Analysis Overview
SHA256
778f324b9de6cebb960cca0559324538e9ac3c073ab614e8166eb3fa95cbd061
Threat Level: Shows suspicious behavior
The file demonditzy_tag.mp3 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Checks processor information in registry
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-01 23:53
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-01 23:53
Reported
2024-06-02 01:38
Platform
win11-20240508-en
Max time kernel
2689s
Max time network
2609s
Command Line
Signatures
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\B: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\unregmp2.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\unregmp2.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \Registry\User\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\NotificationData | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3001105534-2705918504-2956618779-1000\{26015429-4893-4ED4-9EC0-379C8D0948FA} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe23000010009bee837d4422704eb1f55393042af1e400000000 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\efe51be18da84f708d12ab274d0036a7.MOV:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\unregmp2.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\unregmp2.exe | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\demonditzy_tag.mp3"
C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\demonditzy_tag.mp3"
C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa8b13cb8,0x7fffa8b13cc8,0x7fffa8b13cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3624 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3588 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=paint_preview.mojom.PaintPreviewCompositorCollection --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=2916 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4960 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1252 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6880 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13277152176444556691,16331347233569329841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 162.159.135.232:80 | discord.com | tcp |
| US | 162.159.135.232:80 | discord.com | tcp |
| US | 162.159.135.232:443 | discord.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | status.discord.com | udp |
| US | 162.159.138.232:443 | status.discord.com | tcp |
| US | 35.186.224.25:443 | api.spotify.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 162.159.138.232:443 | status.discord.com | tcp |
| US | 35.186.224.25:443 | api.spotify.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 35.186.224.25:443 | api.spotify.com | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.224.186.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.129.159.162.in-addr.arpa | udp |
| US | 35.186.224.39:443 | dealer.spotify.com | tcp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.232:443 | images-ext-1.discordapp.net | tcp |
| US | 162.159.134.232:443 | images-ext-1.discordapp.net | tcp |
| US | 162.159.134.232:443 | images-ext-1.discordapp.net | tcp |
| US | 162.159.134.232:443 | images-ext-1.discordapp.net | tcp |
| US | 8.8.8.8:53 | 232.134.159.162.in-addr.arpa | udp |
| NL | 23.63.101.152:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | 152.101.63.23.in-addr.arpa | udp |
| BE | 104.117.77.210:443 | i.scdn.co | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| GB | 216.58.204.91:443 | discord-attachments-uploads-prd.storage.googleapis.com | tcp |
| GB | 216.58.204.91:443 | discord-attachments-uploads-prd.storage.googleapis.com | tcp |
| GB | 216.58.204.91:443 | discord-attachments-uploads-prd.storage.googleapis.com | udp |
| US | 8.8.8.8:53 | 91.204.58.216.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | tcp |
| GB | 142.250.179.234:443 | media.tenor.com | udp |
| GB | 216.58.204.91:443 | discord-attachments-uploads-prd.storage.googleapis.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| GB | 146.75.74.167:80 | www.twitch.tv | tcp |
| GB | 146.75.74.167:80 | www.twitch.tv | tcp |
| GB | 146.75.74.167:443 | www.twitch.tv | tcp |
| US | 8.8.8.8:53 | 167.74.75.146.in-addr.arpa | udp |
| US | 8.8.8.8:53 | static-cdn.jtvnw.net | udp |
| US | 8.8.8.8:53 | api.twitch.tv | udp |
| US | 8.8.8.8:53 | assets.twitch.tv | udp |
| GB | 18.245.187.16:443 | assets.twitch.tv | tcp |
| GB | 18.245.187.16:443 | assets.twitch.tv | tcp |
| GB | 18.245.187.16:443 | assets.twitch.tv | tcp |
| GB | 18.245.187.16:443 | assets.twitch.tv | tcp |
| GB | 18.245.187.16:443 | assets.twitch.tv | tcp |
| US | 44.234.242.118:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 44.234.242.118:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 8.8.8.8:53 | 16.187.245.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.39.156.108.in-addr.arpa | udp |
| GB | 146.75.74.214:443 | api.twitch.tv | tcp |
| GB | 146.75.74.214:443 | api.twitch.tv | tcp |
| US | 8.8.8.8:53 | pubsub-edge.twitch.tv | udp |
| GB | 18.245.162.86:443 | cvp.twitch.tv | tcp |
| US | 44.236.131.42:443 | pubsub-edge.twitch.tv | tcp |
| GB | 146.75.74.167:443 | k.twitchcdn.net | tcp |
| US | 54.202.197.88:443 | irc-ws.chat.twitch.tv | tcp |
| GB | 146.75.74.214:443 | gql.twitch.tv | tcp |
| GB | 146.75.74.167:443 | k.twitchcdn.net | tcp |
| GB | 146.75.74.214:443 | gql.twitch.tv | tcp |
| GB | 146.75.74.214:443 | gql.twitch.tv | tcp |
| US | 8.8.8.8:53 | passport.twitch.tv | udp |
| GB | 18.245.187.75:443 | passport.twitch.tv | tcp |
| US | 8.8.8.8:53 | 195.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.131.236.44.in-addr.arpa | udp |
| GB | 18.245.187.68:443 | edge.ads.twitch.tv | tcp |
| GB | 18.245.187.75:443 | passport.twitch.tv | tcp |
| US | 8.8.8.8:53 | 75.187.245.18.in-addr.arpa | udp |
| GB | 216.137.34.137:443 | d2v02itv0y9u9t.cloudfront.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 143.204.72.118:443 | static-cdn.jtvnw.net | tcp |
| GB | 108.156.46.4:443 | usher.ttvnw.net | tcp |
| GB | 99.181.79.18:443 | video-weaver.lhr08.hls.ttvnw.net | tcp |
| GB | 99.181.79.18:443 | video-weaver.lhr08.hls.ttvnw.net | tcp |
| GB | 52.223.203.214:443 | video-edge-d92552.lhr08.abs.hls.ttvnw.net | tcp |
| US | 23.160.0.0:443 | global.poe.live-video.net | tcp |
| US | 8.8.8.8:53 | aax-eu.amazon-adsystem.com | udp |
| US | 8.8.8.8:53 | sb.scorecardresearch.com | udp |
| IE | 52.95.115.196:443 | aax-eu.amazon-adsystem.com | tcp |
| GB | 18.154.84.35:443 | sb.scorecardresearch.com | tcp |
| US | 8.8.8.8:53 | 0.0.160.23.in-addr.arpa | udp |
| GB | 18.154.84.35:443 | sb.scorecardresearch.com | tcp |
| US | 8.8.8.8:53 | 35.84.154.18.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 54.202.197.88:443 | irc-ws.chat.twitch.tv | tcp |
| GB | 99.86.114.46:443 | clips-media-assets2.twitch.tv | tcp |
| GB | 99.86.114.46:443 | clips-media-assets2.twitch.tv | tcp |
| US | 8.8.8.8:53 | 46.114.86.99.in-addr.arpa | udp |
| US | 8.8.8.8:53 | vod-secure.twitch.tv | udp |
| NZ | 54.192.177.32:443 | vod-secure.twitch.tv | tcp |
| US | 8.8.8.8:53 | s.amazon-adsystem.com | udp |
| US | 52.46.143.56:443 | s.amazon-adsystem.com | tcp |
| NZ | 54.192.177.32:443 | vod-secure.twitch.tv | tcp |
| US | 8.8.8.8:53 | 32.177.192.54.in-addr.arpa | udp |
| GB | 13.224.246.122:443 | d3aqoihi2n8ty8.cloudfront.net | tcp |
| GB | 108.138.212.72:443 | dqrpb9wgowsf5.cloudfront.net | tcp |
| GB | 18.245.150.73:443 | d2nvs31859zcd8.cloudfront.net | tcp |
| US | 8.8.8.8:53 | 73.150.245.18.in-addr.arpa | udp |
| GB | 18.165.198.31:443 | m.media-amazon.com | tcp |
| GB | 18.245.150.73:443 | d2nvs31859zcd8.cloudfront.net | tcp |
| GB | 18.245.150.73:443 | d2nvs31859zcd8.cloudfront.net | tcp |
| GB | 146.75.74.167:443 | k.twitchcdn.net | tcp |
| GB | 146.75.74.167:443 | k.twitchcdn.net | tcp |
| GB | 99.86.114.46:443 | clips-media-assets2.twitch.tv | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 8.8.8.8:53 | 177.76.201.54.in-addr.arpa | udp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 54.201.76.177:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 8.8.8.8:53 | i.scdn.co | udp |
| BE | 104.117.77.210:443 | i.scdn.co | tcp |
| US | 8.8.8.8:53 | nw-umwatson.events.data.microsoft.com | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 20.42.65.92:443 | nw-umwatson.events.data.microsoft.com | tcp |
| GB | 18.245.143.116:443 | panels.twitch.tv | tcp |
| GB | 18.245.143.116:443 | panels.twitch.tv | tcp |
| GB | 18.245.143.116:443 | panels.twitch.tv | tcp |
| GB | 18.245.143.116:443 | panels.twitch.tv | tcp |
| GB | 18.245.143.116:443 | panels.twitch.tv | tcp |
| US | 52.26.2.41:443 | video-edge-a5f9d2.pdx01.abs.hls.ttvnw.net | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | static-cdn.jtvnw.net | udp |
| US | 8.8.8.8:53 | api.twitch.tv | udp |
| US | 8.8.8.8:53 | cvp.twitch.tv | udp |
| GB | 146.75.74.214:443 | api.twitch.tv | tcp |
| GB | 18.245.162.86:443 | cvp.twitch.tv | tcp |
| US | 52.25.185.210:443 | pubsub-edge.twitch.tv | tcp |
| US | 52.36.107.195:443 | irc-ws.chat.twitch.tv | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\wmsetup.log
| MD5 | fe5fa91959f3855e29ad9a33dc62f7b4 |
| SHA1 | 5b4f8c1a06f837c75e3d043a5a3c3988d45892b8 |
| SHA256 | 1a77c94c3303cac873782fdec38931c9ece529efd18dbe8501c9062bf525bda0 |
| SHA512 | b13c9ad077db211747a0d42f59bc7bcd6f889123898db084e596b96e191db2523a00c2b83bf79733d5ecfec5fb6f534db451e7c34ab21d565b4e35335f483b46 |
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | d35defde3ad3faecd5955399986c9785 |
| SHA1 | 7762067bc38abb0654f552bd5967404c57954ea3 |
| SHA256 | 69d351f5546d8e20aed4549148ce8b8344faa65fb64e00b248028ac408922319 |
| SHA512 | cabff3a74b4b18b87b389f74c383dd79f33f17504a239deb35bb0ccf0d6f9e20b638d136ef8b3b7390f48a16e4f9398f264cc714766c8f7c032124a8737d84d0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 8294f1821fd3419c0a42b389d19ecfc6 |
| SHA1 | cd4982751377c2904a1d3c58e801fa013ea27533 |
| SHA256 | 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a |
| SHA512 | 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d |
\??\pipe\LOCAL\crashpad_2044_LFFPPVGVERPUAYWK
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 390187670cb1e0eb022f4f7735263e82 |
| SHA1 | ea1401ccf6bf54e688a0dc9e6946eae7353b26f1 |
| SHA256 | 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947 |
| SHA512 | 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b174f0a48cf28e8f4cc6404e31502208 |
| SHA1 | 83e3aa5707669084ceddd541bbbf95ddd670b304 |
| SHA256 | 74f224ef813108b4ae210aa948df549c46dcfcf35a2e25366c6ce5326e1b6c1e |
| SHA512 | 02e40affa557ccba8458d10786cbd400f8cf4d7d7ba587e1c992aa97edbabc5f0ba242ddf02ef84d8e1aaec4093bc3f082613e022535751af13ed27557ecf37b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | da671321edeefa22aa4052865ba5b6f1 |
| SHA1 | 9fb3d982ca735a4929c438a68135a963e54b1221 |
| SHA256 | 83de55c7186a70e00713db7676b45fa422866ce93e052615c1b19a833e29fb84 |
| SHA512 | e02f7403983430c3958185d0097909ef730bb1a9503064375eae91b3372f752713984a90a556e7e262706061ad4e9761bb9b901c4ce3d1658b95297bd65371a9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e534392e-40ff-4366-bc29-6dbb78ffa81b.tmp
| MD5 | fb76585b939099e2add1399152898627 |
| SHA1 | 7e5adf12e4ab8b15d774f3ce8ad77b0ef9fe6320 |
| SHA256 | 45f18cb10ea709fa8de5b1d32260c92bc828c321a2277200a38f2bb65c52ca63 |
| SHA512 | 8a8a91bdea8add3d8f13643941e80c0c8847486e3c2ca19fdd4f9dd661c334fdd519cd0ca78bedfe6706f17332436970c0294de2c8056e6379dc5eccda23e00e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0d86cff2f13c0a309dbb1f6a1f46be57 |
| SHA1 | 355aee7d4ba83fa5c692480c14db5000985f1537 |
| SHA256 | 0d8e24a22f89055699ecb6f020eca4cc097422dd3e5009da097a642fee03ef4c |
| SHA512 | afe8290c6f15e1170cecdce83a8318f3624bb1f18e6adf8cd8590ee95de0dd347a1587ae98033403cdee7be4ca6851e3934e0cfb858f6a3c87057c7af15ba2f4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 2e1ef67001d9296f3a310266f0813ece |
| SHA1 | 8d04c8f57de2ce4122b3db1de6b43d7613bd5044 |
| SHA256 | cea4a4e2abb3b746a48b5670470dcdb2b7aaea9d3d713aacfd2cd552a250f3fb |
| SHA512 | 60b8b5aa11334bfb34c1d30d4906879be8adb45f8fd472094a14350f57b3058011657ff80cd0ed94f6a31094b197e11610b805d6df55891aa583fca95ee55279 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cb2dd.TMP
| MD5 | 7908a8664df783ff85c0cd6cd6dfdb75 |
| SHA1 | 3a3687250f603fb0fc3e3526fe3a08a25446f61b |
| SHA256 | bb9277e36d8c0f34501a4aa963e2f4a0984e228b729614bf09a342015ab7cc0d |
| SHA512 | 5c04fb78279712ebb339099ae3e35a028bc7786ef8058b080435ced63e66c5c7b6e2824005a90f8b7cba40b94fca9a69363458565fb9303be225ea8916e14334 |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | aa1d7e153fb32f07d9a0869418050ac2 |
| SHA1 | 89e77a47d97053513c6c49ebecb1fe97a4513be5 |
| SHA256 | 7f01a9c1d5c980cde36bd3f307642b6fe0c086b64221570cd1475f1dc663ae9b |
| SHA512 | f6c19ab6835e424cff5c1886127152a4ad18173f59a727d51df5d4c0768bf8df8ac22b82aa53d018c85114ac57d38f7cb76a9e0cd9b91ca2284a31084e8b32cf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 1f08e17e4a565c397281ef44ca8bde09 |
| SHA1 | ebfe9d16096f58b7b827b21f494fb1a88fd82209 |
| SHA256 | 042f74c1a232b36c55b169c3c68e2e093382f1321a8c0ce2591dfd6b937db6b8 |
| SHA512 | 9eb38ad13e0e2c1f22291d8c3d2283f4de731c28653897a450fe007dba77b81d10a488e44b67d5533632b3f0a28a58f336ef31bf04cbd0037e5fad429e9b0d94 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 7328226a6682506c69212c1f4129c3a4 |
| SHA1 | 11f4017a5472e5852fe03ac4f7800a11c0db1996 |
| SHA256 | e78b1809fd90685a408c671dbde32cac0be99f402c14e8bf6d9dc5954981b542 |
| SHA512 | 0b041dc7a229653fb058af28cde7cca27946dd6b5177a99e7f146587baf4272ca9d5e67a712f21003f7600e5623f0ecc1737947878d28309782442147449ad05 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 26a60cf5604972c8247b55765c42e36f |
| SHA1 | acb3bad0220949e50b133ad385c230634d9d724d |
| SHA256 | 551598ad8959f3235fd2ca448db9f7ac27cfe5e69af40e3268eb7c6d86e8b032 |
| SHA512 | 71834438fc4fdecacb397659ba18e294c31e96fd36b89909ffa4f5cdde10736272746c59640e4b8f7b2f58d040a72b444919e6d35e552e10fef01bcc554b2e4d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 0baddc780430dc1bf2ece23bf6048ada |
| SHA1 | 5386d3300b80a50d683052059473daf2885277b0 |
| SHA256 | de0d6deb33060a647664c839450973e49aecd1e5ab5d308d80faf8420cbce7be |
| SHA512 | acda968cf4e35450f8e14c4b4722fac4bb7625a2f0bf3e3ba84a30938e9f540bdf2b558bbf6a82431f6af57a17f407431294f391421b5e0322bdf3a6f1e610ee |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 5a7a366f631bf4b2f191869bef091e73 |
| SHA1 | 14927941caf5bde66dc9a152905875b8fd0d08c2 |
| SHA256 | 641e2ac96058a4480de24052c39d842a8a063b8b8225ee7e523846a13542e4fd |
| SHA512 | 86d3737af879de68a3c52ec86044f18600dfeb7202eb3d0900cbd2dcc98c9a4c944be8d383a5fd3c79e74513747d727bad991136179938e73bacdacc1a6af39f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
| MD5 | 704118ca770e7f03c5bd9b2667b4a744 |
| SHA1 | e3ded4a845906e5632f01164cfada29e6e39da10 |
| SHA256 | 1ef295984cda24b8229dfa040265ca835bdd2d8633a5f7ea509260b80393e972 |
| SHA512 | 31b71e694569617900c6b506c370e1c8bfd5abfb720f503d0a9a2f24c773660bc05d67319128ef958dec77490e38787ee4b92266a0d9745d16f5cc4c47c725b6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | aaaa973612be5915bf232c64b94fb296 |
| SHA1 | 1fb08d1b60becb9a642ed818b68d99aad4c5d0a9 |
| SHA256 | 3a62d93521a3eb135dd9143ef1c3875d4977e453ca1c9df0510a6d07c8388079 |
| SHA512 | 55012049675c4c16f2a7b780d0a9bdb01fc2affa343e6b1dcdef9624e7255a085d72c42fc10cb4ec14712a2af06d4264d647f8de3082853c3cee44cddd0c971f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | f80f9fed96770fdf6b03efa28b129a5b |
| SHA1 | 4aebfd65fd227c4ab02f13108e604e18fd87096e |
| SHA256 | 0ec14004d5c7d30b883748ee33bc3f8c1d85cc9eacd6a862f30e914ca6dfb2e7 |
| SHA512 | f0b1013c0bc521a49abd32fb18873f1c0be79a901e7dc27bf150f2e2468493094983e400c2b7f7d45043e3f99d0316a328c721abf2dcc25a885e2d015ada00c8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 060a76352dcf70bede1ff69a07416996 |
| SHA1 | f543e661a0979fb4e1a0f4b230ebf40382abc478 |
| SHA256 | cad86366f2c5ec5600d870418eecb52e1281c9355c14bc55f4d1972a65fd06c8 |
| SHA512 | 08a20c47537267b71584d153bd0b56cb471c1c2eaa8afc4540811010c654b7db9872fe5ae20bc0727ca4a84a86e47d9cb96320664e31b85362b480d4d0ace6ea |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 1f59dafa86e6fcc6ba89ba5df2c15c36 |
| SHA1 | b6606e998effc86d69f62e4779981a8cf3c39f61 |
| SHA256 | 76ab5a9a1935accb73605bc58629891b6b7541bf6f0f72b61c5c292eddfc32c2 |
| SHA512 | 2d21283e0c33ba60f1dd423d98310031af81b9e8877dbac11e7cbd4dbf8ad90fd3ce5e94f3a793b8f764d166aea077387992504f3cb710b76546350d16fee209 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 74374213b6dad5afd949ad9c7bf7fa97 |
| SHA1 | 3937d051141e23df2e29f31a5cbc1369822aea3e |
| SHA256 | cf30e2b307b00fe35d0122a24de6d42680d8850116cb6714856396178f550e74 |
| SHA512 | 8d6be1dd799e2f98a13732ae2532a21372d066a470b65cff771f271fbd31278dca9ea57af56247276a63d586c925fd8c679076c578596226b4382c9f5156df98 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | c39f5840a7c2443d3bb105aa2d351ef1 |
| SHA1 | d6cda274cc4f302a65d13b40c3c6ea919b820fa8 |
| SHA256 | b2442cfa2f7b4bc1c814f7969997365039dce416907b365457368679d59154f3 |
| SHA512 | 8548d2df6720637993ece8c418299f7d8c47dd9dd48864a3e5621d96201fd234b0344b9194960d2029f19599192bc6f35785ed7e267160708928dd2ef4c615e3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 08d099d4e2cfa5829a844b5bcbbfc8fd |
| SHA1 | 44157f6b76389655a22a0dad5709e70f9f2db6a9 |
| SHA256 | 9cc363d7de2d5516c6899f4221fea5226929c5bb67ffb2ea3de8f7f109fe99c3 |
| SHA512 | 0cefabb2661b34a862a86a26055983158541f50eeba49e17b82626481850ae1984fec065bf3cd7c435ab420408b5a62f595c22b1956dead431290e162a850c29 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 4a0df607e402b69db64c2122f7110a59 |
| SHA1 | 3e4bc4dd755aee76995facba000a9ff45839f88a |
| SHA256 | 6e2b38860e387954230f34620d956dd939f0a4ef76a7cb2619a45c736facf936 |
| SHA512 | 74b66a8c73adb9fcb1dc2d09fda03884f182ef615280a46bc2694a78b42ca9e7f73b417f1788c8a84e7bcaeb6dbf93dedfae9f9bd73dd52b9f00587bc43ae676 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 58d0fa22b0f6d8ba7de5e6e57d3de8f6 |
| SHA1 | 6cea27bfea3622c1c40169cecf498f8a61a47f42 |
| SHA256 | 5376d687e3ce706399afd206a98a68cd3b70c530f78681d07d75029d1719a3ba |
| SHA512 | f46de8c8e8e673f49e542405f24ec3d4f6fc9e10feed97c30c900df9799ba3313cee0a536206df71025f202995ae7989ffd525816f871999c2d5a22ebf8853fc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 17433dc5c6489e26612985305c583cc5 |
| SHA1 | 8458da04677991b06066195019d1b20d972c2ca7 |
| SHA256 | 3ddcdbca459ac23814ee3dec2e6e24edaa6ee03e4c8cce0fcc12aed7615863d1 |
| SHA512 | 19f7fa1f853a7c8a5c4b15c26f0ad4219d25aa8f10b685d6fc510efe0a0e03ccf4c435e6ec522922803bdaff2a42c224e8a325e4055c2633b8c30f22a6e371f6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
| MD5 | c3f751b0c1bc835f0f3935be3e7ef60d |
| SHA1 | 86252191383b740b26b552a8f23f0aadf283072c |
| SHA256 | dbc86f12b6ccac445da613fb3ef92ca1b1834a9990a7fea7b4463854177a2db6 |
| SHA512 | d6a98cff858586a49b7879f0bd2100ff48a06a0d15bedb6bd4c85a18b128b610d7e796836a38130b51866087b538d2a573792bf9fff6deb46c21fcfc73e27e6b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 63f0ae5d3d820e96f2f11b938c09a42b |
| SHA1 | dd67d3a74fa524d74bc9d2622ef7264d5b9d4ae5 |
| SHA256 | 0924663a6b59139ff053f1b4052ee2428ffad95004e2fef02b57c7217e01bb0a |
| SHA512 | f9415db8d001f33f60e246aebc121ff6a20161e96aa3e5dac638d4d52ac591225612b2862f5c5e74801ef09d63617250e28f9c09207b7e151801691f1b38e714 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029
| MD5 | 672aee3e0554a517479e62d4fb8dbccc |
| SHA1 | b6e6e0e5b9c00bd4267415bb3c6d3f862faf7b55 |
| SHA256 | 1b26f034d51e6b9c0c82257b4a9d37f6ec96889cd63e643f6b2a52295b80fe01 |
| SHA512 | 7f8ee0df86a2ae2c7202ab0200d35c5185abff57c4fe50f3b3eef8f409d7696f7e09a7f38de108bdd172f69ddc13d439aaec1e5e7b0da3d3d797b8b2043da993 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f
| MD5 | 2c28194eabcdaa3ece25538d6ec93d24 |
| SHA1 | 9ee3b4fa6b334a163c2a037115c0e4d31465dc34 |
| SHA256 | 3dd1156b65420bb173a7b3a085c31bf247fb9c4bd5f17d0e18ca6aba7279b1f7 |
| SHA512 | c4f3e6b70cf460c02d4771e0ec5713eba0974989df48f9770107f5429e42a924c63e6d11a15451043a74ea2aa704548422566d7287e05cfcb93753aa6810bb24 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
| MD5 | 47c7aceec68e30f20d975526cf62bf8c |
| SHA1 | 04bf75e87acc00687ec4b9b3c8b571f5da454cb2 |
| SHA256 | f12ec4b1224457d9db8c4ea7af02e201ed4526a38bc0a30248b341bd4652996e |
| SHA512 | 28e2e27113f1270e8510e8859608d1aa1f9e3c8233eeeed67c39347692e370032aac44ff31313b0c455dbc0ea412b77c85295557ebe5e0ca60d1d142e4580348 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060
| MD5 | 7ca67ce3c43ed345541ea534507604df |
| SHA1 | 2576a058aae59d2fb1785aeded48c0bf1a9b56ba |
| SHA256 | 619ddabe68d36a59929cdaad1a41e38ca46e4ee172f0824cc5dfd02d855dc4f6 |
| SHA512 | 6b72c4c789827cc3bfcee4c439018eddc9d864a1bb461c9c0f6ff0f9b550492306dd5af35f11b39aa6d6fde98415cc04f6ce64cd64c6a6a8fbb291e049f2f06a |
C:\Users\Admin\Downloads\efe51be18da84f708d12ab274d0036a7.MOV:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 65c04099fb2f0a5e6fc61d3fe11b846a |
| SHA1 | 0f3f5b4c8521df24a6e7c17aa0accc30308b0433 |
| SHA256 | a743440cc056c40b879358f70aeecdf5741aabf65877e5f06e5991ede124f86e |
| SHA512 | 6f41034fad3123a7f66f8bef482079a9a820dc278cf4c6031e55871b0a390e6b2b5b79dee1609d2749ff2a9de9424553fe51cf99304b0fdfcb65a7a1a5426995 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 9518cdb0ae9da0f3756f879042018490 |
| SHA1 | e77aff9a040ca24da4956dec875308adbfe4595c |
| SHA256 | bace68af575d1ab8c3882e7d2307f09d93203b864ca8bd3080e675fb47798b95 |
| SHA512 | 1c9b712a29b5231e1fdfd06fc7b3b013c7692f83c2cffd698b64e720faaa4320de195c85b47b05959fa0054e386543c8d0818d4fc1ba4ca37470cc555d3aea52 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | ac6b65dfb9ece8062ea117919cee1ffa |
| SHA1 | f9f353f5ddc807e3182f3a3b0ecebe37e9c6302c |
| SHA256 | 424cdd1a59cd2bf7104cf4a46b7a4ad7f807daae374b1a7a0cc26b7e1cd2afb7 |
| SHA512 | d1eec5b2fb8af73f743b863ec004a6d96801db43b9e78a70b764775f517d749d9c72c55af8602d92c0d292ea1bb182ab6d7980178e907704d8af235b576dbd52 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 2d38d04cc49797b8491069546bfb9a25 |
| SHA1 | 34720050fcf774c4a4a3cad3f041b0b8471c7d27 |
| SHA256 | a6fbd32385bbe1987d88a112e623ca3c91b86e04be845080ec259eb1c22f7cca |
| SHA512 | 2de63647f5b3d18e5991ce22c1fff8f98ef7561c554a4bd54ea590f7bb4fa76cd95b1ffdf4e74818d5c5e846c1b747fa89e0b94dd2b0858edc13585c5d5ae70c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | b901cfd70ebf6a21e39fb64729c080dd |
| SHA1 | d72679d9318c56dae507ecd6522e76dac19ea254 |
| SHA256 | 72fa5a47477b6655e031d47110b070918c284485c7e8086f03a603d62bf4a67f |
| SHA512 | 256ad5ca1d35894dfe466af17d2226c9643530bea92192d694ee4fdfc41dcd4dfd7af6635c1ee18ae185f3de1090f67bcac1f82c737b74451be53f1def167b12 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 0c4e6ab90bf193415d6025d2ee1154d1 |
| SHA1 | 321ce0b82212fcb57ca6788985b09eb2d65499f1 |
| SHA256 | 3c42f7cbfabdbe1bdfadcf0f27165260cf2f6308f481bf674434ba79fcd987f1 |
| SHA512 | 59f6410d55628ade8a399866f900d1aa11a007c3a53a0a439d9d2c06b5145995634f27b87d44a5947d2862cf5794a951a7b127d64fcec9b946c8e3dbb4b1b355 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 7897c56846a18eae68270a73d6c6f4ed |
| SHA1 | 6cdc6e75f449c97d58827196ed34443b12f6f6d5 |
| SHA256 | ad6ea1092d9101e3409797b137ca6f4e4db6dfdb6e82de8d6b1b11cff5065c87 |
| SHA512 | a85637487166a0deaa4d09beb79ceb71759a6aef9dd2c37a57782ce91bb1d3515138b5a9a22481135ab7f0db0d7aca55da25b442e0f9feb4b1f9fa2d595b4ed8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 0a30d7386b72ea6b5181bc2949d4d5df |
| SHA1 | 3b6392f65799bfd1ef0f9a01e54d6d05a600fcee |
| SHA256 | 44453390bd3e3f692d4e4a693c770b58ad99907bbc4ee96ba983034f7dfa16e7 |
| SHA512 | 32d879986134e262ed2963c6615eadb6ae8931565000d5d52f689ca1a2b39cff18b956969eb64248eec6dd4d60445398e6a1750b0cc6df7b3e0cddef67a17e65 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | a9bdb25572c101e3b0303be05d43b476 |
| SHA1 | 0bce891c63c03f00c48ad7d9809b0c7b315ff8f4 |
| SHA256 | ae64efd841a1aa02b9d09083163511ca351dcb0c1c6f4162abe28fd78cabc017 |
| SHA512 | 67a2076ec22534792f6845b8cd1470702311a51af1ab12839e042031f80c7dd6333d8cdcd9e4977919f92b1dcc5ad38ca476ca1832612fd646576381fbbfc5ac |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | e2cdac9e1a7458dc226e6459c7905817 |
| SHA1 | e7293601656235163a249546bef4af776fa859b1 |
| SHA256 | d6ae44e5c61885f84ba0015f740fa54f0e40cb42e7c1dc4877b19dcb5664c791 |
| SHA512 | 01c0cca839b1b3bf5626e72618c876093c1a4a520be20abe3d78bb9d6c953bb35cd691b771ba00d5a31d6d0f67a672c4fbc872fb373b95febb8e060eb1b3b274 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 6341b4337863c95d76d66e5002929c7d |
| SHA1 | ebef81fbe7daa32fc6361eb03d51c3d397eb0ece |
| SHA256 | 79dac3c2340dcf5f506534a1ccee4641de8a37cf424c27a1b7f00af2fbb0c966 |
| SHA512 | 8a2d10d4cfc76a89a2a84920e97cb251d58285b234bddc8520152eea768fe8b9bcfc1129c21963a13586db4c64d7c1407843e1428c3a9e912876e97d49d49b6f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 737effd5f2658e49aff6e3d0f5a3b8b4 |
| SHA1 | d662956c973e43f5eb5bd9a44d3568dc742cb64b |
| SHA256 | cf03221fb121a149542eac9b543343226945908e23fb4c8c3635e17992dabc14 |
| SHA512 | 92d9e33abf32cdc6cb6d8180ebc42917808cb18215cca06a137f13a003bac9787615909fa583ea4a81ffb01632787aca25f5fef38e78f20a8c9b88e6da41eefc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045
| MD5 | 5e093dc68d6ada4c10b2ec4cc1207b0e |
| SHA1 | 58d01d3f95114f2bf44c0f5709019c274fcf11b2 |
| SHA256 | 9aac52fb9968c885bf1f82adb262e27aca02733e482960fef5644a023d4e0b5c |
| SHA512 | df588b3262ae7b4f4d256729b1630f4557f9182916ce4e3f7d3a3862ff1bc27a0c101eade3e3f98cce489190850151390e264a4c6682f40e01954bccb3a14c52 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e
| MD5 | f1ee4d9af1d92a44d8d685836799f02f |
| SHA1 | 61fa1057b0b8fdbe4f0f8c7623389938b5818ecc |
| SHA256 | 886c56e742ced09eed67a6731a79f7ed4abd331ba27f16da5bf0ef730678508c |
| SHA512 | 6d2ee6109d3bebeb85c834a3c4d67c2c1ae1c1a7b953884659107f0938f495f56d44ff25f1fab7906c62e60354b0a1489c6cb547bc1f34b7c970d406ff0eed82 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | e04123d70c6f14c4832d1f3e873548a9 |
| SHA1 | c9c9483d4c2b07c3c21e60f59e8d7b706d122f1c |
| SHA256 | 668af3bb050dd6d8bd8e36baa8b7b8ac459d1caf304389fd8ab13f6da3993094 |
| SHA512 | fd12e1dbdc5a98c21993a33c9f898bf9b23bc188a00ba06d32925b0372b4f4b53be241ca6d0b005b09a1566138368d9eec54743b633ce80e36f36a083ff8e36a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 31b553c0f3e215a6bf9c7403b8f68214 |
| SHA1 | 3e50e088b25e5d68266a104a96915a70ccebdc5d |
| SHA256 | bd6163d328d8ceb43921149f5b09a6091514b633bafbdc64abd25041e220054d |
| SHA512 | 827c7d82d3d2cac17dfca0eef2bb38b878afbf48865f07985929542740bef3d1d439e9a00458f6ff68572626ba0c09cfc1ccf5783cc5c6b04491b62c91921004 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | dbfb6842768dc54a8ac738e00cf22ebe |
| SHA1 | 086c3ad516b42d62d9f4653c4a584aca218cbb0c |
| SHA256 | f0dfc6086f4d047397ae7a002f747202959debb812e3ffd00eba3c5d0b1251e4 |
| SHA512 | 2bb9c7f320b7949bd6e47b4705a7c98df22ffbe554b6beb5cc5e6ee0e276d9b3465a334f8b82f683da867824638d9ef8c0bb9ca9969b9c4c47cba2746ebb57fb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.twitch.tv_0.indexeddb.leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 673a18710eab72ae32221f3f4c5ac282 |
| SHA1 | 0a81a688043ef3d02342bad478672ef60ec11882 |
| SHA256 | 8f352874eda47479c8f2877a2b2b22fda1f331e956286040bda0c35d9c8a3fea |
| SHA512 | 09fe6bdc68c7c2783a33e2b73068378d38050807d75db3a3cea8f9e3ec2e1596a1bc163851fa2684c31866daa850beed9172782bc0e09aa40714c3d49f8c1e2f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 508da34b5cc5dcda8989d05a3e124189 |
| SHA1 | ac0aa55c640a61551c872b4f9779da46088aff93 |
| SHA256 | 1f259de01b529d5d77ed8211c8e038caf726982fc55f0f36e5ec6a7587837873 |
| SHA512 | 0d6fef05b2f1478d056c684f7415ddd833071e16e9b4a20f6f6e056f6bb68c455230eb7edd8c933c27fe241748050b171c8cf448ef44d5e25320c69cbb7493d3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 16df64ae71ccfffddc8a6f89bea64d36 |
| SHA1 | 6cb527a6f310e24843bc6dc684dd68b9d20f076c |
| SHA256 | 880c36ce45ef35e1c73e1ad73fe08d507ff672c82d734506db050146e867bfa6 |
| SHA512 | 0b34c39b000e94de302fc190ebe5db4a83951cd0fda1aabe8988dbe9dfbe631a31a8fd7a3d96c71b046499201e364b52afddae4a97d887c1c2ca6d091b1c586b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
| MD5 | f7fd2a31469a2e98da54109f68be6717 |
| SHA1 | 0f2355af80c6268ddd131f2156568a5f991cb57b |
| SHA256 | 52c34d7f4f7a6c06aa81d412ec842522d59d4cc0f5244aa75738834d38e61dc0 |
| SHA512 | 1d8dd525cda04ee99e5e684878f1abf214ec8f6d6d7c44a1a4d7eb656c50fb4dd84ac49556eb71eb68c67520033679a6de52e6bd26bf61c3d7dd4558c86a0b02 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 1b0eabfe3da866f53aa36a1389e9f76d |
| SHA1 | 932055cba9b30ce64f71e553b10a4127bb18d0e5 |
| SHA256 | 6d20c2705fa99ae5a19f167174a5b60422f51ce35137d67355415be5ec10abf9 |
| SHA512 | 5de40286b9fa0533736c20551f0e200a6c8779006c30beb83bf473eba7635913c858c25181c5c81fea0de977a38ace2fe774dadf1227016e66f8311583ccb66e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe626ada.TMP
| MD5 | 51b3a05db2e63c688d7e20020c29f760 |
| SHA1 | 8447743588fd29facdb5291c1898fc727d5220dd |
| SHA256 | ed18bcb9276554438625b48ac0432adf27fdb6621bb3bc18b7540a94ccfe19b4 |
| SHA512 | be753b5d3e2de78c22c063924752182af5956cf909f8fb86d74bfa87eb4baf78d45593ed38a610c25eea641197ea2731b306083e87c9c6bc538436d228ae1a20 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 3397d49d2bd5007073a14b51a3406090 |
| SHA1 | b2cdb66c986e416f8b886018dd5fe0f98261a314 |
| SHA256 | 9706687d1812b0113fb32dcef586d41a18c0d0b6f6755d312c23b2bd4c687182 |
| SHA512 | 9e4e4c8f23c513ac387c84dd4f525a0116e47eb8e2c953ed77a35c1862757231f986a55f2c4007823a06a0dd1ab2d2af2dabba181658dc3b597f5fa13cfdd4b6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 37d5ce1e59107e9f8a87f4cc200d78a1 |
| SHA1 | bef34ac6b24e10eb44eba35694135b1befa8c0c7 |
| SHA256 | d55c0889055b69158ad0bcfdc58f7e88667b3c9cb13adcc576dbe258daadae6b |
| SHA512 | 72b730e8325cdfd66e41e3ed59d20388b4114eeb360404f3fe4d4e91e7c0ab47f1e3bac099f0f54ca74bb38f2450c91c1c83ee4c00d09cc284a4e0e7dfd52f68 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | ff5b5f4a5d22715c6d856ecbd7fb2364 |
| SHA1 | db28fd5c000e8c505b1aecea5d39da0044d0f24a |
| SHA256 | 45e36729ae0f5cd3e744183ccc5df054e7fcd17f06f7dd13956ed5bee03369c0 |
| SHA512 | 942e76b5ca950b7ec9baf5da14c16b23affc9b81b98dfd70dbd5533bb617931e399b722d6c55d3dbaeaf8cd6d196bfdfe0b39bd668241f0098921bdf138dd936 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 400ab8117dadca55eb7b58f4aa8e6485 |
| SHA1 | 568438f6f3e698d08be5a37ae0de54e6229b241b |
| SHA256 | ecc5c213877180325f79c3efe4b2df1854c7dd8fd54aacf576a744fa49ef062f |
| SHA512 | ad93e8db3df655819f4087aaea5fe3ba76e73e034b8b7dd07addf7888394518de334645ed09b706bf92b4367e6f0e42c4e0abde04bb6a926c99eeb32eb2d43a2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | a2cc1288be68fe03377eec11c8066f70 |
| SHA1 | 19cd771418b357ac7a54e391e40af6f89a4ff52c |
| SHA256 | 88b9127c3aa80c1f117b12a5a220f3740fa185a8ac38e361e72aca733f4529c0 |
| SHA512 | f5fec7efd3b730ac2d5deb3daf2d8ab8ba281d110d411b608511d183ccc499fc32fd5a3a5ab6910cebd662dcf1224b8e68067b19664126d9f9e19d39b65e2364 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | c1bd4b170d0f0f102d3960ddc559dcb1 |
| SHA1 | ea1de56a47379012ae43f93427ffdc84e0a67fad |
| SHA256 | f6b6da97e0762623ed01ded260560dca47f3db1ca1c8129f293414b23ac9c4d4 |
| SHA512 | 83171be1140adb0659a8db3ca70340e86f49daf8ec7aaa69650c93ee7a72f3c7e8c3780fe1ee7ee3b5e616a7fc8070af1da452398f81ff270daf1eaeae4c4591 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a
| MD5 | 478564d0bb4fb3ef6c88560a12cfce75 |
| SHA1 | 8e678aae45fd37c547d39690365fd2b80274e9f9 |
| SHA256 | 5ae8bec54fbe690cb3a13557a34fc461a7106b520ad4f3ca565ef6b44bc54eaf |
| SHA512 | dc068572749a7cac5759f9671888060cfe6773e593b7234ad6012a08122a61b8d3cbc09db91aa9bd0ce8d140e2d1519732e4aac3e21ffe78d884e45a4b4c0428 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070
| MD5 | 2f20081aabef7e84e6bf22739346e7f8 |
| SHA1 | 71b904e0bbb70b026bfeb884bfef42079b635b2d |
| SHA256 | 33cf505dd4ea8234c09c3ce893b2c0910482c321eb82ebd2c462cdb0fb5ecc92 |
| SHA512 | 3d57679f1d6025594ef81b6bad37d7ade38cd38053e29b8f689e2b5dbfba2f331eafc639868a61090e97f21d31379177ec55ec0ff4b9339bd9b76319b053edc5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | c4294e7057ee0114d0d50c3348abd9a5 |
| SHA1 | 05ffe77b6226221bd4f67ffc23c8987aee03f0fe |
| SHA256 | fcb9ec2d0f4e72a31eb51b2062f38b388ff67f2392fa044a1abf28bbaba4bde4 |
| SHA512 | a423c8f5c05e788b05c574b9fdc7e7cd8a2145ab1e971385326af97b4e9d5be487dbdd203f2b46fd04e45de13291cd91fbf3ddf28fcb0762674686bf6e113061 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b
| MD5 | 4d0dcd69f0c4c221d48df385e01ba8c8 |
| SHA1 | 155d8f1352d6eb6e1d90519e7ff74b0527285584 |
| SHA256 | b5409de28ef8d3c817662eaf5054261bd8df0a952e78de6f47436f78015c22f3 |
| SHA512 | 8cd3b3e36d1ce9c3efef1acf12ae1811f4bbb05589637076a8a57a39f9da2f4b20c04b94e775dcf474da457683707b4725ed5627e9525fea427d5acb291da14b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 337268f89fc023b1166c92a9d24861e8 |
| SHA1 | 5a32a57d3f6057913c1eeb6f8308fc886487a5fa |
| SHA256 | fceca8fc4af3782c0f58c42799e69b2c2f5aedaf0f7d8b00290a4f857f171ad2 |
| SHA512 | d0a6fb443bb5dbbc2264606d3fea0efa7e2c4137f866da6507d18f605ee4e3e2f4194b30a0881c3165079b5ef9d02cdd4c09fa4226bc6e49745773a85df68106 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 88f26245395e6e6719b45ed9fc377a82 |
| SHA1 | a9e5c45904197eb059a696b109e359cac8fcdbab |
| SHA256 | d41853a7722c1a572335d838415c51e7fdcea14dd7889ae9bfa9d4d2550f7212 |
| SHA512 | 92bc4c69addee71578b7df55e99f53b1ae38db3931ebcaf3158ef0bb7d4a0beecbdadc7643fea8773303ba0fb20c803812ef38accede35a46053377861fb92c3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 2dd4dbd6ade6fe5640c0fe03e14ee093 |
| SHA1 | aed1e9ac0d1ee6d13cf1aae9ec2b99771818fde0 |
| SHA256 | bc33dd3d0fabdafea5e49e37b2f291198685756645af601687ab473bc8b6c08f |
| SHA512 | eb65b06a5e5123816cafabf3e63a078d3c9626225f98558adb195c75b81c55766aeba51874f87848dd88c6540b379dea244028d3f52ae05faf77315e973cc536 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f8589870-6703-455d-88ef-544d889c2006.dmp
| MD5 | e8562ef44b561913bbb978b2358a4477 |
| SHA1 | 606e8d11fc13d201686d86c72b84c20845ed0e14 |
| SHA256 | d685de88885858320f8da55f6dcbd6db888e7a977d14932b620147072a63978e |
| SHA512 | a143cff4878c9fb55fbfb74bfa996851981e207b593596ed0f77dd323f954abc6f0edd23fc082902cd8a264f94ce0a6a334b03b6df7b36fda087663188ec8feb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 3b3f0618fd790372989821e81c7c4f21 |
| SHA1 | 5f81e1e22a3be41a6d13b507954caa577c76df06 |
| SHA256 | d8c8190637705a79dd1c0ddabecb929f2f348246a42d24ac9dccf0aa48284821 |
| SHA512 | f143708fcabafc248a4684f763b4add60cdad5efe58a046f3740394521fd77bf67894bd681f76d1414a80c04a3ffe4fd6b4bfcf4d5c5d366887c478ffb6f418b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 5fd6b87d19bba9b5b24a4d169eca7b38 |
| SHA1 | 07b47d3ae59eb148a563f91f614549922a169b29 |
| SHA256 | c72c1e0ece9acc6119d17233ba7db49c86818f6f685bac451441d3d8ddd6a89e |
| SHA512 | 6abda200fea4191bff766b1e706ca4abd184e2850e4894b79efea7a7d944b6ed0bcbc40d39539be8291be1c8b30c46ce1ddca4e4542e1d7f5125de7778107592 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c49c93b1a5540c6615453addecc3d7c6 |
| SHA1 | 389d7ea2c189ad3831a059a63b6486abcb100496 |
| SHA256 | d6f36df444f0a1ee578a5448b6aa65dca8639a874d5adb8dfc89d2adabbb95a6 |
| SHA512 | 68024cb8149fd30db779062bc71f1baaaf30a3c0a5df2aabd6f149b5aac831c49769df9b8d099f09ad437ad9696a805305f92aca1a91dac3f8820df8a0b4a29f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 664d4935ee0d5c5a92f59babd66a0c39 |
| SHA1 | 0958d5928b221eeda171fd16ea2c4ca9ec4255df |
| SHA256 | 06f972bb70b868af09ef7e4a62c3ac9f71a1cb4c8e42882f213de90650eb3704 |
| SHA512 | c13594baedd896a173b470ca1e79b8c3da3d08e270fb93d4fe02620379d852da8f731ef6e65d9184d94623bef59f2a817e3a8db878e3b5b2e94bb13d6cb45ca6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | c99c6df60af96fbcbb449cc534b7151f |
| SHA1 | d2247194ac83b6a51a8bb74cda07eba9e574f31a |
| SHA256 | 68cdbe960b320f33619f015bd6c429213de663748e9ece8d1dac1e9d212159d9 |
| SHA512 | a2adfdc12d53a1347e8fa817a5a5fcc6b151b11c2d7dbfa65c9eec3c000e7409a69215b1bad0aec8bc95b680ebf4006e9960b0378dc734dbfc441de3589a63fe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 5a100ae26755181eac63212829304803 |
| SHA1 | 2c15d33234cf77f623831fb489f9b9b6316ef9d7 |
| SHA256 | 501e4ae64a9d42bbb39d1d47c3ca288c1e0caca8074771f2bf7769a2bfa922b6 |
| SHA512 | d10879188f29d2fa4c768f4553a9de9fbad5deba68bed3da5bdbcaf4e7929e0e1d403808af22badb808fab7f0016d1220f16904f22398a715a663ea9f68e987b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d
| MD5 | c9ba5d0a50addd4245b756b38d3ed45c |
| SHA1 | f4b48f5cea9be942679a08ce50e468f9d790d558 |
| SHA256 | b3f3a667438205104116c8c37528758158ba0fcea93b0b126ac884d4fb84919d |
| SHA512 | 2fd474793befcea6cc802101ad64e0a2261ec75059c426eb89f2179493ea146a58de764fc98b0b4c7f2d1461d65db2434497942eb8485ef3c3a586bd2aa06fed |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b
| MD5 | 248aed638d8712f1acffeb01aeed7938 |
| SHA1 | 3391ce6f82c2b11fd9f746d9aca571e86c06ca8d |
| SHA256 | 9d076a31cf04c6ceb837196728d0b25960f3a2e2110673f2cf192b5ffd5e3f4f |
| SHA512 | 17775b3aa62b1bbf20484e1d4b75be4cb1b7dead01003510cdff07beb2ea1dc4f841ead2da7b0c3778055ba2966fd49b71e7207151dac202e112f5b41ec0c2b2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008b
| MD5 | 6ae3a1ac98f3f8019449022f8f381d62 |
| SHA1 | ed3d5464008b656e41bc2d14f467eb0bf40a0d6d |
| SHA256 | 6b68ea56c8feb2c7ffcc1a59b82180068ee1f53ae860a052bc6e3f1f03ca0905 |
| SHA512 | 78612c4174609f0857174ba0b281f1f74aa8ad4a954f62c13c84bf94219457e278a8c01bb911b649be58d02472f99cc54d0fc576572d8841ecdd61fd5ba394ca |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083
| MD5 | ca4ccc9e5df4c221d2f6cf02bfeeee15 |
| SHA1 | 1bcc24278dcf62f4488c93d1e6ad03b24785a753 |
| SHA256 | bb95beeb3eb7fd4f4af6a1033b9549b7db8e9dfcb8a223b7c604bbe730427477 |
| SHA512 | 071b5041379d19526ea86d08d74dd50446be6601bc8a19beb29468735d4792bf4327b9bb6829d5dc8db890149dd2ef1e8f8659f1aa46764628282af9f1f902ee |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
| MD5 | 85571b91665c09836cd53704cd277c67 |
| SHA1 | 58156cce20f0d25a67a2b14d7bb6d1435b9f6ef8 |
| SHA256 | 340dce6a41f4a71c8e71990fe4ea4a76d30f484bb912afd759f5db8ebebb55f1 |
| SHA512 | c06c532d35a23cc15b90f4f665701e0c274dad86287e96423124edc32e21775aab3250674bde68e5ca3452b9553e7eb7fd595fd2df821743b1ccb526657547e0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000122
| MD5 | 8ad6481f0602dc780e7b8904aae6ccb4 |
| SHA1 | e88913266c604a380f25a15e9b38ec302663eed7 |
| SHA256 | ffa9d302298c773f6a403ae6151a03f673ae2cc20dabff3b7459f9663ebbb1fa |
| SHA512 | d91b8448f32999fb59e0d43cc9f99be16ef31f39f29c0a60c3a7936a8da189bce697a309ef9a0e6b84246b649e54cad6c797d472c0b12f980678647710927b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | e9403d07225869ec0585e10812d0b1ea |
| SHA1 | 5e36afeeaf3a9f62e7d1191640ef79bd9b91b26f |
| SHA256 | 9a50e560ad5c72f51cf34326882e968e5209a08112b61c7fc15e0c97a7b11a0b |
| SHA512 | ba0b95a3cb26e27f3e87930550c76ff3b8500fc9f5413cd71b8db265c3c7f7b7e0445292789c108d135e8b05b36ed5d947db319d93b6b5fdea94f15917810a74 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 2695cebe47d75b5ed6937129093a4790 |
| SHA1 | 6ee732cebd0d937128a3116a4c11f16412a85836 |
| SHA256 | 6ff58f933003651d2993c46380f23452413ab227039aa1e814971b85a33e5a7a |
| SHA512 | f41c630341faa1d7ce1f5d2486efbcfd02528a2f74eef53e6ebc058c0440ac1c07fa39a16be7ef26a7ba80daa1b10f7d970b558394e2b746e9c1f7444bcfdc14 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5e47c3a9f17c0dc4802c30fc1268e699 |
| SHA1 | beab5bc077826709e823d60eca6a323b972faa6c |
| SHA256 | 64dbca4c11e16f4706a774f3543a5f5bd65b794430b214f7f6fb7995d3aea833 |
| SHA512 | 164147f142dfb100e4253b077b0f1d7961de42c42d0bdc642e2f82e56b0610bb30115f739535450d707230f823429ae883dd53d8c9d0cb560ae459f4cdcb182b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
| MD5 | e3c6ac045ca2c7bcac384ef158f49437 |
| SHA1 | efd3435d2253d067cf0c6df8eb9628dface9bf27 |
| SHA256 | 59e37e96c2e7ed33723317c822772c4710287cb74ceb85abf5db135facee5814 |
| SHA512 | 7b4c68474a0041a4357cc6f138d6aed0abd525ff8564a969a07c7c3e15af101faf8738826454ad06a0ace9d8b0205b9bb03ca35680fbd0982ad48169c8dcda6a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 179aa13b462a551c3cf932e57de70e26 |
| SHA1 | 4c17b46c539e7c99adb92cd5fc93150bc14d4230 |
| SHA256 | 8ed1591867b654fb7c599bdb35ad8aa4df463d16be2a6f725f4fdbd854062508 |
| SHA512 | d2fd5f9b9c6eaa087bdd4ace806818c8e4ca810a1bc3ce7175c5c42cd5c672113b9627d78dc8561d89e5fdb45d9cd14c684fd9fb406cc2fe9e464babc6e2d398 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
| MD5 | 948ed5012489ba655650015d39adfe83 |
| SHA1 | 89431ee294cbf98e3e9ce9b4ef8218e83fdc2b35 |
| SHA256 | 6d746a20a5857f7a8336dcad8cac2a578e41ed2a0237bfee2bbf3de2e4a79812 |
| SHA512 | 2383bfab9d33da0af6f265b5c50fcf10485fdcd1a299dc8c3682efb0d1169cf97c6d04ba79dd17613e097c3314eab97654c0646548bf94e9ca0d5ff7454d5390 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 5d48b18d4318b3174120ed117e7a036e |
| SHA1 | d7ec44cb405ca5f72e1e381d7cddf4817a164740 |
| SHA256 | 33ca65320e7be3bd77e4e18e5e9b9d38106db506f9ded514a1be79590e6a9a6e |
| SHA512 | 5e8f327d67d1cdbc7dc2f4a3ef65c4042c823d333535be7dd919a2fa2eaad9a75a431f8b8d05dc88df35ad8c2567181f0b9f4993c48112aebfcefd5814335d1d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 3abef6750e6629ae43785ffb6baae8e4 |
| SHA1 | 9749e23b989a42efad65dc23a8889268b17de8ac |
| SHA256 | 45ae9974b68647e450bddb5fbffdbee7ddb929d90964aa6cd18fff02544bd854 |
| SHA512 | 065fec972cc2a2ef65f73e6acda349cd9cede1cceb19c34d7aecfb94648e71bf5fd19a1b422c604db42c32392f0d15de99a14f3d77829db0ec5584f99880a266 |