866f53aa36a1389e9f76d
SHA1 932055cba9b30ce64f71e553b10a4127bb18d0e5
SHA256 6d20c2705fa99ae5a19f167174a5b60422f51ce35137d67355415be5ec10abf9
SHA512 5de40286b9fa0533736c20551f0e200a6c8779006c30beb83bf473eba7635913c858c25181c5c81fea0de977a38ace2fe774dadf1227016e66f8311583ccb66e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe626ada.TMP

MD5 51b3a05db2e63c688d7e20020c29f760
SHA1 8447743588fd29facdb5291c1898fc727d5220dd
SHA256 ed18bcb9276554438625b48ac0432adf27fdb6621bb3bc18b7540a94ccfe19b4
SHA512 be753b5d3e2de78c22c063924752182af5956cf909f8fb86d74bfa87eb4baf78d45593ed38a610c25eea641197ea2731b306083e87c9c6bc538436d228ae1a20

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3397d49d2bd5007073a14b51a3406090
SHA1 b2cdb66c986e416f8b886018dd5fe0f98261a314
SHA256 9706687d1812b0113fb32dcef586d41a18c0d0b6f6755d312c23b2bd4c687182
SHA512 9e4e4c8f23c513ac387c84dd4f525a0116e47eb8e2c953ed77a35c1862757231f986a55f2c4007823a06a0dd1ab2d2af2dabba181658dc3b597f5fa13cfdd4b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 37d5ce1e59107e9f8a87f4cc200d78a1
SHA1 bef34ac6b24e10eb44eba35694135b1befa8c0c7
SHA256 d55c0889055b69158ad0bcfdc58f7e88667b3c9cb13adcc576dbe258daadae6b
SHA512 72b730e8325cdfd66e41e3ed59d20388b4114eeb360404f3fe4d4e91e7c0ab47f1e3bac099f0f54ca74bb38f2450c91c1c83ee4c00d09cc284a4e0e7dfd52f68

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ff5b5f4a5d22715c6d856ecbd7fb2364
SHA1 db28fd5c000e8c505b1aecea5d39da0044d0f24a
SHA256 45e36729ae0f5cd3e744183ccc5df054e7fcd17f06f7dd13956ed5bee03369c0
SHA512 942e76b5ca950b7ec9baf5da14c16b23affc9b81b98dfd70dbd5533bb617931e399b722d6c55d3dbaeaf8cd6d196bfdfe0b39bd668241f0098921bdf138dd936

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 400ab8117dadca55eb7b58f4aa8e6485
SHA1 568438f6f3e698d08be5a37ae0de54e6229b241b
SHA256 ecc5c213877180325f79c3efe4b2df1854c7dd8fd54aacf576a744fa49ef062f
SHA512 ad93e8db3df655819f4087aaea5fe3ba76e73e034b8b7dd07addf7888394518de334645ed09b706bf92b4367e6f0e42c4e0abde04bb6a926c99eeb32eb2d43a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a2cc1288be68fe03377eec11c8066f70
SHA1 19cd771418b357ac7a54e391e40af6f89a4ff52c
SHA256 88b9127c3aa80c1f117b12a5a220f3740fa185a8ac38e361e72aca733f4529c0
SHA512 f5fec7efd3b730ac2d5deb3daf2d8ab8ba281d110d411b608511d183ccc499fc32fd5a3a5ab6910cebd662dcf1224b8e68067b19664126d9f9e19d39b65e2364

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c1bd4b170d0f0f102d3960ddc559dcb1
SHA1 ea1de56a47379012ae43f93427ffdc84e0a67fad
SHA256 f6b6da97e0762623ed01ded260560dca47f3db1ca1c8129f293414b23ac9c4d4
SHA512 83171be1140adb0659a8db3ca70340e86f49daf8ec7aaa69650c93ee7a72f3c7e8c3780fe1ee7ee3b5e616a7fc8070af1da452398f81ff270daf1eaeae4c4591

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

MD5 478564d0bb4fb3ef6c88560a12cfce75
SHA1 8e678aae45fd37c547d39690365fd2b80274e9f9
SHA256 5ae8bec54fbe690cb3a13557a34fc461a7106b520ad4f3ca565ef6b44bc54eaf
SHA512 dc068572749a7cac5759f9671888060cfe6773e593b7234ad6012a08122a61b8d3cbc09db91aa9bd0ce8d140e2d1519732e4aac3e21ffe78d884e45a4b4c0428

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070

MD5 2f20081aabef7e84e6bf22739346e7f8
SHA1 71b904e0bbb70b026bfeb884bfef42079b635b2d
SHA256 33cf505dd4ea8234c09c3ce893b2c0910482c321eb82ebd2c462cdb0fb5ecc92
SHA512 3d57679f1d6025594ef81b6bad37d7ade38cd38053e29b8f689e2b5dbfba2f331eafc639868a61090e97f21d31379177ec55ec0ff4b9339bd9b76319b053edc5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c4294e7057ee0114d0d50c3348abd9a5
SHA1 05ffe77b6226221bd4f67ffc23c8987aee03f0fe
SHA256 fcb9ec2d0f4e72a31eb51b2062f38b388ff67f2392fa044a1abf28bbaba4bde4
SHA512 a423c8f5c05e788b05c574b9fdc7e7cd8a2145ab1e971385326af97b4e9d5be487dbdd203f2b46fd04e45de13291cd91fbf3ddf28fcb0762674686bf6e113061

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

MD5 4d0dcd69f0c4c221d48df385e01ba8c8
SHA1 155d8f1352d6eb6e1d90519e7ff74b0527285584
SHA256 b5409de28ef8d3c817662eaf5054261bd8df0a952e78de6f47436f78015c22f3
SHA512 8cd3b3e36d1ce9c3efef1acf12ae1811f4bbb05589637076a8a57a39f9da2f4b20c04b94e775dcf474da457683707b4725ed5627e9525fea427d5acb291da14b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 337268f89fc023b1166c92a9d24861e8
SHA1 5a32a57d3f6057913c1eeb6f8308fc886487a5fa
SHA256 fceca8fc4af3782c0f58c42799e69b2c2f5aedaf0f7d8b00290a4f857f171ad2
SHA512 d0a6fb443bb5dbbc2264606d3fea0efa7e2c4137f866da6507d18f605ee4e3e2f4194b30a0881c3165079b5ef9d02cdd4c09fa4226bc6e49745773a85df68106

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 88f26245395e6e6719b45ed9fc377a82
SHA1 a9e5c45904197eb059a696b109e359cac8fcdbab
SHA256 d41853a7722c1a572335d838415c51e7fdcea14dd7889ae9bfa9d4d2550f7212
SHA512 92bc4c69addee71578b7df55e99f53b1ae38db3931ebcaf3158ef0bb7d4a0beecbdadc7643fea8773303ba0fb20c803812ef38accede35a46053377861fb92c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2dd4dbd6ade6fe5640c0fe03e14ee093
SHA1 aed1e9ac0d1ee6d13cf1aae9ec2b99771818fde0
SHA256 bc33dd3d0fabdafea5e49e37b2f291198685756645af601687ab473bc8b6c08f
SHA512 eb65b06a5e5123816cafabf3e63a078d3c9626225f98558adb195c75b81c55766aeba51874f87848dd88c6540b379dea244028d3f52ae05faf77315e973cc536

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f8589870-6703-455d-88ef-544d889c2006.dmp

MD5 e8562ef44b561913bbb978b2358a4477
SHA1 606e8d11fc13d201686d86c72b84c20845ed0e14
SHA256 d685de88885858320f8da55f6dcbd6db888e7a977d14932b620147072a63978e
SHA512 a143cff4878c9fb55fbfb74bfa996851981e207b593596ed0f77dd323f954abc6f0edd23fc082902cd8a264f94ce0a6a334b03b6df7b36fda087663188ec8feb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3b3f0618fd790372989821e81c7c4f21
SHA1 5f81e1e22a3be41a6d13b507954caa577c76df06
SHA256 d8c8190637705a79dd1c0ddabecb929f2f348246a42d24ac9dccf0aa48284821
SHA512 f143708fcabafc248a4684f763b4add60cdad5efe58a046f3740394521fd77bf67894bd681f76d1414a80c04a3ffe4fd6b4bfcf4d5c5d366887c478ffb6f418b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5fd6b87d19bba9b5b24a4d169eca7b38
SHA1 07b47d3ae59eb148a563f91f614549922a169b29
SHA256 c72c1e0ece9acc6119d17233ba7db49c86818f6f685bac451441d3d8ddd6a89e
SHA512 6abda200fea4191bff766b1e706ca4abd184e2850e4894b79efea7a7d944b6ed0bcbc40d39539be8291be1c8b30c46ce1ddca4e4542e1d7f5125de7778107592

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c49c93b1a5540c6615453addecc3d7c6
SHA1 389d7ea2c189ad3831a059a63b6486abcb100496
SHA256 d6f36df444f0a1ee578a5448b6aa65dca8639a874d5adb8dfc89d2adabbb95a6
SHA512 68024cb8149fd30db779062bc71f1baaaf30a3c0a5df2aabd6f149b5aac831c49769df9b8d099f09ad437ad9696a805305f92aca1a91dac3f8820df8a0b4a29f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 664d4935ee0d5c5a92f59babd66a0c39
SHA1 0958d5928b221eeda171fd16ea2c4ca9ec4255df
SHA256 06f972bb70b868af09ef7e4a62c3ac9f71a1cb4c8e42882f213de90650eb3704
SHA512 c13594baedd896a173b470ca1e79b8c3da3d08e270fb93d4fe02620379d852da8f731ef6e65d9184d94623bef59f2a817e3a8db878e3b5b2e94bb13d6cb45ca6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c99c6df60af96fbcbb449cc534b7151f
SHA1 d2247194ac83b6a51a8bb74cda07eba9e574f31a
SHA256 68cdbe960b320f33619f015bd6c429213de663748e9ece8d1dac1e9d212159d9
SHA512 a2adfdc12d53a1347e8fa817a5a5fcc6b151b11c2d7dbfa65c9eec3c000e7409a69215b1bad0aec8bc95b680ebf4006e9960b0378dc734dbfc441de3589a63fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5a100ae26755181eac63212829304803
SHA1 2c15d33234cf77f623831fb489f9b9b6316ef9d7
SHA256 501e4ae64a9d42bbb39d1d47c3ca288c1e0caca8074771f2bf7769a2bfa922b6
SHA512 d10879188f29d2fa4c768f4553a9de9fbad5deba68bed3da5bdbcaf4e7929e0e1d403808af22badb808fab7f0016d1220f16904f22398a715a663ea9f68e987b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

MD5 c9ba5d0a50addd4245b756b38d3ed45c
SHA1 f4b48f5cea9be942679a08ce50e468f9d790d558
SHA256 b3f3a667438205104116c8c37528758158ba0fcea93b0b126ac884d4fb84919d
SHA512 2fd474793befcea6cc802101ad64e0a2261ec75059c426eb89f2179493ea146a58de764fc98b0b4c7f2d1461d65db2434497942eb8485ef3c3a586bd2aa06fed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

MD5 248aed638d8712f1acffeb01aeed7938
SHA1 3391ce6f82c2b11fd9f746d9aca571e86c06ca8d
SHA256 9d076a31cf04c6ceb837196728d0b25960f3a2e2110673f2cf192b5ffd5e3f4f
SHA512 17775b3aa62b1bbf20484e1d4b75be4cb1b7dead01003510cdff07beb2ea1dc4f841ead2da7b0c3778055ba2966fd49b71e7207151dac202e112f5b41ec0c2b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008b

MD5 6ae3a1ac98f3f8019449022f8f381d62
SHA1 ed3d5464008b656e41bc2d14f467eb0bf40a0d6d
SHA256 6b68ea56c8feb2c7ffcc1a59b82180068ee1f53ae860a052bc6e3f1f03ca0905
SHA512 78612c4174609f0857174ba0b281f1f74aa8ad4a954f62c13c84bf94219457e278a8c01bb911b649be58d02472f99cc54d0fc576572d8841ecdd61fd5ba394ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083

MD5 ca4ccc9e5df4c221d2f6cf02bfeeee15
SHA1 1bcc24278dcf62f4488c93d1e6ad03b24785a753
SHA256 bb95beeb3eb7fd4f4af6a1033b9549b7db8e9dfcb8a223b7c604bbe730427477
SHA512 071b5041379d19526ea86d08d74dd50446be6601bc8a19beb29468735d4792bf4327b9bb6829d5dc8db890149dd2ef1e8f8659f1aa46764628282af9f1f902ee

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 85571b91665c09836cd53704cd277c67
SHA1 58156cce20f0d25a67a2b14d7bb6d1435b9f6ef8
SHA256 340dce6a41f4a71c8e71990fe4ea4a76d30f484bb912afd759f5db8ebebb55f1
SHA512 c06c532d35a23cc15b90f4f665701e0c274dad86287e96423124edc32e21775aab3250674bde68e5ca3452b9553e7eb7fd595fd2df821743b1ccb526657547e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000122

MD5 8ad6481f0602dc780e7b8904aae6ccb4
SHA1 e88913266c604a380f25a15e9b38ec302663eed7
SHA256 ffa9d302298c773f6a403ae6151a03f673ae2cc20dabff3b7459f9663ebbb1fa
SHA512 d91b8448f32999fb59e0d43cc9f99be16ef31f39f29c0a60c3a7936a8da189bce697a309ef9a0e6b84246b649e54cad6c797d472c0b12f980678647710927b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e9403d07225869ec0585e10812d0b1ea
SHA1 5e36afeeaf3a9f62e7d1191640ef79bd9b91b26f
SHA256 9a50e560ad5c72f51cf34326882e968e5209a08112b61c7fc15e0c97a7b11a0b
SHA512 ba0b95a3cb26e27f3e87930550c76ff3b8500fc9f5413cd71b8db265c3c7f7b7e0445292789c108d135e8b05b36ed5d947db319d93b6b5fdea94f15917810a74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2695cebe47d75b5ed6937129093a4790
SHA1 6ee732cebd0d937128a3116a4c11f16412a85836
SHA256 6ff58f933003651d2993c46380f23452413ab227039aa1e814971b85a33e5a7a
SHA512 f41c630341faa1d7ce1f5d2486efbcfd02528a2f74eef53e6ebc058c0440ac1c07fa39a16be7ef26a7ba80daa1b10f7d970b558394e2b746e9c1f7444bcfdc14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5e47c3a9f17c0dc4802c30fc1268e699
SHA1 beab5bc077826709e823d60eca6a323b972faa6c
SHA256 64dbca4c11e16f4706a774f3543a5f5bd65b794430b214f7f6fb7995d3aea833
SHA512 164147f142dfb100e4253b077b0f1d7961de42c42d0bdc642e2f82e56b0610bb30115f739535450d707230f823429ae883dd53d8c9d0cb560ae459f4cdcb182b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

MD5 e3c6ac045ca2c7bcac384ef158f49437
SHA1 efd3435d2253d067cf0c6df8eb9628dface9bf27
SHA256 59e37e96c2e7ed33723317c822772c4710287cb74ceb85abf5db135facee5814
SHA512 7b4c68474a0041a4357cc6f138d6aed0abd525ff8564a969a07c7c3e15af101faf8738826454ad06a0ace9d8b0205b9bb03ca35680fbd0982ad48169c8dcda6a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 179aa13b462a551c3cf932e57de70e26
SHA1 4c17b46c539e7c99adb92cd5fc93150bc14d4230
SHA256 8ed1591867b654fb7c599bdb35ad8aa4df463d16be2a6f725f4fdbd854062508
SHA512 d2fd5f9b9c6eaa087bdd4ace806818c8e4ca810a1bc3ce7175c5c42cd5c672113b9627d78dc8561d89e5fdb45d9cd14c684fd9fb406cc2fe9e464babc6e2d398

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 948ed5012489ba655650015d39adfe83
SHA1 89431ee294cbf98e3e9ce9b4ef8218e83fdc2b35
SHA256 6d746a20a5857f7a8336dcad8cac2a578e41ed2a0237bfee2bbf3de2e4a79812
SHA512 2383bfab9d33da0af6f265b5c50fcf10485fdcd1a299dc8c3682efb0d1169cf97c6d04ba79dd17613e097c3314eab97654c0646548bf94e9ca0d5ff7454d5390

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5d48b18d4318b3174120ed117e7a036e
SHA1 d7ec44cb405ca5f72e1e381d7cddf4817a164740
SHA256 33ca65320e7be3bd77e4e18e5e9b9d38106db506f9ded514a1be79590e6a9a6e
SHA512 5e8f327d67d1cdbc7dc2f4a3ef65c4042c823d333535be7dd919a2fa2eaad9a75a431f8b8d05dc88df35ad8c2567181f0b9f4993c48112aebfcefd5814335d1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3abef6750e6629ae43785ffb6baae8e4
SHA1 9749e23b989a42efad65dc23a8889268b17de8ac
SHA256 45ae9974b68647e450bddb5fbffdbee7ddb929d90964aa6cd18fff02544bd854
SHA512 065fec972cc2a2ef65f73e6acda349cd9cede1cceb19c34d7aecfb94648e71bf5fd19a1b422c604db42c32392f0d15de99a14f3d77829db0ec5584f99880a266