Analysis Overview
Threat Level: Likely benign
The file https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg was found to be: Likely benign.
Malicious Activity Summary
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-14 17:38
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-14 17:38
Reported
2024-08-14 17:41
Platform
win10v2004-20240802-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb057346f8,0x7ffb05734708,0x7ffb05734718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12725392267404332726,12203579095969691602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clicks.aweber.com | udp |
| US | 104.18.21.223:443 | clicks.aweber.com | tcp |
| US | 8.8.8.8:53 | form.jotform.com | udp |
| US | 35.201.118.58:443 | form.jotform.com | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.21.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn01.jotfor.ms | udp |
| US | 8.8.8.8:53 | cdn02.jotfor.ms | udp |
| US | 8.8.8.8:53 | cdn03.jotfor.ms | udp |
| US | 8.8.8.8:53 | hcaptcha.com | udp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.19.230.21:443 | hcaptcha.com | tcp |
| US | 104.22.73.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.73.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.73.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 8.8.8.8:53 | cdn.jotfor.ms | udp |
| US | 8.8.8.8:53 | newassets.hcaptcha.com | udp |
| US | 8.8.8.8:53 | events.jotform.com | udp |
| US | 104.22.72.81:443 | cdn.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn.jotfor.ms | tcp |
| US | 104.19.129.105:443 | events.jotform.com | tcp |
| US | 8.8.8.8:53 | 58.118.201.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.72.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.230.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.73.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.129.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.hcaptcha.com | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 104.19.229.21:443 | api.hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 21.229.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | imgs3.hcaptcha.com | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.jotform.com | udp |
| US | 8.8.8.8:53 | submit.jotform.com | udp |
| US | 104.19.128.105:443 | submit.jotform.com | tcp |
| US | 8.8.8.8:53 | y7mu.kremolitp.com | udp |
| US | 104.21.78.175:443 | y7mu.kremolitp.com | tcp |
| US | 104.21.78.175:443 | y7mu.kremolitp.com | tcp |
| US | 8.8.8.8:53 | 105.128.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chg56.nstailky.su | udp |
| US | 104.21.84.17:443 | chg56.nstailky.su | tcp |
| US | 8.8.8.8:53 | 175.78.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 8.8.8.8:53 | challenges.cloudflare.com | udp |
| US | 151.101.194.137:443 | code.jquery.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.18.95.41:443 | challenges.cloudflare.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| GB | 92.123.143.169:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 17.84.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.194.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.95.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.24.17.104.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.socket.io | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| FR | 172.217.20.196:443 | www.google.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 18.245.187.80:443 | cdn.socket.io | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.109.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 196.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.39.156.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.187.245.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.109.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ok4static.oktacdn.com | udp |
| GB | 108.156.39.24:443 | ok4static.oktacdn.com | tcp |
| GB | 108.156.39.24:443 | ok4static.oktacdn.com | tcp |
| GB | 108.156.39.24:443 | ok4static.oktacdn.com | tcp |
| US | 8.8.8.8:53 | 24.39.156.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.74.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | b9569e123772ae290f9bac07e0d31748 |
| SHA1 | 5806ed9b301d4178a959b26d7b7ccf2c0abc6741 |
| SHA256 | 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b |
| SHA512 | cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795 |
\??\pipe\LOCAL\crashpad_548_TYROQCQZPDZWCWYC
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | eeaa8087eba2f63f31e599f6a7b46ef4 |
| SHA1 | f639519deee0766a39cfe258d2ac48e3a9d5ac03 |
| SHA256 | 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9 |
| SHA512 | eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c3877677c7ee1cebb8feabc8e84fbdef |
| SHA1 | 806f55fb90a4d25f185d09f8807a8602ab1b33dd |
| SHA256 | caa02c4cdeb9841c7b881e5291893efb77fcf566acc21f9c2e1d51908c681800 |
| SHA512 | d6b92c6e2c4f314b5e83c8cebab5a4dbaaaec8d3471b15b9e457a9ec9120190e33afb0f8d0dd57a2dff67ad44f48d27796c0667f2d786b11676b56f9514c284f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 18a6d4554c874a568c841f2b50559b74 |
| SHA1 | 7a563c247b8eff2f532c174a93c85aaba35fb3d2 |
| SHA256 | 93ee42866ed4f16d8c3dbad8dd1dd8135eee6cfa1718dffaa89132ebe2a826d4 |
| SHA512 | 56d21333d395fbd1aefdd7fe44553d2300b28d7a35c746464718775cb73af695bd02ccdff4752b18e51fb45e88a5aa1055b1b95abd5fefe55af7566a418820e7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a44bc992f652b3f1bc876f23ca2ead1f |
| SHA1 | eeffab57d55a63ee7ddb6101dd04f423af494093 |
| SHA256 | 4ff71541de2222a361ef1f3464d57f31654789fce7bdfcaf2f8c374cebb7471d |
| SHA512 | 104752339944651ff824073a77da4c44e2929c984d35346176d697cafc583f233765e948f48d4dc157e007e3e2c4ddc848618bc7c92c6be9ee6ef39d27861314 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 25e7456d7dbe81ec5bdcd00d99a8a4cc |
| SHA1 | 35282322d272c582b328348c9928480ad749ca78 |
| SHA256 | c2cafc533333d182cb242a785f960016897c7ca21f015e7195e4ff0d4a039d0e |
| SHA512 | c302608fa9a6ce61d2e2e09fdebb62edc94f55b323eee01fb4d9399dd0c60f07196e28added5ccf0dbd23703ad49796f0de88156d517e137b3de0cb858fdbfec |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe63f61d.TMP
| MD5 | ad9545797f136c14788015dd6b548f3f |
| SHA1 | 6a72be66c4ef804b038e83e59ac987b340b9eb6f |
| SHA256 | 1ac9ceae3762164e576532019132357666ac53b757557c026cd4f329c837c362 |
| SHA512 | 2ef8b284e0ed1e6fe080c63647a2908d96f2dd3699927b10566867b124d6bd6da09db93110bec7e7c03f286735b2826014c60dc7ea726c629903a33a8485c1ad |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6ef4e0cf6202937266c7650ddd1a6639 |
| SHA1 | 6f5ee71c8070862752661d0780da0ffb38a2f50c |
| SHA256 | 03b861bd74539f3730489e4068edd8bfbafbce5d43c3d4d0ff27866e87377e19 |
| SHA512 | 958bcc5d63ec8cb097804adfd546a2bb83d51b8575e000d30da688ff0fdc7c9f1ada1765de4fdd1a73e787633f8a8455f93ed5c9cc6462738892520ca53beb70 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 0c5dd236817ed9807ffd89aceed8b8b4 |
| SHA1 | 4a421031778cd9cabd875e469cd3e19174da2ec9 |
| SHA256 | 98bbb39e0aaa5c29d0cc9a4905f3fed5acbc39c727ee53e46622c873671944ea |
| SHA512 | c5b70face9511fa29f5d9cf86193590616db97071b714f2cc1b037d75ba0e7221c95e9fbd42503f4dbdc7e808c69bbd4f662423b9744447dedb672f5d0da140a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 39e4e307154857d1789b83ff2180e753 |
| SHA1 | f81bf3b14003d7839f63d82bb041491c15101c8e |
| SHA256 | d77f5b212f75dcbe4b298dd723f38a5b1107b9f22379192da5f3cbf34620fc51 |
| SHA512 | 87e5d1b12d85d8dad7d6027929da4b9e2da51b1787cac2a970de5153174a1db1ea6fbe19b430ee54eb354b1afb7e0e8d27427d385d5b27d8aad59403151a77e9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f4b115576fb96228a9e9a06b586c0118 |
| SHA1 | 33abc6eb8ca20c762b4b7355aa0a9870597b9349 |
| SHA256 | 0568fccbcda407342a392a8861242789fec5e5aec2b8ff7d31d6cf7ebd8fae99 |
| SHA512 | bf527b5102a0cd625ec48ac7079035e211f49a64ab22155449d44ae14e8085ccddcbb89348403f398e1aa202dfa3416a4c295e029e34327481a79a9d3b7bd299 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b781ea7c8d1f718dd7aff94f6c87478a |
| SHA1 | 418ac1705c97574cb1bd0de921dd2e171b1428c5 |
| SHA256 | 230a1b86affa9b00cf4c276d42f0ad84c653c016e450540dd2691ffe6c30ed12 |
| SHA512 | 61a872abe63e1b40e33d640124d90dfd4841c9ec3ab2a1c4ea3604729fb1365b84c35a8c379be9cd9a17beeee7226580f2b76f7d426849b3311d00b0c72de8c7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 5b8a7ad31a5455776fa6d08cf9b69eb2 |
| SHA1 | ed5be36b511dd5014c69527a5eb89a075e37fff2 |
| SHA256 | 6ec547e3832183fd8763b6c320a7a90a967f1cf44c2f6cac4b3b0d22da1a44db |
| SHA512 | 6bb85b4028c11d8c5732861ca825fa7579762ccb7be0b5c3cb0e1b9fe17b92149ddb1b94cd89e05f4ecab92f148c14e9b59227ed8e3c6a520a7c448d46d9a51c |