Analysis Overview
SHA256
a12e0ac33a927dc5d7596c903a21672a7fb1c1d5d1602f4523b561277305a876
Threat Level: Shows suspicious behavior
The file sample was found to be: Shows suspicious behavior.
Malicious Activity Summary
Legitimate hosting services abused for malware hosting/C2
Detected potential entity reuse from brand STEAM.
Browser Information Discovery
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-05 08:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-05 08:01
Reported
2024-11-05 08:32
Platform
win11-20241007-en
Max time kernel
1768s
Max time network
1685s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Detected potential entity reuse from brand STEAM.
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc19bb3cb8,0x7ffc19bb3cc8,0x7ffc19bb3cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12247679716518865070,8370363944938732679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3060 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 8.8.8.8:53 | cdn.localizeapi.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | cdn.prod.website-files.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 172.67.41.53:443 | cdn.localizeapi.com | tcp |
| US | 104.18.160.117:443 | cdn.prod.website-files.com | tcp |
| US | 162.159.137.232:443 | discord.com | tcp |
| US | 162.159.137.232:445 | discord.com | tcp |
| GB | 142.250.187.234:443 | ajax.googleapis.com | tcp |
| IE | 3.162.143.165:443 | d3e54v103j8qbb.cloudfront.net | tcp |
| US | 8.8.8.8:53 | 232.137.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.187.250.142.in-addr.arpa | udp |
| GB | 142.250.178.10:80 | fonts.googleapis.com | tcp |
| US | 104.18.160.117:443 | cdn.prod.website-files.com | tcp |
| US | 162.159.128.233:445 | discord.com | tcp |
| US | 162.159.137.232:443 | discord.com | udp |
| US | 162.159.136.232:445 | discord.com | tcp |
| US | 162.159.128.233:443 | discord.com | udp |
| US | 162.159.135.232:445 | discord.com | tcp |
| US | 162.159.136.232:443 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | udp |
| US | 162.159.138.232:445 | discord.com | tcp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| US | 162.159.138.232:443 | discord.com | udp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| GB | 142.250.200.35:80 | fonts.gstatic.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 92.123.128.140:443 | www.bing.com | tcp |
| GB | 92.123.128.146:443 | th.bing.com | tcp |
| GB | 92.123.128.136:443 | www.bing.com | tcp |
| GB | 92.123.128.136:443 | www.bing.com | tcp |
| GB | 92.123.128.146:443 | th.bing.com | tcp |
| IE | 20.190.159.64:443 | login.microsoftonline.com | tcp |
| US | 13.107.5.80:443 | services.bingapis.com | tcp |
| GB | 2.17.5.46:443 | store.steampowered.com | tcp |
| GB | 2.17.5.46:443 | store.steampowered.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | shared.cloudflare.steamstatic.com | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 46e6ad711a84b5dc7b30b75297d64875 |
| SHA1 | 8ca343bfab1e2c04e67b9b16b8e06ba463b4f485 |
| SHA256 | 77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f |
| SHA512 | 8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | fdee96b970080ef7f5bfa5964075575e |
| SHA1 | 2c821998dc2674d291bfa83a4df46814f0c29ab4 |
| SHA256 | a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0 |
| SHA512 | 20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff |
\??\pipe\LOCAL\crashpad_2312_YMEPWRJANUTXQDAK
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | edeaad218a73ba01fe166481438859ae |
| SHA1 | 7e7d1b44a776148f516900360d678eddc02ebc9d |
| SHA256 | 26411333b62bca6c46dc9e846bebd6bb9c09b7cdb6377ff6306c8d603d2d4ceb |
| SHA512 | 8cda5f08fdee217eefc77b3d96edc2a74b3e4af5cbeb8c4038a12f5d453ad5fc8a0c654f781f73580ecd4acb8fe71110ac50501b62d04df4521827705e5a0342 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 0034dc0ee88e9387aac59107e99bc504 |
| SHA1 | 1bae825ba9de9192cc010a12c5d499659901a0c5 |
| SHA256 | a53b22c62459cb905f0853005d1a2266ea053b815d0ca87ce8bc4d01e48c1f87 |
| SHA512 | c2b9f94708a0d7910a10c94a8ad7e135c78f7cc39120811c5efe05fb333b785f6cc4c9e31dcdbb7bd18e088cc1e1e49b5ff7a439d2377bbdd6f9476343700eaf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | df5f76bbf2877163d7bf7cbf609897a1 |
| SHA1 | 2f49ddbf73cf354dc5d52787711fb86cb6fdb4b4 |
| SHA256 | e199430431f3e7b46ba42de2a949e2d8e4dabb30f4acc3b69c142a45004ecb26 |
| SHA512 | 7e1c8bb84f50ce68e80b9bb2f35426dc5596f67ad76bd875de8fb1c870456f8b9a893e7a1fcce29bb9c72fb25dfe4a44e0696b2a651d8e26ddc24a65d16d2c6c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 95eb39df4131efefc955f8603ed0d0c0 |
| SHA1 | 1e8e1101c4ecefb20788cf0edd1dd290eee1f6db |
| SHA256 | 42fb1d05c918c5a9a0731a30822575fffd20b22c2ab5df919b6a8c0c11f20307 |
| SHA512 | 8b86204d0feb3230c0fb8267cb7695e51e57f32a5ad9d8560ea7a3eb070917fc53839e18e2fad93c5947827284ef12d3b2b953b8fd81e40edc36ce90cf387e6d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 58a3743ef4f99ac2dc3ef1d1fdbdce41 |
| SHA1 | 5d2492ab4ec621ae55a84ff4b43abc32eb75c0c4 |
| SHA256 | 9be57abfe6ea002c3dad066688c6966fa19ba6e9463ac787e8562a3440aefb5a |
| SHA512 | 77099a00d0a6569c35878a08537389ac64d4e76a8b79821eb1e8315155d1eaaa13dfe369bc5be0d09bc525f662abb2e414d8ec745d0f5cb4e13fe0136bf50178 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 251434403c8a192ef3b9d84c88e18e8b |
| SHA1 | 273fbac777a970691a0c378b7a625c318cf8f851 |
| SHA256 | 76afd994602d8119f34d5c1c9ab7eef4760b8c45ae411b41932e4e901b9115f7 |
| SHA512 | fd214cc0fc25d85ab4e35c6da78a0219f45fd4515e0f8f91c51e9467c881444eaccbf5fc268a796794a14c887f594df5c3dcc0a9b3836d0d6bf7e14a42691909 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e908.TMP
| MD5 | 869dc10d84b71bd041f6fe96e67f4ce7 |
| SHA1 | 9518387f791d0d21ae0715c10e5445ee814166ec |
| SHA256 | c21efc1da7adec99658df7b2f3c62bb6d8b50a6104d05cdd1d9a9e4e9d8d37bc |
| SHA512 | b8bff7d2ac5218c8f1c309a18723648cecd01735de2d6af7c0133246f248e787fafef6e6f4831f676acbdef4fd6069a1d22c077c2a140e25e71cffafd57e7764 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 8e4e615ab28597d96596ba335986e17f |
| SHA1 | 9129075928d1f40b7ffda795ae11927aa4fee6d7 |
| SHA256 | 2769b9c63007e27095f7163b10a3966fa41e10290b13907a3942bdf3249bb709 |
| SHA512 | 710c78eb09d960f4bd1d5e39eeb98ee96a919d0b262c4ce0be3cb6daa78a729ee186a550606cadc7cc34bf20fe862d642034022d4e8e17de90ecf3bc675feb30 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 7213c6f83d0cdb5050383a55e3d8c3f2 |
| SHA1 | 6b67782a884cd0439820323023c6334979c00471 |
| SHA256 | 06d9bb9440811c54312520f855105955f38567443eb7b683a4a2547ecf27bf91 |
| SHA512 | cee6cd721565787abd2489f8bb2fefd3e2449a42458be1aa8b43f963cc35976b812e05b588a82e09edcf39b5deba8c93ee8d0386ebd35de31705f11da3ffa017 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30185977-fed1-46ca-924b-1242596e45b2.tmp
| MD5 | 8c6d2871923a6a8196c3ec8cce00667a |
| SHA1 | be40ed75c796b894b52a2ce8cbb2f0db6244cdb7 |
| SHA256 | abb4474c25404727a18fd468efd0dbf82303bf1ae2208e5164385025a8ac4098 |
| SHA512 | 40c6dd76d50f1f27bbf8e51a9d38f750a85439ac251dc792be341abec849567683a2a38c3451255915968fc8fbcb0bedc6a2c4e355030e5cc8dba87429cd57d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 067cd05048429ee523668d696b1269dc |
| SHA1 | 917cf371676f14ce0e547f72766fd4b6b9c68dc5 |
| SHA256 | 91e440b0b98002400a173c7b58de0745d67aea72954dfdcecbcdd0c19e0bc107 |
| SHA512 | 7fbef4615dd111c6ba85de5bc02260f9f5855421768f84788418f56ac1acf42b51d1c7fb5c4665bf5a4a7f964a08107fb5305af3c669b625383900e7cbcdfff7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | a0522fe0178bfb3359bbc493fb5e0df7 |
| SHA1 | 06a09735b1fecc07214c61e305b02091aa4e6f58 |
| SHA256 | 2c711d9974cb19a0dc00c72e81b65e0ae45da44b71acb49c1ad660c6f8a13363 |
| SHA512 | a1e2fc20cdb2ca7bea00e28daf40514a99c0d1629872ed806672449fbb339accd1f66e7011b9342ec76f0fc2461d1e75652350a167e1b3d01190bcaa18499562 |