Malware Analysis Report

2025-03-14 21:49

Sample ID 250115-tqrztayrhk
Target Morocco.png
SHA256 9db4669f2ca05d569cb4f0ff68d3c6915aba00b9cbfb4efbc03e60b9681330ab
Tags
google discovery phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9db4669f2ca05d569cb4f0ff68d3c6915aba00b9cbfb4efbc03e60b9681330ab

Threat Level: Known bad

The file Morocco.png was found to be: Known bad.

Malicious Activity Summary

google discovery phishing

Detected google phishing page

A potential corporate email address has been identified in the URL: [email protected]

Legitimate hosting services abused for malware hosting/C2

Browser Information Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-15 16:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-15 16:16

Reported

2025-01-15 16:29

Platform

win11-20241007-en

Max time kernel

562s

Max time network

589s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Morocco.png

Signatures

Detected google phishing page

phishing google

A potential corporate email address has been identified in the URL: [email protected]

phishing

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6140 wrote to memory of 900 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 900 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 5440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 5440 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 6140 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Morocco.png

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xa0,0x104,0x108,0xe0,0x10c,0x7ff92d9d3cb8,0x7ff92d9d3cc8,0x7ff92d9d3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2652 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,3919703074048685698,428515653804201982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7140 /prefetch:2

Network

Country Destination Domain Proto
GB 95.101.143.178:443 r.bing.com tcp
N/A 224.0.0.251:5353 udp
GB 95.101.143.194:443 r.bing.com tcp
GB 95.101.143.194:443 r.bing.com tcp
GB 88.221.135.1:443 www.bing.com tcp
GB 88.221.135.1:443 www.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 40.126.32.68:443 login.microsoftonline.com tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.133:443 private-user-images.githubusercontent.com tcp
US 185.199.110.133:443 private-user-images.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 140.82.114.21:443 collector.github.com tcp
US 140.82.114.21:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
GB 88.221.135.17:443 th.bing.com tcp
GB 142.250.180.5:80 mail.google.com tcp
GB 142.250.180.5:80 mail.google.com tcp
GB 142.250.180.5:443 mail.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
NL 142.250.153.94:443 accounts.google.co.uk tcp
NL 142.250.153.94:443 accounts.google.co.uk tcp
GB 142.250.200.3:443 ssl.gstatic.com tcp
GB 142.250.200.3:443 ssl.gstatic.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.180.10:443 peoplestack-pa.clients6.google.com tcp
GB 142.250.178.14:443 ogs.google.com tcp
GB 142.250.200.42:443 waa-pa.clients6.google.com tcp
GB 142.250.180.10:443 peoplestack-pa.clients6.google.com udp
GB 142.250.200.42:443 waa-pa.clients6.google.com udp
GB 142.250.178.14:443 ogs.google.com udp
GB 172.217.169.42:443 appsgrowthpromo-pa.clients6.google.com tcp
GB 172.217.169.42:443 appsgrowthpromo-pa.clients6.google.com tcp
GB 216.58.201.106:443 addons-pa.clients6.google.com tcp
GB 172.217.169.42:443 appsgrowthpromo-pa.clients6.google.com udp
GB 216.58.201.106:443 addons-pa.clients6.google.com udp
GB 142.250.200.33:443 lh3.googleusercontent.com udp
GB 142.250.187.234:443 signaler-pa.clients6.google.com tcp
GB 142.250.187.234:443 signaler-pa.clients6.google.com udp
GB 142.250.178.14:443 ogs.google.com tcp
GB 142.250.187.234:443 signaler-pa.clients6.google.com udp
GB 172.217.16.229:443 mail-ads.google.com tcp
GB 172.217.16.229:443 mail-ads.google.com tcp
GB 142.250.187.238:443 clients6.google.com tcp
GB 142.250.180.10:443 peoplestack-pa.clients6.google.com udp
GB 142.250.187.238:443 clients6.google.com udp
GB 142.250.200.3:443 ssl.gstatic.com udp
GB 216.58.212.238:443 lh3.google.com tcp
GB 142.250.179.234:443 appswaldo-pa.clients6.google.com tcp
GB 142.250.179.234:443 appswaldo-pa.clients6.google.com udp
GB 2.18.190.212:443 aefd.nelreports.net tcp
GB 172.217.169.78:443 drive.google.com tcp
GB 172.217.169.78:443 drive.google.com udp
GB 2.18.190.203:443 aefd.nelreports.net udp
GB 95.101.143.219:443 www.bing.com tcp
GB 2.18.190.203:443 aefd.nelreports.net udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a28bb0d36049e72d00393056dce10a26
SHA1 c753387b64cc15c0efc80084da393acdb4fc01d0
SHA256 684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1
SHA512 20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

\??\pipe\LOCAL\crashpad_6140_YNODYCIKFHBBSICK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 554d6d27186fa7d6762d95dde7a17584
SHA1 93ea7b20b8fae384cf0be0d65e4295097112fdca
SHA256 2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb
SHA512 57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca33475fec83c3b42f5fd26933699ac4
SHA1 6c8bc39877f219b6541d43045df881a8f8697ab0
SHA256 2a4c4d0db1c7af430f8b147c35a1d22500c37c785663c925f79070bdcb3546ca
SHA512 cb82c35e3168fdecf781e7aea8ff17b0b50fc3426aff532bc1e423fd09b86cbb24395efa3c696588577ef8f3ec73b047d240af9d47c26e1b88ab10c471ff114a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a9a9caa0d0b7f1890223ed0fcfcd9048
SHA1 6756398777e44aaee66083b1010ac2559c600895
SHA256 8a5e36ca2a9bec182ca1fa777a0d40afac0161261046666f78fb89d3573c3a6b
SHA512 6ea926b79dfd43fe655283c28c507bccd2f436670379fd71d5a52d0bd8ae178531cd300f1d0e4de44393db1c783f956d81b75a8e801da7397bbb9769dd7c627a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 747bfefb7b702db12cfd188b4f59888e
SHA1 1a0f71e12a1ab5fbf7c88c6d4b165b539cab3976
SHA256 b1cedbf65aac5bfcb37372ab950ed1e2b9debd58b4eb9463bac35f775b09abde
SHA512 1fc0332f90d3467985c4aadbcf49598e901446e40e69561e479182bb741f0b6d678633429f33da48e7753777511fa371fc452ae701c3a5fb708a96491728310c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5859e3.TMP

MD5 f459c254cbf966a3fe27820e46f88b4e
SHA1 028acd0ee877d6c7bc6995ace3f9dc084e053e80
SHA256 843138cc347381796f18e267623149b1ce5beea12218bfd8a7806f43161bb221
SHA512 ca553b9a33475cc1fd26fe356779166a0013e382324cb6dcf9450cd3ee1d71597bf1f9a30defb8e89a78eb020dc03632675e5071efc5ce09ee0c8cc1b67b6b57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 12d0a50d552eda3beedb7d47c93c0688
SHA1 7ef45ce9dd741e0742d464da32999ccdc965edf0
SHA256 8e76286ede10de1a1b44e38b44b664529bcd20509a3fabbf96b04c1e0530c6f8
SHA512 d1b7d64c325d0ea3becde6df7eb2d30f3d842ea624193d957a620cc4fa4c37f0edbdd69a3e66e97823cd1ce6b5b6737084d3bc089f98a24f22152d1b4c676ca1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7576d816af461a5c59c004a88c0d76b9
SHA1 187deb1f067caf3bd8e1481d0147f4294f67e8ba
SHA256 8f7516af872f45ddc64606abc18d78f04e3e828dfe526ce6857ba10e76d85418
SHA512 76dce352f9ac3adcda863d838cba8229aae84069effd783a8ea1ec99b7d31c708942f855f2c2348fc487ef206279faba8e8d855491ad311ff1ee3687739266a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f282c7ae2f8d051d66535271c100f2a0
SHA1 98724273ee69dfabf5b4b190e23339383e3b62a1
SHA256 8577c27a1a808c3054d7b09e2355b99ae5e943ac86839396312ab2f890d12d97
SHA512 89f289aee2b6087e06945a21fe05194205a72443da603d0d95847058bcdbb538ddc1465ca9717a7174663ab071d584af7e5d25431c67a2658433af16068b4fff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 60c90271f5c834dc24b9e2a2d73fec88
SHA1 88cef77836df0057fd1dabaf14a63791353b08f4
SHA256 29c40326c2830051fa93d5616e27439ad45b522e1d0350b29757fd0daa43700e
SHA512 06270e06a1b4722661e0312ef714ea55554a8d13148b9101121c504f10b50992d1412196b5a252346fece9c84b712c7c654d79beb10687b3cf97e3724a5c8bea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 25115868a46517decdad51fa1ec54ebd
SHA1 cefcdc1946037e763ad878fe17e6bdc0348be291
SHA256 27ca2a8821023f51450ff64c4f08dcd1612b7557dda2d1582ff109e18be01bf1
SHA512 4a5e957743f85fa014112c2efc8d5c2611db7eedf2c87cb7c94f8c93ceca382aaf7d0f8b988ed3866e9e45bb7349d3053148cf35a4a81a039827403e2e9d6770

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 69df804d05f8b29a88278b7d582dd279
SHA1 d9560905612cf656d5dd0e741172fb4cd9c60688
SHA256 b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608
SHA512 0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a64ea2b17573782b8016731e4becb046
SHA1 27a524160d4241dcef1536143f2fc95731789bcc
SHA256 0eb0e907210d57eca35b55dea67b32b5c86126611d425bc83933ac4d96adb314
SHA512 8db42d043461f404837b627359aacbe551703545b49cffcf988c4931109aaf85da2b8c73076066a68ae275bc8b52ab029efff0cf8f081eb193663af59c845759

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 574a337401a2b592f336a747ab7e89f5
SHA1 e710eec85121743f87e5ce6fe97ac1c788ba0e36
SHA256 a9842202f6376e0d717fb2cd837a4bea6b22b5e9ab3511ff102a5cc08c3ba0ab
SHA512 26a48672e3fc149d0735f2369dbfebd59af404d79849d460d65eb4448b3251aacc1f86f051907270011412dce4a7c1c04d5b203004ec72c2dc96c6a600fe445c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b6c92adee62e8068a2c1d198ba04b965
SHA1 27fb78d02504c133058cb8887d7dc40532874e62
SHA256 142731ed20eedd28321efeed6ba4abf2a00de7ff48f1fe23210eebacfde660d5
SHA512 e3e4e0c7732f9d4b13307e2be3e86d4dac1b4cd3848972ffae02fadf902afd0e8c270564f54c43abfecdf4abf5c6669cf5a6b38b64afa975f5fa21bd02eea1c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9e231237ca965af730e149a1ac41e3a3
SHA1 021cf94a049abbb1d43e3eabb746d35b2d27ec5a
SHA256 5df0d8b19f71caeda56f894595e23c060042928cf52517cd42653e8b159d2576
SHA512 fd8966829d86e866f146c2c1405679952dbf466f532c947481fc01057e873c7968ab36f5977c834b0f7f4632fcb2ec26f038f09a241f355702a4b5bf16442ac3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 364d6cd8a80f74c47f480fc379f808ea
SHA1 6bba2343e241051c4887c03f66e7701259d0deea
SHA256 a208a686e78c4d59a861a5ba32a2323f5705b35a1f037880cb493ccef61ffde7
SHA512 84335cbf374790185ed2dc18a4969d5b8654b908cbab2782a79da1902bcb9fd5c9eb6ac6b5bbe178aeaf7337fc2d31cb9d82352a261a39931eeed7dc2ceac78f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9da5385eeeaa5298426f89bedee48256
SHA1 17266124b33f8cd5cefbbed3df888554bcdcf1c6
SHA256 c459e948edc2dd514089defdb49ca8407f3d07fdc63ad98d54434fec2714816e
SHA512 b17d417da83ea283413e615a934ea8211c2fe983d7ac104bd008e9aad4c31a8577018c9a8d3a5727c1385be7719acc6916ddb1ff65ac7a8ff869e2d3dae190be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 d6059b1d0989dfaaf40b026039061a65
SHA1 b867d42f4f8ec1b926b47f24233a61ea54865edc
SHA256 f4c48a119c6f259d03419c054a955db4e0230dda84abe7d5d5c841062eef4dee
SHA512 b22b550d66cfe53d8a5de6132e7c4b51d56dcbb3179954051b1b72e055b7a04e2ff7fc7b592969b083805cfe8bd53f1a130dee0d8b4f90f1b65a5518d17b59db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 15e74737a304a4f18784e1c13c890aeb
SHA1 615ef469424d02f4bf12187d3aa7ca57aeaacf61
SHA256 9cea0c69b32f5191781da33b135a26f161785b188d92f9677127a43a17b29ef3
SHA512 6ef90c211f1f7ebdd2ad1e1ce0edcdd5f70809bc6ef790ef8d2040b4731fecf03fcca3ecfa6afa2f102013dce3c1ec2dab10a0003beac89d732397232e9f885d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

MD5 4d8a9ea1680d3cef835ec72dce5116f7
SHA1 5412d9ba16eaf5396adf4e918d823fab303c5b76
SHA256 f18a288a9a92d1edf7344683217f53d9015d3b3c32c582261a8ee3f0448b4cb1
SHA512 d01298bc083029806b97af726512d2cf8b0b70748dc849b448afe46812f4c7772326e8535a4c6a576d5760d043b98e46492178df7d66dfdeafc2be3b9fdef8d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 2caa26c7980f597ce7fe2da3c1cc8b84
SHA1 b06a0e695d62c9f9e5c2d648a1b1b35df82cef9c
SHA256 b7ed0076e29e6c6f8a7fcd49ba43dfee9a20e7f2401aae67884f3c3e76f9f461
SHA512 023b81815fd6d62972a2713bf589fdde5258a972c281bf2b1500eb06e220f71f37c57c0c05a26b25025ca1eec18ac98e2615e85c2ee33c963b0755ee1558387b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\f78a7f58-a180-410a-b8fb-b45a5b568aa2\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 6d367048db99f92977d8dcc8107a9877
SHA1 0995521c58f526bf2a586cd7210dd2203a230db1
SHA256 17cedd4f428b4862008830157b5409381735e634c2c78ccc2aa1cdf6ab74323b
SHA512 316c87712560b1ad3aab1a9c3a22c9de9195290b1436f86ddde4264b07b5cd4c92ffe4ac36780fb9929667f1144579bc00fecd3206356130c9a2bcb545b6195a

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e4f12dcd2e1c45d4e842bd1c29fb6d6d
SHA1 a2a0b76bbd9eebe1bc6811ba34830fb74bcbe841
SHA256 fd6fa21f27261497c55e3a8275dab1ce8dff4bd69d737494de06644177e907dc
SHA512 064ff8f6df8faeac656b5fcfa4613ca45966313eadf852657bd64a40c359fd75fd7a27b8c95ad088b967bf1a2e7d13b2955b50b431a045f9378d1f35ad7b3a03

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\f78a7f58-a180-410a-b8fb-b45a5b568aa2\index-dir\the-real-index~RFe59e14e.TMP

MD5 b6759b67b81db36d9b32dc8bbc91e44b
SHA1 cc4a1106b4483d28dd89f608d41cd6623ed70319
SHA256 819c49fb25874b6fff9da81f6eb066dd0ea29c2d52c4f96b3fbb03c598f5374e
SHA512 7821bf1a19781aa874351a00cfc02a5b753d12db24ef49a66dc86650a33841c7da89b5d5b467d4bea767c1fef24a47557e2192b318fceee4cb40b3b3579fa5d7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\007739eb-41c4-415a-a6ad-f0357b01bffc\index-dir\the-real-index

MD5 b3461dc5a50151444087173062f12542
SHA1 66bf67a635c9aa2de48e43bec3303ed7becfb931
SHA256 b01de45249969ee7443e36955dbefbc456f470dc86a94cd326cca86cb0e7c1a5
SHA512 b83862861296b61d75a49f5ad4f479eee8330244a03654e08147943383d84f743ad70003a0acdea1c24feeb93b3a45be0c1e84f427c99afc45562064b2891089

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\f78a7f58-a180-410a-b8fb-b45a5b568aa2\index-dir\the-real-index

MD5 e607c0a10d6cb9877e0879184883cb66
SHA1 4aca6f0e3f442a3f992b6e3b86af12f4cba017fc
SHA256 7d4c9ea511d18ebfd9b35c0e8262b182c7eaf9a2d781e98af4c93da8743cb6f6
SHA512 600e430b0ca58cdb6bc3de9c826894dd428423bcb558c0dcd1c5b227b32fed5e101962d8d57e822947d4fb49e5677a01eb83549715df3843367994da3f6a911a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\007739eb-41c4-415a-a6ad-f0357b01bffc\index-dir\the-real-index~RFe59e14e.TMP

MD5 fb24763ac3047c320a0c3d79ed39b103
SHA1 dceec9f9e22261b4ec9b546e87155549d158b3cb
SHA256 fae52b0bc16044f642fb7f9f37cd77b09309b7855f4e010e4baf6423657ad7e9
SHA512 3105fb96095617ebaff048d62c55342cc40a5392c302ad0befdd749016014035c5a3bd385811ce381f4958c3c8877f5e90579ab070a707759996e74be8f3edef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\24681311-82a2-403f-a597-c7c79168c385\index-dir\the-real-index

MD5 1b85791798af7343df2fe7344d719309
SHA1 af3df2c1b549242a886cb06b446ebff0483cf710
SHA256 919433fea15971c13ccb621e429bb9adc57b28278c461b21006a4588e34e6fa6
SHA512 d405555304a90cbb38c7de045210dd7a52c177f18b54ec6df083dcb3ebc783abc49cf242382f4f721fd1524b76dbf209c531e839039d00aaf38e0c4e70449cfc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\24681311-82a2-403f-a597-c7c79168c385\index-dir\the-real-index~RFe59e14e.TMP

MD5 6845d8c6e7ed284be8dd98490643e0bd
SHA1 99862d2319baeddba7d1d78d079a6b0cdb3f5b22
SHA256 f0e1460afaa501849969c40edc3b5507cd2b2298933abbffe1d9a153bcf45459
SHA512 7a7edd42c42d292bcb71cd37b46c7ab3494d8a27da039de013933332a444b667692436d3114ff63abe3ee275749b0b81c6bb446f9322575e95541f1d300b0a1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\d2162fc4-ef00-4eab-a085-80828c077a21\index-dir\the-real-index

MD5 ceac0ea0948577e41554f3c2e10d78a5
SHA1 2c76efd348279d75eded27851f696df33fadb6cf
SHA256 cf8d5c3181011837adb9074740d5c5c075bdd5983005dd098c822cd619fd5d34
SHA512 a2ef8d8493ec4d471852ea8314e27d34b1bacd51394335e3095ad5aba58b003295199e5856dffd5bbaa505a26179415984f55fb3aa1b65be2eafac4398e94914

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\d2162fc4-ef00-4eab-a085-80828c077a21\index-dir\the-real-index~RFe59e14e.TMP

MD5 f64072e10b13bbc5d9aba4c60bb309a0
SHA1 7bcb74ae5a6a9318e55dd1e7a544c8c582b6c5f4
SHA256 b0ba3c644e65e5ea8eeac4705b8b6c1f33422d02d0d03f48d355e9381cd9b225
SHA512 8d55aaa0886379ce770eb4e5685b2788e854f3b582b8a62d7facfeca74ddf5991bf14d38b2c398ddc005098e463750e86decac31dda18654bc070183d38acdb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 22aefa1ee21c39145a71d47ccc608c28
SHA1 921fa6941e63cc9ba3f83f396f86495720e03fc7
SHA256 e277f5a90e6030a793fe5de6432105234aedc463bfb8db5ccd39e23310dd0342
SHA512 6f98a948962d11e8324a07496b2839a025ba51f201314ea8ad71ccb4bf301ba9e5ee9e733e331815af282f0d4bf9b86be7026fa8c197d039ba276c8d65ac5933

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fa25.TMP

MD5 65d72d6f05969cc254707a8606bc4024
SHA1 8d8365c0b1a708771dab627e2c0dc8a9f43d5b46
SHA256 43f4ea47f9403703da6f86c91016a2c3dc40dcf3c6b8db82994b1750e6bd0e17
SHA512 67588ac212eb122129ba852a28510867d257bb67ee7e4e2507cbd4f4cbac6e29ef4f0db7f8ef68c42c699cce5d95b1f480893c30dd3526968c27413833be72b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 a8d9ae07b19c89bb15982480f06c0be1
SHA1 5e479da62d8452af80b8e6c0e0de293ff8aaa081
SHA256 06726afcad826fa3eda90937eb6efb8c46fbd106f6d72269e359716b72370e54
SHA512 c88ffc4c7b4739bc008e366c6808a53f36cfdc079af61fbb6381cc5fc442895f21e7410d7a7560ff36b00b0b06b151d70b6e93a8667352ba14d976edac3c0691

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8e52a5378ea59e445ec6c2ddfef22df5
SHA1 ef0c732e37dfd8d907361394fe865eb3701ec8b0
SHA256 efeaf5ff85a138c48ecd306b58a134d804e68c8d494dd12721471684edf0350b
SHA512 e952c4622ac6d464f8f450c6c489253dfa3708905921d3c2735640c5001e1ecf0e9c1009b2c0a081d54d2a2454ccec78c8eedaf4c108f8699144a42733707427

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 739d07c2e8a5217e84c7e78d56a9343c
SHA1 6825e0863e0d0a41a7bbdb2dfbd06573a5c2137d
SHA256 73e82e81eadd9b312360f01a87c1c25603af4b1d7d898b3a4b76c0ef3514c52d
SHA512 22a13b81e631a3285c15fd5c5db1ed0294d3eddbb46c9644591a04f187fc962d3371bfba942c4c86468876b62078afcbb8fe3965837b17931c120eb54410eb13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 8968f37067864e1b3e6816f03fc5d740
SHA1 68d0a6b1cf645dcc42ab23db53c5a1e47e06a89a
SHA256 71db665f83d87a8fb6704120d98e4f109258d71f77fa940c990b9ef4b532203a
SHA512 b3d06ffb6c8a304c1de92c81f0ffd96401885436e2f6006cddec8885a303f70eee3626aaacca4aadd324a000f251c68123737a549484c79d4c6cd17b372b7ffa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 38bd2a66a9104958eeab03eab2c0ac86
SHA1 fcf0c49e783f2c5257dcf352c20913347eddc638
SHA256 dfceeb334462adda558644e358f4154fc3aec00f94d41c1ebb01c170d9055d6d
SHA512 adc42989e796a566b52280e7b712582164cbe1f95c92e471203cd0e2d5a35da582f3c960513e199eab8766f71f80503a96f1ea4146d351a1dfbee298920c0476

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 69e6ce6b8b15da54451497dcc0acdf66
SHA1 03219b0ca6bdc563b798b3813e77869b6c340922
SHA256 098059b6a76e8b34038f19cd3442654d177ca1bcd79088dc3139ef9df67c7782
SHA512 e86156c1243efbacfd4f5e047c6e4e9a228099f7d3dfc60e7538d407795b79f4c9d4db4f184abc64eb8ec0b1207df89f8841c6a4b797918f900fd39d79dc4324

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0ae605425a25283852578c0eaaec7f46
SHA1 1909cb03dad1b097352590aab801fd94e6411e8c
SHA256 d988cdc3360ea55427265da09c06dc2761fdc6310a95c2f52a5c1a28a035e6a5
SHA512 258775910d47ffa1be678c8ff67d63c9a2b72f575c0b94dcaf0aad8ec1e538d4a09b89fe17aad025d4c657b9395e9ea085ba0e7678bf30f1e893145e7b7a9c10