Analysis Overview
Threat Level: Known bad
The file https://www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/d5cab0d8.c97030bf0666bf0c93f09a29.workers.dev was found to be: Known bad.
Malicious Activity Summary
Detected potential entity reuse from brand MICROSOFT.
Browser Information Discovery
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-26 08:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-26 08:51
Reported
2024-11-26 08:54
Platform
win10v2004-20241007-en
Max time kernel
145s
Max time network
150s
Command Line
Signatures
Detected potential entity reuse from brand MICROSOFT.
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/d5cab0d8.c97030bf0666bf0c93f09a29.workers.dev
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d0cb46f8,0x7ff8d0cb4708,0x7ff8d0cb4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,546181462080472953,9254791125077264105,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6036 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.co.nz | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.16.217.172.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | d5cab0d8.c97030bf0666bf0c93f09a29.workers.dev | udp |
| US | 172.67.198.85:80 | d5cab0d8.c97030bf0666bf0c93f09a29.workers.dev | tcp |
| US | 8.8.8.8:53 | www.cloudflare.com | udp |
| US | 8.8.8.8:53 | 85.198.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 172.67.198.85:80 | d5cab0d8.c97030bf0666bf0c93f09a29.workers.dev | tcp |
| US | 8.8.8.8:53 | challenges.cloudflare.com | udp |
| US | 104.18.94.41:443 | challenges.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 41.94.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | separategradual.org | udp |
| US | 141.11.95.173:443 | separategradual.org | tcp |
| US | 8.8.8.8:53 | r10.i.lencr.org | udp |
| GB | 88.221.135.3:80 | r10.i.lencr.org | tcp |
| US | 8.8.8.8:53 | infrequentsuitable.org | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | 173.95.11.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.135.221.88.in-addr.arpa | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | udp |
| US | 8.8.8.8:53 | res.public.onecdn.static.microsoft | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | udp |
| US | 8.8.8.8:53 | m365cdn.nel.measure.office.net | udp |
| GB | 88.221.134.219:443 | m365cdn.nel.measure.office.net | tcp |
| US | 152.199.21.175:443 | res.public.onecdn.static.microsoft | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | 175.21.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 219.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | eu-office.events.data.microsoft.com | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| IE | 20.50.80.210:443 | eu-office.events.data.microsoft.com | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | 210.80.50.20.in-addr.arpa | udp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | aadcdn.msftauth.net | udp |
| US | 8.8.8.8:53 | aadcdn.msauth.net | udp |
| US | 152.199.21.175:443 | aadcdn.msftauth.net | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | csp.microsoft.com | udp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| US | 13.107.246.64:443 | csp.microsoft.com | tcp |
| US | 8.8.8.8:53 | 64.246.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | outlook.office365.com | udp |
| GB | 40.99.148.242:443 | outlook.office365.com | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | privacy.microsoft.com | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | r4.res.office365.com | udp |
| GB | 92.123.26.112:443 | r4.res.office365.com | tcp |
| US | 141.11.95.173:443 | infrequentsuitable.org | tcp |
| US | 8.8.8.8:53 | 242.148.99.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.26.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e443ee4336fcf13c698b8ab5f3c173d0 |
| SHA1 | 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a |
| SHA256 | 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b |
| SHA512 | cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd |
\??\pipe\LOCAL\crashpad_4420_FGMVEERWRADFDFGK
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 56a4f78e21616a6e19da57228569489b |
| SHA1 | 21bfabbfc294d5f2aa1da825c5590d760483bc76 |
| SHA256 | d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb |
| SHA512 | c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5d3ff191dbf6a57e5aaf150b8b95f53a |
| SHA1 | 19ab9bac7d4ac07f14978f884691d44b5fd90c8a |
| SHA256 | 33b1a20575f1ff89cc73dc90aa6982b5413140320aac1b05fc241b22896ace7a |
| SHA512 | 43e4cc35d57315ccb10c425635c5a457881f3def8b92ae6bf8d11ef36abaadeea2f14f3628b72aae42a8722bf0d082c4162904a96b0531287f9097f33307cdfe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
| MD5 | 2be38925751dc3580e84c3af3a87f98d |
| SHA1 | 8a390d24e6588bef5da1d3db713784c11ca58921 |
| SHA256 | 1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b |
| SHA512 | 1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 54951e2b6cb26683c35f3c956d7fe16b |
| SHA1 | 2d2588c7a67d5dd79375e22eb3f19320bf17239d |
| SHA256 | efdea0f0c3bc626a6921ab380f2779857566a8be2571df7804568c126920add2 |
| SHA512 | bd6aa3c003bd0a83147b8a405352335018b76b6eeef10adb42be9a44c7ee98bc42606647119d2380d12a5c300f5f62bf819aee0d5aecca8d7f41af8aa2cb85c9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | fbdd22e8d8f95d94234f6e1aadc4f5d2 |
| SHA1 | 660ac89d6e8743285b638b8eb71285ff2b690d7c |
| SHA256 | 812246f3bb870570e7fb3317f03c27ab7944efd2ba6dae6fc445d444f3d54920 |
| SHA512 | 620b0eea6ca014f57e49274033cd72f8e83d0e294e65270543b730a1e4d5074d968505d0c3af31777a32514f20fb8010fdf3bed75bc37abeb68e7c8d744ba379 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a958294e087d8ddc0b1cae800fcaf11e |
| SHA1 | 41f83bac8958156eb3c3a4753ff53be06ce35a2a |
| SHA256 | b24629f930bd472ceb4ebc02d05f45d56034723c62fcaa9b582a38edcbb49528 |
| SHA512 | f9bce584d2aaef8f2eae3e93a33aa200d1297eb69ad2fe3151320170aac1130c664cc3474e9f45e503a14a0fc2ca15607b5db3ab1be6d1f7304a7c854218a48a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | e99b0c5573e89e76eca739a8dafcd7c1 |
| SHA1 | f95805e8c7e1eb85baa9dd6e07a910b825b8feb6 |
| SHA256 | 4e4a5be78d584282be614070c6f1db0a1fb503aadb7952e744549278d7eb0172 |
| SHA512 | f679862dcc2db714ef6dc6d73ad27371a78b506fb7e957ff2a5537a774e60a7548f07d3ed2538763a2828fc8b97125960f8b709bc288931e38aee4e0e527a514 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815c5.TMP
| MD5 | 658b8f0c3a006935602dbee63b1c776f |
| SHA1 | 1421a2f7fab8dcbd2ee64d089a86503465f06668 |
| SHA256 | f4f47afbabe67f9e1b8710410a81c06dfe21971f59126d8bbed37558f05d5ba3 |
| SHA512 | b701528cda52178cf04944356576f280bc63c04934734d56d4ac1705b2ac243df26f849b0bc2165dde9ba8861957b88c6dc6bf7ff1ea54b8f112d1a29c5912b4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | a14275b127c4bb631b7adff58166ef20 |
| SHA1 | d27c872604702e73789dad6ab61883281c997e61 |
| SHA256 | ef888610e6e32ec3efd697b6c07eab4c4765cd6c1fd8d777a17577dc88cf1a56 |
| SHA512 | f5e531c454bcf3b662ebb95dd2c42016e7f28f7744374a94d9223a52c22527de59a4394d7e0b1677ce371bc053af95c9e5d70bac14e05c11cf132e7c629100e0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0b0159f34c54aeee420d0e8388af7ef3 |
| SHA1 | 524d5355a6c9310b31ce12851bdbba02b65182e6 |
| SHA256 | 7d5beefeb4d1b20b4dbfe2bfcc2031be842036e8b18212bc86fa971a2caf8fbc |
| SHA512 | 8b5f23ece3e855299383948503ab56537dc3d0772db7ca4c024aabd666b7152cd702b6cb74e3a7aca3ec7e4be414774ca26dfef11612f792ac4aa6495dc128fd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b32d7d8a84a1a24505e30a969ea31a75 |
| SHA1 | b36609f2f4ae4f9d09d8fa2b79bb6bd16dfe348e |
| SHA256 | 706414f433b541f47ec6ac82b3b37cc9201c53355af020cca9949b8272254203 |
| SHA512 | c6e846c4d2a26a7809adeef4dfbe301953975ddba59a8710d7b35d807d253b93ceef5c091d5fb635d655e54d2bb1c122566fdd791f7dd659bc5e68d8f7661ccb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | fab2efb5986fe88240a8e7d6aed89d9d |
| SHA1 | aadd2e4fed4fe94b7ca45a049eee5a9601096efc |
| SHA256 | 9341cf35083b130525a69fa9930ff52099152a4d2896adfa0e3d1fdbf6c61a71 |
| SHA512 | 6717638eed19317beea6af3c754a51aba29c05ec79b8ad6270ebbd225b26b48f2a1478929d6a9797acc32aa59e48896fc59807b7cee06f72afe298573cae3e9b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 748e7956fd15f9756d3b5e7e9640b378 |
| SHA1 | c0e99547d3a4dbfb053384c80ece6037f79ee6c5 |
| SHA256 | c338f0311e32323c09fa84ab3ae7b8b84271731a4fbcfb1fa77d887c56e61a4e |
| SHA512 | 3b7675e0454c6594a1306bb90641b37ee9cbc3426cfebf3c3e03092b2cfae420121dfd4a3023931af5e5b7c8ed3f9b75c69ea7ac510c7e16683a1ce2070f9928 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 9ac7f7a9211ae2b7ce5c28dec746124d |
| SHA1 | 2182c636e518e64f667c0f18d51b0a1e0df3fb4b |
| SHA256 | 92aeb08f659fe5064ada4cf225683c783c071c8651373d64d7f8f74440d42e74 |
| SHA512 | 0ad488daeb6f6393f2cb2a66b9994c0c16a73fd86c64ca553baf20b5fcbefcf609764c08fdab9e8bcb8a6540b3579b6669816da90193e170d9082a31fdb0fed8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | a025b6a2ba880898195fe0ea7b963b6a |
| SHA1 | 86dd231fb4ee9b9c359f2f5d17cb9da41bd52f26 |
| SHA256 | ad98bf153c0a7c89e0c01cd76f689b907d05caf75da7102ed031d6cc20dbbace |
| SHA512 | 337e40d50bc4b86d036272677d4a5f0f623e1e118bbfb00595582ad10389855ce4140bb8632e700a46442dd1a9ac59b7739bdeefe6152d869a77d4b3031d718b |