Analysis Overview
Threat Level: Likely benign
The file https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg was found to be: Likely benign.
Malicious Activity Summary
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-14 17:40
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-14 17:40
Reported
2024-08-14 17:53
Platform
win10v2004-20240802-en
Max time kernel
720s
Max time network
725s
Command Line
Signatures
Detected potential entity reuse from brand microsoft.
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | clicks.aweber.com | udp |
| US | 8.8.8.8:53 | 21.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 104.18.21.223:443 | clicks.aweber.com | tcp |
| US | 104.18.21.223:443 | clicks.aweber.com | tcp |
| US | 8.8.8.8:53 | form.jotform.com | udp |
| US | 35.201.118.58:443 | form.jotform.com | tcp |
| US | 35.201.118.58:443 | form.jotform.com | tcp |
| US | 8.8.8.8:53 | 223.21.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.118.201.35.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn01.jotfor.ms | udp |
| US | 8.8.8.8:53 | cdn03.jotfor.ms | udp |
| US | 8.8.8.8:53 | cdn02.jotfor.ms | udp |
| US | 8.8.8.8:53 | hcaptcha.com | udp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 104.22.72.81:443 | cdn03.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn03.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn03.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn03.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn03.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn03.jotfor.ms | tcp |
| US | 104.19.229.21:443 | hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.jotfor.ms | udp |
| US | 8.8.8.8:53 | 81.72.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.7.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.229.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | events.jotform.com | udp |
| US | 8.8.8.8:53 | newassets.hcaptcha.com | udp |
| US | 172.67.7.107:443 | cdn.jotfor.ms | tcp |
| US | 172.67.7.107:443 | cdn.jotfor.ms | tcp |
| US | 104.19.129.105:443 | events.jotform.com | tcp |
| US | 8.8.8.8:53 | api.hcaptcha.com | udp |
| US | 8.8.8.8:53 | 105.129.19.104.in-addr.arpa | udp |
| US | 104.19.230.21:443 | api.hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 21.230.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | imgs3.hcaptcha.com | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.jotform.com | udp |
| US | 8.8.8.8:53 | submit.jotform.com | udp |
| US | 104.19.128.105:443 | submit.jotform.com | tcp |
| US | 8.8.8.8:53 | 105.128.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | y7mu.kremolitp.com | udp |
| US | 104.21.78.175:443 | y7mu.kremolitp.com | tcp |
| US | 104.21.78.175:443 | y7mu.kremolitp.com | tcp |
| US | 104.21.78.175:443 | y7mu.kremolitp.com | tcp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.78.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42ay.maktated.ru | udp |
| US | 104.21.23.73:443 | 42ay.maktated.ru | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 8.8.8.8:53 | challenges.cloudflare.com | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| US | 151.101.66.137:443 | code.jquery.com | tcp |
| US | 104.18.94.41:443 | challenges.cloudflare.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| GB | 92.123.143.169:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | 73.23.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.66.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.24.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.94.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.socket.io | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| FR | 172.217.20.196:443 | www.google.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 18.245.187.127:443 | cdn.socket.io | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| FR | 172.217.20.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 127.187.245.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.39.156.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | ok4static.oktacdn.com | udp |
| GB | 108.156.39.22:443 | ok4static.oktacdn.com | tcp |
| GB | 108.156.39.22:443 | ok4static.oktacdn.com | tcp |
| US | 8.8.8.8:53 | 22.39.156.108.in-addr.arpa | udp |
| US | 185.199.111.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.74.250.142.in-addr.arpa | udp |
| NL | 52.111.243.29:443 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.16.208.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 983cbc1f706a155d63496ebc4d66515e |
| SHA1 | 223d0071718b80cad9239e58c5e8e64df6e2a2fe |
| SHA256 | cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c |
| SHA512 | d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd |
\??\pipe\LOCAL\crashpad_620_ZJHZQJJEPHENQCCT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 111c361619c017b5d09a13a56938bd54 |
| SHA1 | e02b363a8ceb95751623f25025a9299a2c931e07 |
| SHA256 | d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc |
| SHA512 | fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2312c27077c71115561a99af9b083855 |
| SHA1 | 4e1c1ca195257458815e8fbc2141f6eae6d7e262 |
| SHA256 | 2f545c384ab41f2c98f2aab0548f069b71e9a944338f293a012aab2e706f9a5e |
| SHA512 | bfdbb20e5b5547fdad8fe7c3ca7c02726b5d16e6bfaa7c421af8e90b68eeaef1d5ddfd8e50012a9e963308a523044d75b7c5a7953ab074b84a9668cbbf933cf5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 029ad56fa19f481181e15ec89e4b65d1 |
| SHA1 | 5e265b76c6b5cb9d56123dbb7c122628ad443038 |
| SHA256 | 010d22ae97b2d9ee346c7aa93ae9764a58fc0c99bcf2b953628531633acbfb94 |
| SHA512 | 13c52790a417bda0554509b5b65abcf5a367c71340acb5db0c0db37c5c4d20d58a15735593dd801a72d6c6d3aac2021efa2b23fc3097b3e491ad576d5376a4d1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 66a58acc3191fa4874e3f4dcae233e1d |
| SHA1 | 3eb8d6993a9c233831ae9f44d8027c05a32e6fa6 |
| SHA256 | 1ecb6f5910ce034ed689e77783ec091632ca10ee4243633b05f1f492d0efa732 |
| SHA512 | 1dca90d8ad10f222d17ed2b57cd64b440e3b5af3047925c848e0f914fba0429798b440e6e08c007a97924c5b541d31bbbcf1dab0720b86dbf547ba35017825cb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 807419ca9a4734feaf8d8563a003b048 |
| SHA1 | a723c7d60a65886ffa068711f1e900ccc85922a6 |
| SHA256 | aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631 |
| SHA512 | f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823fe.TMP
| MD5 | 839dc710490f1b1b86b902c10231eb00 |
| SHA1 | 18e44354888a415a39cafa3ab3eaa0d1101752e3 |
| SHA256 | 05b9fcf9b7c69b2eb3567dc884a78e5aa52c3c66db593339e06bbe26cbca4961 |
| SHA512 | 83481f5a62eab91f9a82af90fffbb831409c5294d0e9e020fb7e733c179bc556f996897e2e95bc0d3923eca06fc714cc4374f347e1401a3355750220589b2927 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | f7672c165ddcb19e5c9f19fa26f3aabe |
| SHA1 | 383849cb1d761ca9ece1d7c85bec3feb603bde8f |
| SHA256 | c34707574e013051edb7d855688350cc2eebb9bad37a39d119fcdd85a0ff0c83 |
| SHA512 | 67ce04460f1c8a54d979c8461191e4b9258c4d68ee7be55b48ab5bcea5166401b0effde265a454c03533b645392616e9072b785af690241e7dd22a0761c3f6c1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 155ee1ae0400c559bc5c7920a7c728d1 |
| SHA1 | 7a4509598eb4169598ca66b49ace7f225a0e6003 |
| SHA256 | a52a80ce08ac52d117f9ae9df7a987297df26f932feb81f58262bba86ad44e65 |
| SHA512 | eaade80c89bfac17997d55d2024d55cd25f127de31aea16d7a9d0dcf711b731accf915f2018c372d27d299d92c1013a111f3e670ebe61049ef86a2e0d9545334 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | eb91c2ab9d2ba74f6f4ebed6a9c6ffad |
| SHA1 | 16d51b4a022d80e1bc28c7b8ad3c84de0beaf75e |
| SHA256 | 98dcd857a4245cde05f3666c70ac82929b5d6e42be97bd48273f3ee927e69a2c |
| SHA512 | e4b8ab7e240d27dbf3eda1e4c4b1794b3e5f52236a5a75c588988b8322c211aa60e8a070447d2a15c1b25cae42811fbcb3590474b15221b9caf827421542b090 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 430085d5ed5b79c83a255889559e3d0f |
| SHA1 | d43db17b7853642bff28beb37d800ee830e9b1fe |
| SHA256 | 3f3f0c2852ef621151ace9f5aae11a620191d5407f4453b161ac31f79f3a24be |
| SHA512 | 2780ac716bae3e3e3525bdff8d59c34656488649b2fdb88ed2c5d98fb6cdee90ff25d6d7608f25b496517971b5b9c8f80f6a97c5db3eedab574d7d945504812c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f0164e89152995206ee3a946e9ec7de2 |
| SHA1 | 1151efc78b5202d9b012e73aac6b59e1bf9d18de |
| SHA256 | bba3c789902ffab9393a25e5ca96c6d0b53b4181a433d17cd3acd52f13d7cc34 |
| SHA512 | 3b3fdaaf4da7af4ad5737ef892b6138ced033b173dc6c8aeda9d6894a178e623fec26f2fb414a966748b270017447450f1a79266a1f8117d33a14ee67e8bb8af |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | f03bb83cc57796b352f59fca74e3a7ab |
| SHA1 | 8c6e4d85a616951c0eba5d6d7c432588d5ca1a31 |
| SHA256 | 9b6fd378d94ab28e13779a57ad89dbe40c4fd699f861d6d3d70e103acc3f7402 |
| SHA512 | c7778c81fac52a30e9e980b0452e7dc7bf9392ede791304b7d4e0ea10995564549aa4536b796d5918694919c262754fe80679e4d68a317ca209a2d597cef949a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 2961739474832db11a44114addc9b77c |
| SHA1 | 68e532ee8862783c1de7d78429b30f5e4c870ff0 |
| SHA256 | f9a4288e93421bdcf6cf5e6a9b52b568da20d232a12f9f2feae01f29bfa367eb |
| SHA512 | 84eabe67691018dd1ed4e10f4126e45d9364b4984ced4b1964a78a4a92c4a828e187c644c549d0afb383bbb5e431f5625f467576ad3cd766c0e84f9385d05204 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | a08bfeacdaca269b5a0774567ac2ccb2 |
| SHA1 | d199a405f26ff60c264bc4894e529e793d1cbb86 |
| SHA256 | f1782698d999e51628d4859a13193b283538f794edb109cc3da54ab67e45edc4 |
| SHA512 | e66a9f400c922aa57808745284bfaaf079895159088d47c2130c0bdf64e4025d34b6c6999e6a0ba43846af6f0c512c577aff6ae3e61fae3e0cc6d53fe3008823 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 6635c4e5f0f0d5679c3767c185081806 |
| SHA1 | a424a4996551bbc102614c67eaa3c6c3d23b9d5e |
| SHA256 | fb605fa325c7cc2cbcf71906b73440952fc01e12ce05f32194558bbf35b2eda0 |
| SHA512 | 82563eb9b68b2bb0854690e27f7f3947b2165d6efd126b373ea9c8d3f890ccc822d6c5b0ca4743230f2dd01c069eae70b01c722252ce47599703e1686752df64 |