Malware Analysis Report

2024-10-19 11:40

Sample ID 240702-p36araxcmm
Target http://lacplesis.delfi.lv/adsAdmin/redir.php?uid=1439888198&cid=c3_26488405&cname=Oli&cimg=http://lacplesis.delfi.lv/adsAdmin/i/preview_610959355.jpeg&u=http://u45399925.ct.sendgrid.net/ls/click?upn=u001.P5twhHPZ8ddWUFr7QzBnFwu49oAc39ZGizb-2Bfon967kbcwRt2sNk6JjfNCZEE-2FTF-2FHoiWdYQrm-2BaC52TuWCJej0YI5kfex8VfzUB1a67WbLiT9ohVcNtosyNi9ytLLEcDQXfRBVAA-2FdpgZtDkHQ8xs4SIoBnJAud0U-2FjpMXqFKFlTd0oPucHMBmsfYbr1W1bFPuqjXwvWKhbYIawiZ-2FwOAwiIppc-2BCo-2F8nqqi4BfLzk-3DMqvb_NbKRw1e3eztFxz5vjavcmdoozMVb-2Fr9DO9Yopnv1-2BLKGiSlXTn5tLJ1E7D2gLcuSGQnw2-2Fq4dCGhuTgI-2FCh5wHXEnMeo0XxpcK4Mkyr-2BEvScg-2FUSbGEX9xfg7lbd7-2BEUQV4vzADZ1KbjvJb-2F3jeIzI8hMEWxcR-2FvoUctYwvxe6s8UPP7JWdl8MT6KpZBxyaUh915FMBuvi2lS6-2F8fnrckX9z1kD9sexnkBHRayLfAlh-2ForEpzapShaXRSzAtUpDX0sBB2LbmnEos21q1NyUL3QsMhMVGxXLqUuSt6pUy07V9B9Sh6jRjnbDb6-2BdhXshHy9AJkauhe2uJY5ocKUdgGbRT-2FLzAmQyl1NT1kteHPrWoZ-2FeMfwWZoaws4bMh8gV6TH9XPlpoVe9KPpNrxZoApxusvvksTCG28qqycpgMXINjNOsje7gNMLZggLxa8d-2FF&c=E,1,5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq&typo=1&sa=D&sntz=1&usg=AOvVaw3M2IK1451r_uQGYiEVyOIF&sa=D&source=editors&ust=1719861584574540&usg=AOvVaw3XnUDNEs0mfujfRThl97w7#Z2V0YXdheUB5b3VyaG91c2UuY29t
Tags
phishing microsoft
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file http://lacplesis.delfi.lv/adsAdmin/redir.php?uid=1439888198&cid=c3_26488405&cname=Oli&cimg=http://lacplesis.delfi.lv/adsAdmin/i/preview_610959355.jpeg&u=http://u45399925.ct.sendgrid.net/ls/click?upn=u001.P5twhHPZ8ddWUFr7QzBnFwu49oAc39ZGizb-2Bfon967kbcwRt2sNk6JjfNCZEE-2FTF-2FHoiWdYQrm-2BaC52TuWCJej0YI5kfex8VfzUB1a67WbLiT9ohVcNtosyNi9ytLLEcDQXfRBVAA-2FdpgZtDkHQ8xs4SIoBnJAud0U-2FjpMXqFKFlTd0oPucHMBmsfYbr1W1bFPuqjXwvWKhbYIawiZ-2FwOAwiIppc-2BCo-2F8nqqi4BfLzk-3DMqvb_NbKRw1e3eztFxz5vjavcmdoozMVb-2Fr9DO9Yopnv1-2BLKGiSlXTn5tLJ1E7D2gLcuSGQnw2-2Fq4dCGhuTgI-2FCh5wHXEnMeo0XxpcK4Mkyr-2BEvScg-2FUSbGEX9xfg7lbd7-2BEUQV4vzADZ1KbjvJb-2F3jeIzI8hMEWxcR-2FvoUctYwvxe6s8UPP7JWdl8MT6KpZBxyaUh915FMBuvi2lS6-2F8fnrckX9z1kD9sexnkBHRayLfAlh-2ForEpzapShaXRSzAtUpDX0sBB2LbmnEos21q1NyUL3QsMhMVGxXLqUuSt6pUy07V9B9Sh6jRjnbDb6-2BdhXshHy9AJkauhe2uJY5ocKUdgGbRT-2FLzAmQyl1NT1kteHPrWoZ-2FeMfwWZoaws4bMh8gV6TH9XPlpoVe9KPpNrxZoApxusvvksTCG28qqycpgMXINjNOsje7gNMLZggLxa8d-2FF&c=E,1,5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq&typo=1&sa=D&sntz=1&usg=AOvVaw3M2IK1451r_uQGYiEVyOIF&sa=D&source=editors&ust=1719861584574540&usg=AOvVaw3XnUDNEs0mfujfRThl97w7#Z2V0YXdheUB5b3VyaG91c2UuY29t was found to be: Likely malicious.

Malicious Activity Summary

phishing microsoft

A potential corporate email address has been identified in the URL: [email protected]

Looks up external IP address via web service

Detected potential entity reuse from brand microsoft.

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 12:52

Signatures

A potential corporate email address has been identified in the URL: [email protected]

phishing

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 12:52

Reported

2024-07-02 12:54

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lacplesis.delfi.lv/adsAdmin/redir.php?uid=1439888198&cid=c3_26488405&cname=Oli&cimg=http://lacplesis.delfi.lv/adsAdmin/i/preview_610959355.jpeg&u=http://u45399925.ct.sendgrid.net/ls/click?upn=u001.P5twhHPZ8ddWUFr7QzBnFwu49oAc39ZGizb-2Bfon967kbcwRt2sNk6JjfNCZEE-2FTF-2FHoiWdYQrm-2BaC52TuWCJej0YI5kfex8VfzUB1a67WbLiT9ohVcNtosyNi9ytLLEcDQXfRBVAA-2FdpgZtDkHQ8xs4SIoBnJAud0U-2FjpMXqFKFlTd0oPucHMBmsfYbr1W1bFPuqjXwvWKhbYIawiZ-2FwOAwiIppc-2BCo-2F8nqqi4BfLzk-3DMqvb_NbKRw1e3eztFxz5vjavcmdoozMVb-2Fr9DO9Yopnv1-2BLKGiSlXTn5tLJ1E7D2gLcuSGQnw2-2Fq4dCGhuTgI-2FCh5wHXEnMeo0XxpcK4Mkyr-2BEvScg-2FUSbGEX9xfg7lbd7-2BEUQV4vzADZ1KbjvJb-2F3jeIzI8hMEWxcR-2FvoUctYwvxe6s8UPP7JWdl8MT6KpZBxyaUh915FMBuvi2lS6-2F8fnrckX9z1kD9sexnkBHRayLfAlh-2ForEpzapShaXRSzAtUpDX0sBB2LbmnEos21q1NyUL3QsMhMVGxXLqUuSt6pUy07V9B9Sh6jRjnbDb6-2BdhXshHy9AJkauhe2uJY5ocKUdgGbRT-2FLzAmQyl1NT1kteHPrWoZ-2FeMfwWZoaws4bMh8gV6TH9XPlpoVe9KPpNrxZoApxusvvksTCG28qqycpgMXINjNOsje7gNMLZggLxa8d-2FF&c=E,1,5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq&typo=1&sa=D&sntz=1&usg=AOvVaw3M2IK1451r_uQGYiEVyOIF&sa=D&source=editors&ust=1719861584574540&usg=AOvVaw3XnUDNEs0mfujfRThl97w7#Z2V0YXdheUB5b3VyaG91c2UuY29t

Signatures

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4960 wrote to memory of 2644 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 2644 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4960 wrote to memory of 4416 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lacplesis.delfi.lv/adsAdmin/redir.php?uid=1439888198&cid=c3_26488405&cname=Oli&cimg=http://lacplesis.delfi.lv/adsAdmin/i/preview_610959355.jpeg&u=http://u45399925.ct.sendgrid.net/ls/click?upn=u001.P5twhHPZ8ddWUFr7QzBnFwu49oAc39ZGizb-2Bfon967kbcwRt2sNk6JjfNCZEE-2FTF-2FHoiWdYQrm-2BaC52TuWCJej0YI5kfex8VfzUB1a67WbLiT9ohVcNtosyNi9ytLLEcDQXfRBVAA-2FdpgZtDkHQ8xs4SIoBnJAud0U-2FjpMXqFKFlTd0oPucHMBmsfYbr1W1bFPuqjXwvWKhbYIawiZ-2FwOAwiIppc-2BCo-2F8nqqi4BfLzk-3DMqvb_NbKRw1e3eztFxz5vjavcmdoozMVb-2Fr9DO9Yopnv1-2BLKGiSlXTn5tLJ1E7D2gLcuSGQnw2-2Fq4dCGhuTgI-2FCh5wHXEnMeo0XxpcK4Mkyr-2BEvScg-2FUSbGEX9xfg7lbd7-2BEUQV4vzADZ1KbjvJb-2F3jeIzI8hMEWxcR-2FvoUctYwvxe6s8UPP7JWdl8MT6KpZBxyaUh915FMBuvi2lS6-2F8fnrckX9z1kD9sexnkBHRayLfAlh-2ForEpzapShaXRSzAtUpDX0sBB2LbmnEos21q1NyUL3QsMhMVGxXLqUuSt6pUy07V9B9Sh6jRjnbDb6-2BdhXshHy9AJkauhe2uJY5ocKUdgGbRT-2FLzAmQyl1NT1kteHPrWoZ-2FeMfwWZoaws4bMh8gV6TH9XPlpoVe9KPpNrxZoApxusvvksTCG28qqycpgMXINjNOsje7gNMLZggLxa8d-2FF&c=E,1,5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq&typo=1&sa=D&sntz=1&usg=AOvVaw3M2IK1451r_uQGYiEVyOIF&sa=D&source=editors&ust=1719861584574540&usg=AOvVaw3XnUDNEs0mfujfRThl97w7#Z2V0YXdheUB5b3VyaG91c2UuY29t

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6230099730496523405,13833188135430295725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 lacplesis.delfi.lv udp
LV 62.63.137.94:80 lacplesis.delfi.lv tcp
LV 62.63.137.94:80 lacplesis.delfi.lv tcp
US 8.8.8.8:53 u45399925.ct.sendgrid.net udp
US 167.89.118.28:80 u45399925.ct.sendgrid.net tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 94.137.63.62.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 sofia092111.github.io udp
US 8.8.8.8:53 28.118.89.167.in-addr.arpa udp
US 185.199.110.153:443 sofia092111.github.io tcp
US 8.8.8.8:53 igbh.ingoguat.com udp
US 8.8.8.8:53 ajax.cloudflare.com udp
US 8.8.8.8:53 cloud.antibot.cloud udp
US 8.8.8.8:53 alt.antibot.cloud udp
US 172.67.204.31:443 igbh.ingoguat.com tcp
US 172.67.204.31:443 igbh.ingoguat.com tcp
US 8.8.8.8:53 31.204.67.172.in-addr.arpa udp
US 8.8.8.8:53 153.110.199.185.in-addr.arpa udp
US 104.17.73.14:443 ajax.cloudflare.com tcp
US 8.8.8.8:53 vyscw.25bvnw8.ru udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 104.21.76.172:443 vyscw.25bvnw8.ru tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 151.101.194.137:443 code.jquery.com tcp
US 104.17.2.184:443 challenges.cloudflare.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 14.73.17.104.in-addr.arpa udp
US 8.8.8.8:53 172.76.21.104.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
BE 23.14.90.73:80 apps.identrust.com tcp
US 8.8.8.8:53 14.24.17.104.in-addr.arpa udp
US 8.8.8.8:53 137.194.101.151.in-addr.arpa udp
US 8.8.8.8:53 184.2.17.104.in-addr.arpa udp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 cdn.socket.io udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 www.google.com udp
GB 18.245.187.34:443 cdn.socket.io tcp
GB 20.26.156.215:443 github.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 34.187.245.18.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 43.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 ok4static.oktacdn.com udp
GB 108.156.39.60:443 ok4static.oktacdn.com tcp
GB 108.156.39.60:443 ok4static.oktacdn.com tcp
GB 108.156.39.60:443 ok4static.oktacdn.com tcp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 60.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 httpbin.org udp
US 3.227.135.8:443 httpbin.org tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.135.227.3.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.8.44:443 ipapi.co tcp
US 8.8.8.8:53 hpd.ingstio.com udp
US 172.67.143.252:443 hpd.ingstio.com tcp
US 8.8.8.8:53 252.143.67.172.in-addr.arpa udp
US 8.8.8.8:53 44.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 aadcdn.msauthimages.net udp
US 152.199.21.175:443 aadcdn.msauthimages.net tcp
US 152.199.21.175:443 aadcdn.msauthimages.net tcp
US 8.8.8.8:53 175.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4960_SHHLIWUGYCGXIZCY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5dfc88fef0bb9bc198c672605ed4ae19
SHA1 ddea03e0db74093a3df8fd67bae4a45899eb5fc6
SHA256 e6cf6be49180227033d7b1e6bf070e63798c60e49fcdf7f96b7867fb68f93040
SHA512 cf5fec5bf9210b76c5d6250cdcf76628c25a40076c7db5448568071a395bd6295cff95c164781b985954abb42b01eb094753ada3083afe4d7a791571688dc10e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3d3db194e31107f92bb15b2ff4df0505
SHA1 28f63849a4d6690567156fc1fc96459d8becd6c4
SHA256 7a029ba25ccc6e4535c8023f5b3aaeeae5de1f4b8505295477c7df44ba98a2d2
SHA512 bb8147e7af44710e9d3e82e360820603e222973e4e8222eeab8eee0f43b083e9e2765b10b570f2698af1e157a43e45f5b3a13692484919fa49999aa7bb919587

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6a62308a7f1fa731071ab54f756a7dd9
SHA1 be80cb4b13f45dafae76df9ab603c2aa5bdd5592
SHA256 8c0b599011be9aea982505c775781795cfd25788fad1f727f8dda5f62ee39ee5
SHA512 dae9031b9f7b3bdf0c3eb17f76c6337c5f2e0c5f07c7f530d06d44242340275cf4a13c120bfd96b249f2881ea177ac358317b1294265444708e5413e177fee7e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 66e355279c2a5ad047cd0b2eac15f8df
SHA1 77bc87c593851a67d0059292bcf5c8c1284044b3
SHA256 18cd224a601cf8e560c6cad1031018de631aee7499f6f1fca0570c6342a46cd2
SHA512 34f4d3ed3fe9a2ccbdeb4005cff96ac99bc431c8e3551fda5346c41b70bb4424d8b79b7877940489a359379cafe09bae59a216261bb9e91c4fed747a111a063e

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 38ef6a7f717b1647a8452608796f5172
SHA1 8e722c15bb0790e045a6bd64f38ce90010c7b98c
SHA256 ac034465b114efbb8c455b1711c22b03c799785545e0d49bbe9ddc8d8ed6b4e7
SHA512 38b302621261f1ebc83cc94647338ad137a5d7f8cbf8d426f52089b51fc56b99296c396d3e2bc7055a31092c097dbd9d2ef83972e136a52fb3346adf008d1b3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6afdef07e2acfcfb075bb4be69b281bd
SHA1 c5b6141e54b62831f69cb25713d80dde52ecb95f
SHA256 834f2dfd7c8ac842d911be86824c0631282e15f774e3887c71915f8db846b034
SHA512 f99039c30a4a27f451b517cd79eeeab9cc09515d9b75c0bf6269ddd8d0ac592500d27fa7997302e2e55081c7c648811c67a56a276617c0837e4a23b69ad2303c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813a2.TMP

MD5 1d547a12d1af54de97dce964e3c65358
SHA1 05485fe720f62eaa80f96524d1e53eba465c0a3a
SHA256 2af2f12cb6dca81767c476695c0d9d03447aee9d70d460abfbda0dc747ce4c54
SHA512 27132813c5ee1e820da3f7f460d11c2ccef73ff4fa8664f6406728bcbf66effa517488f091d855c07aa3f5d99d851b3c1c6d117309c7ea0988fcd012996ff902

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ad7007bb831e51343ef58cf6608f6464
SHA1 dce3f18fabb9623b769f3e1b9f48aff36ac75679
SHA256 71e6bfca3e2a39644136d02e5237459208660dfcb61b629191fb2a1aec5cb7b6
SHA512 dd2e52fb56410067b9d425ea57f90c763be9ce47f819672ac8e1094312c65aafca4b24199161d3a6d23547f8d613c0faa0f036f01c800d5255f5e2b1c3513ca7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 603ceb595121b1ee3a389f02c8e9bd73
SHA1 8c5ce3c8527d167083e1485b286c284e06357522
SHA256 bc622fbac7aff3da35aa8aede6ee49d56f4e8427dccc8d241d0b87a98831b1de
SHA512 71e457ed5a3874a117ad20c189f0f80bc4431ac8ff35d5e5103ac4d0f8c0bdd0e1a6c737e6d06028d542154171e3f3daf5a060a8374e5ed7a51509c4c4106342

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2534566ddfd7d77a184fbeff86e4ba36
SHA1 392cbb7271eb9c56aac25ceb84dd4fd917e39926
SHA256 60ae8f5bc54c9906b79dcfe763fd68fba3abaeafd85645afe44e9908662a98da
SHA512 cf3685549b60b26107e0c6b31dd7282e5d5dffba797184a35bdb3dfb6d76fe8b978841caf1a946ac9f22176e4cfbf8b69346a4fb82cce1c9473093ce6678fe04