Analysis Overview
Threat Level: Likely malicious
The file https://klick.publikator.se/?BREV_ID=592&[email protected]&URL=https://v3accountancy.mx-router-ii.com/c/69qz/kiqzg4uc/isf4bjxuwl4 was found to be: Likely malicious.
Malicious Activity Summary
A potential corporate email address has been identified in the URL: [email protected]
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-08 00:45
Signatures
A potential corporate email address has been identified in the URL: [email protected]
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-08 00:45
Reported
2024-08-08 00:47
Platform
win10v2004-20240802-en
Max time kernel
81s
Max time network
81s
Command Line
Signatures
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://klick.publikator.se/?BREV_ID=592&[email protected]&URL=https://v3accountancy.mx-router-ii.com/c/69qz/kiqzg4uc/isf4bjxuwl4
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd582646f8,0x7ffd58264708,0x7ffd58264718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4935163779003438119,1666630668380497672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | klick.publikator.se | udp |
| SE | 89.107.213.153:443 | klick.publikator.se | tcp |
| US | 8.8.8.8:53 | v3accountancy.mx-router-ii.com | udp |
| DE | 185.103.10.2:443 | v3accountancy.mx-router-ii.com | tcp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.249.124.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.213.107.89.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.10.103.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98270205.2bc3493b616168448d112e82.workers.dev | udp |
| US | 104.21.10.110:443 | 98270205.2bc3493b616168448d112e82.workers.dev | tcp |
| US | 8.8.8.8:53 | challenges.cloudflare.com | udp |
| US | 104.18.94.41:443 | challenges.cloudflare.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| GB | 2.18.190.80:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.10.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.94.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | saleshbsquawkingmagpieconz.buzz | udp |
| DE | 195.133.88.5:443 | saleshbsquawkingmagpieconz.buzz | tcp |
| US | 8.8.8.8:53 | r11.i.lencr.org | udp |
| GB | 184.28.176.80:80 | r11.i.lencr.org | tcp |
| US | 8.8.8.8:53 | pdiemailprofitdailyinsightscom.buzz | udp |
| US | 8.8.8.8:53 | 5.88.133.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.176.28.184.in-addr.arpa | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | r10.i.lencr.org | udp |
| GB | 184.28.176.80:80 | r10.i.lencr.org | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | udp |
| US | 8.8.8.8:53 | res.cdn.office.net | udp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| US | 8.8.8.8:53 | csp.microsoft.com | udp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| GB | 2.16.167.144:443 | res.cdn.office.net | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | eu-office.events.data.microsoft.com | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| IE | 20.50.73.10:443 | eu-office.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 144.167.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.246.107.13.in-addr.arpa | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | aadcdn.msftauth.net | udp |
| US | 8.8.8.8:53 | aadcdn.msauth.net | udp |
| US | 152.199.21.175:443 | aadcdn.msftauth.net | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | 10.73.50.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.21.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | outlook.office365.com | udp |
| GB | 52.97.165.146:443 | outlook.office365.com | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | privacy.microsoft.com | udp |
| US | 8.8.8.8:53 | r4.res.office365.com | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | 146.165.97.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | autologon.microsoftazuread-sso.com | udp |
| IE | 20.190.159.64:443 | autologon.microsoftazuread-sso.com | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | passwordreset.microsoftonline.com | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| US | 8.8.8.8:53 | aadcdn.msftauthimages.net | udp |
| US | 13.107.246.64:443 | aadcdn.msftauthimages.net | tcp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| DE | 195.133.88.5:443 | pdiemailprofitdailyinsightscom.buzz | tcp |
| GB | 52.97.165.146:443 | outlook.office365.com | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | identity.nel.measure.office.net | udp |
| GB | 2.18.190.132:443 | identity.nel.measure.office.net | tcp |
| US | 8.8.8.8:53 | 132.190.18.2.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 27304926d60324abe74d7a4b571c35ea |
| SHA1 | 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1 |
| SHA256 | 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de |
| SHA512 | f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 9e3fc58a8fb86c93d19e1500b873ef6f |
| SHA1 | c6aae5f4e26f5570db5e14bba8d5061867a33b56 |
| SHA256 | 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4 |
| SHA512 | e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e |
\??\pipe\LOCAL\crashpad_4224_VZBLBOZAGBXXXHNL
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 87f815c00c2795afe5e60eb1d9cca4f7 |
| SHA1 | 26f5d6726e66278045b4b98ed4b57311e5e478ff |
| SHA256 | ec4e845d5665998ed54fff58f5380f6f9ddf628fbde71d3ccfaad1e476d61608 |
| SHA512 | eb2cbce8197e351f4bb1264b0759493434b65f36ba0fda119cfd5774f5c7d586e6a61613902746544f84018a5f10993db700a2b45441f5d72e3763d99977244b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 4ef720db02c442573928dde58390361d |
| SHA1 | 7dc1e8f2830232215bb18a4f385a736d97b7654c |
| SHA256 | 2bfaaa433395c8f02c7424cf04a70f90aad8b5e119f5754b8a666e09e3f72c7b |
| SHA512 | 860a0863457af3e1b191a47e782f7baa596237870765a70c4615c7a43bfb8c45462e98662aa8d28068a65b2cdcc20f5a236352cd95d636df4ebc3c9acbd053e3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7455faa72783f20e92ab1164d4151f12 |
| SHA1 | 60637bd5758abaa322ccb0dd5fed3e1a6ce3c2f0 |
| SHA256 | 05c64cd2c68a4c9efffbc093847d76c1d7833d155ad74c1df724041579609257 |
| SHA512 | 232a0aba25c08bf04f339291fe897c21cd52455b7885e5df11f254b840db8b1d413af716ef5480d187135e7301a9906bd87502a8817dc7f69ef4f9c779978c73 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c56cd3187e2513f4b65fef9fb6357904 |
| SHA1 | b55a22dfcde552969acb44c70cabec21cd70b416 |
| SHA256 | 4b4c7cb3dfbbc91f68d382406d8edc8b2a658321d167b726da8d525dc21e1b04 |
| SHA512 | 041ce3cc4cdad11dce95f1bb410c883645e9346ca15fd5a91e130f98773d1535e7d41b446d16116ec8aacdcf5d2900c124d951b25d5a90ac71598dcfea051119 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 36aebf9fa4189fc747ab36d057aff13c |
| SHA1 | 41adc009cc04da3fc02a92c3b50d2e7ae5cd3ec6 |
| SHA256 | 02bf5ca50f21ba668b752b0c45618ceb17ba468e1c8e804e38d8be15adf4b7a9 |
| SHA512 | 2ae70a9187beddb3ca413dfcbf70ea0f900056f5e3b1f837cc3a517bfa3dbfd430629abbeff73311f111932ded4b7bfa19fa1017a90402b7ff3830de6fa89778 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 1d010dd7af5ab88bd0ef1102168faa80 |
| SHA1 | 7d266b0d148898a4b6799c3fe8e2e2e96fae4ee0 |
| SHA256 | bcc7008cacca4866e5e121897a4e152e023f58444ee5763053a510feba468df9 |
| SHA512 | 123d55a879d7b4d11026d9f1ace4eb38419e479daeb079af62878fe31b6d1daf12e673061d23d28a656f19177f73cbf1c1d0cfe5c4565aeb9aeb8c9ea787bf83 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c32.TMP
| MD5 | 1ac07ca3d4a1f5ed7bf20866d38035a9 |
| SHA1 | 54418583061463c12d6a6e438d2662be5d493992 |
| SHA256 | 42843e1112b4347a3419399e4e575649dd57fd5b83ec183d9e17bcc9323d2b33 |
| SHA512 | 53d12c921a132ea5c7e9d7ec089bfc4018446d410116cb59cf45ee4e333b08f2cd0f5be5d9d7c4041f43dfa6bd6d9e964ee39b5accdc437ad56ed5f65b189959 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 523ca12dc657d01c46d81cd3f4f1e1ad |
| SHA1 | bbad3d9651eab2e17b57730fc9b3c46bb544a07e |
| SHA256 | c5219a69bee517037eedacf9e96052c4e313fc74fa84771d23ba3f9616fbfbb1 |
| SHA512 | 1c89d1bf5b318576b19a14df9b346246025d4f86191d022d1a774d67bbf56b16839c50c95bd29033c81d6cb2119fdbbd1d60cf9d4527dcb89bb9bee2fbc37079 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | fd51c8982cad7f1ec17fc6d6e173a57b |
| SHA1 | 967bc8b19dc8ae014a1c99170b024d8fcc6bfd49 |
| SHA256 | 5a37470ab3a37a3e3a42457eafec333d0c49086ed15f39eeb8e522f7f128f500 |
| SHA512 | 0d145b3893970abbf8b95cf9f46340473ab8db01af8acbb6ff45144b4419cf3174966d9bcc02fc6dd35992577f2b1a47816105c694afc4863f63c18baab481bf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | e6d80b7e45de9d09dfb97d7691b0a834 |
| SHA1 | c9df70bcf30cc93dcb785fb2c367bf8dd6290a65 |
| SHA256 | 5d822ee7dd1a465435aad68ea67dce41adf732be8f9ff6d486ad10f6c5b35ff3 |
| SHA512 | e02f59ad4e65b408a5ecb7eea86b232f01890e23fd32de6ba24f5f55a0519fef6a07e6abe218affee0a4c894d920d9753478e635e6e2bb651e464801ce193e56 |