Malware Analysis Report

2025-03-14 21:47

Sample ID 250205-q93nwayqax
Target Kami Export - Aden Armour - Chapter 9 Section 2 Section Quiz.pdf
SHA256 504c29b7ebf5856ca42969fa272f02d16415ce18743da63cbaee3ce110ba794e
Tags
google discovery phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

504c29b7ebf5856ca42969fa272f02d16415ce18743da63cbaee3ce110ba794e

Threat Level: Known bad

The file Kami Export - Aden Armour - Chapter 9 Section 2 Section Quiz.pdf was found to be: Known bad.

Malicious Activity Summary

google discovery phishing

Detected google phishing page

A potential corporate email address has been identified in the URL: [email protected]

System Location Discovery: System Language Discovery

Browser Information Discovery

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-05 13:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-05 13:58

Reported

2025-02-05 14:13

Platform

win11-20241007-en

Max time kernel

887s

Max time network

893s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kami Export - Aden Armour - Chapter 9 Section 2 Section Quiz.pdf"

Signatures

Detected google phishing page

phishing google
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

A potential corporate email address has been identified in the URL: [email protected]

phishing

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3492 wrote to memory of 3828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 4624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 4624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 3720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kami Export - Aden Armour - Chapter 9 Section 2 Section Quiz.pdf"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffefa3b3cb8,0x7ffefa3b3cc8,0x7ffefa3b3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5048 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,8972329797577513782,875174300771495817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4824 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
GB 88.221.135.26:443 www.bing.com tcp
GB 88.221.135.26:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
GB 88.221.135.1:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.1:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
GB 88.221.135.16:443 th.bing.com tcp
DE 142.250.185.165:443 mail.google.com tcp
DE 142.250.185.165:443 mail.google.com tcp
BE 64.233.184.84:443 accounts.google.com tcp
BE 64.233.184.84:443 accounts.google.com udp
US 8.8.8.8:53 195.185.250.142.in-addr.arpa udp
DE 142.250.185.142:443 play.google.com tcp
DE 142.250.185.142:443 play.google.com tcp
DE 142.250.185.196:443 www.google.com tcp
DE 142.250.185.142:443 play.google.com udp
DE 142.250.185.142:443 play.google.com udp
BE 173.194.76.94:443 accounts.google.co.uk tcp
DE 142.250.186.163:443 ssl.gstatic.com tcp
DE 142.250.186.163:443 ssl.gstatic.com udp
US 216.58.206.46:443 lh3.google.com tcp
DE 142.250.185.196:443 www.google.com udp
DE 142.250.186.97:443 lh3.googleusercontent.com tcp
DE 142.250.186.46:443 ogs.google.com tcp
DE 142.250.186.138:443 ogads-pa.clients6.google.com tcp
DE 142.250.185.202:443 peoplestackwebexperiments-pa.clients6.google.com tcp
DE 142.250.186.46:443 ogs.google.com tcp
DE 142.250.186.138:443 ogads-pa.clients6.google.com udp
DE 142.250.185.202:443 peoplestackwebexperiments-pa.clients6.google.com udp
DE 142.250.186.46:443 ogs.google.com udp
DE 142.250.185.202:443 peoplestackwebexperiments-pa.clients6.google.com udp
DE 172.217.18.106:443 appsgrowthpromo-pa.clients6.google.com tcp
DE 172.217.18.106:443 appsgrowthpromo-pa.clients6.google.com tcp
DE 172.217.18.106:443 appsgrowthpromo-pa.clients6.google.com udp
DE 142.250.186.65:443 ci3.googleusercontent.com udp
US 142.250.186.106:443 addons-pa.clients6.google.com tcp
US 142.250.186.106:443 addons-pa.clients6.google.com udp
US 142.250.186.106:443 addons-pa.clients6.google.com tcp
DE 142.250.185.106:443 peoplestack-pa.clients6.google.com tcp
DE 142.250.185.106:443 peoplestack-pa.clients6.google.com tcp
DE 142.250.185.106:443 peoplestack-pa.clients6.google.com udp
DE 142.250.186.97:443 lh3.googleusercontent.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com tcp
DE 172.217.16.197:443 mail-ads.google.com tcp
DE 172.217.16.197:443 mail-ads.google.com tcp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
GB 13.224.132.84:443 applicant.jobappnetwork.com tcp
US 104.18.26.50:443 cdn.mouseflow.com tcp
US 52.36.164.62:443 prod-applicant-bff-external-api.jobappnetwork.com tcp
GB 18.245.162.9:443 images.jobappnetwork.com tcp
GB 18.245.162.9:443 images.jobappnetwork.com tcp
GB 13.224.132.84:443 applicant.jobappnetwork.com tcp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.185.106:443 peoplestack-pa.clients6.google.com udp
DE 142.250.185.138:443 subscriptionsfirstparty-pa.clients6.google.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
DE 142.250.186.46:443 ogs.google.com udp
GB 52.84.90.74:443 prod-apply-assets.jobappnetwork.com tcp
US 8.8.8.8:53 cdn01.boxcdn.net udp
US 8.8.8.8:53 ssl.google-analytics.com udp
US 104.26.9.123:443 cdn.datatables.net tcp
GB 162.125.64.18:443 www.dropbox.com tcp
NL 51.105.104.217:443 js.live.net tcp
US 104.16.145.15:443 cdn01.boxcdn.net tcp
DE 142.250.186.46:443 ogs.google.com tcp
US 216.58.206.72:443 ssl.google-analytics.com tcp
US 216.58.206.72:443 ssl.google-analytics.com udp
GB 162.125.64.18:443 www.dropbox.com tcp
US 104.16.145.15:443 cdn01.boxcdn.net tcp
US 104.26.9.123:443 cdn.datatables.net tcp
US 8.8.8.8:53 15.145.16.104.in-addr.arpa udp
US 54.148.5.95:443 cf-apply.jobappnetwork.com tcp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
DE 142.250.185.142:443 play.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.186.170:443 taskassist-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.185.142:443 play.google.com udp
DE 172.217.18.10:443 waa-pa.clients6.google.com udp
DE 142.250.184.234:443 signaler-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.184.234:443 signaler-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.184.234:443 signaler-pa.clients6.google.com udp
DE 142.250.184.234:443 signaler-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.184.234:443 signaler-pa.clients6.google.com udp
DE 142.250.185.165:443 mail.google.com tcp
US 8.8.8.8:53 play.google.com udp
DE 142.250.185.170:443 waa-pa.clients6.google.com udp
DE 142.250.185.142:443 play.google.com udp
US 8.8.8.8:53 170.185.250.142.in-addr.arpa udp
BE 64.233.184.84:443 accounts.google.com udp
US 8.8.8.8:53 signaler-pa.clients6.google.com udp
DE 172.217.23.106:443 signaler-pa.clients6.google.com udp
US 8.8.8.8:53 106.23.217.172.in-addr.arpa udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 142.250.185.142:443 play.google.com udp
DE 172.217.23.106:443 signaler-pa.clients6.google.com udp
DE 172.217.23.106:443 signaler-pa.clients6.google.com udp
DE 142.250.186.163:443 ssl.gstatic.com udp
DE 172.217.23.106:443 signaler-pa.clients6.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 02a4b762e84a74f9ee8a7d8ddd34fedb
SHA1 4a870e3bd7fd56235062789d780610f95e3b8785
SHA256 366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da
SHA512 19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

\??\pipe\LOCAL\crashpad_3492_WJXLHIYVGCPQOYCT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 826c7cac03e3ae47bfe2a7e50281605e
SHA1 100fbea3e078edec43db48c3312fbbf83f11fca0
SHA256 239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab
SHA512 a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ec3a0c8e02a2df044850e183804126ac
SHA1 5138fcf6e1b6b08977e8723d79cc8ebc3750f8c9
SHA256 dc83210ff5fb3af33ac8f77e85d0ee95d57053a49fb54bd4f16d9f720810bf18
SHA512 433f31c83272c85abddc6567d85eeab9c96ea591067aa5ea31c8ccee47ad08f92921c855f128377bf70c4ca78e5d872dd2eafeddf6898db799a0ecdf64d8ee0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9431b6eaaf9a87c8643d95d46827f0f1
SHA1 50c3b93937f058b97d5431d20757c6e09e9d80f6
SHA256 b00ebebbacc1f26ed36ee116f5a434964a5d0b98338f51eeaa99ba604a9e8af6
SHA512 aabcdab2465d36cc2ba8cc8428c5ac7bf7d0a5c6e0acee09ad3311f814834b4f9f54cc5ed4610de3525b2bef8a8c2955f133ab6458c1ea79f5ec5a0e56fe0f8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 90c947c5b3d63012495553d490edce14
SHA1 6eb96ab73f452a817ff236a014e838eb73bf2256
SHA256 70fd5602fdf270188746634b5f6a2fda96db95bb8c6a5eeeef364390d03f843d
SHA512 4d6a15e9f3d97ddb9ea6db9d3821034a8741b6f7212710e6d135cd35c059914423eceeb56db959195f24ac435245065f5a318a903d61d099b9035191bf89ea00

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dc0a9d4acb1b7ef50dec519758fa333a
SHA1 c69d9cff30605885c2a870f8ad3603addfd60d09
SHA256 17e639809f85b173d6a2d7edffead1b7dfb961ea8f773deaacbc7329d6df2d75
SHA512 5e0281ecfe80cd9e5bbde4744f23e645fba624be045f7a3c276e74fff9b83e9b9b13160ac50f81589df1473cc35accc32f45369ff9d6fc390e943faaf02fe11c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 43bbc1a45c36b395d9399642eb7c0ebb
SHA1 d62dfb6674febf79e42b71e3060c676be1436671
SHA256 82bc1ec9f3299845ae2e4142eb5ba2d85669d829781a7513187adb6558efb190
SHA512 f14596bfc92b266e764b4700c3a13f27ba41938c01aca395d957b019fa480afd1f7221ca859255300052a89403ae8e501c8a5669d387bbba513f357c17143fc8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e7fe.TMP

MD5 3fa23f017f5b351070aac15cbb12525c
SHA1 3fe5cc3b456bcb8654e1845d9d76dd7983433762
SHA256 ba718209ba89bb75b496467069fe9c5ed4c0c144a46435658c6c9a2dc2a45afe
SHA512 6d56dec9a2ab953b377ab09afcf43e553548f4462d5922d0efd5d61814d651463eb354fb70049d5e13b90591d0a6b7efbc5d1c60851eabe47994124ee3034790

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d431000a65f83bc0bd942a6995e68606
SHA1 50c6f243fdfa8390522f884287bfe0a8084e581c
SHA256 c4a678a7012f5388e1903e8ece6b37745fb226d6842a3b2a604c3f3737ce550a
SHA512 cba67222838277a26b54dfdf4c00071d61788769d233ecaeefac7ec9683469ce19cf4ad1f637ba4f1ec4c949f6923916e4e10f6c3508ea4734f51809de022fe9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

MD5 3ec72c6b8c76b88d39126113192e8a18
SHA1 7eccdefb941421b45fdc42342d865c47f6b75353
SHA256 7fdcbd5f815aae607771c110ece7e00adcb8851e115bb4af202632eea2406f2c
SHA512 864cf726d05c5231e4f0c5cadb485750222aceeea44457763963010d4e3c4154ce2a54a7cc4f36090e0dc375ab10d24081d1bf154fd9650add9586e8d66c56a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 aea1919c07d9c5ffc4ace4f4c0d11175
SHA1 4fb5dcff3ee91bf8648634bcf7f22b94b51ff8b7
SHA256 fcc9e6e738dff7918be124b5d616830a50d9d74e62933c0602a8d23d7fab860e
SHA512 60ca76e37da46952247960830dfa9ea6794d8ba5da0dde8105f780638bab5c89bd6c51392083a340b5d3c858c6745e70de22f9087a8529ea2d2bec4d0efc928d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ee7efda17145d951271b3937b9f306b5
SHA1 1e3c414061c1f551d7e05323163fd7cdc979709f
SHA256 05f1311d22c67f72f064b707744f7ee0332bca3673571f490ebcd631e6b706c7
SHA512 d956016e065aee309d304c1529dcc3807ec0ff00a2aed489566a86dc36a7ad2e00f8803c24194d14cae984030af2e35562987e5014f3751b61a770b32a66af90

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 bac8e87937979311df90f78d63c60319
SHA1 d750530709e5a61d5e8f97ca48c275e7bbd30bfc
SHA256 1323b6ad1fea1799080a6cf088f06b1d56d2425b9c3e43df8816d3fb2c69e097
SHA512 e55fb5c97c3b5f662becf4cb87ee2ac01b0567fcd6f50d3841997632d9c2e9b0463883489fe2efb5a2c07f9f4aa191ad970ff7ad2bafb1d6725745b3aa65ed38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 d798530f636acd792442e267cec192fe
SHA1 cac25197cfaf77c1cbd1c26300faf1b2a6d6be26
SHA256 a0035c3a4f3084ccd94743058df24edcf4712c0bd70ddc5276add4845f000dc7
SHA512 7d9516e5a0a7d8ab52f4bc95c82c77bb2e2d1baf8b5a054caed8588b236e0d344a6c442e519e6b1073aef2fb7a778abe60ad0f9478086c9a9f37fe87e950a347

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

MD5 525a06ac49e4041cf9737235bd09c437
SHA1 902b08c10dc44298f4d599e0b60bef61eb67bffc
SHA256 5b142c4aadbdcdf7341b072ca43bcde7c7f79260cfe89cde4babb44315371581
SHA512 5e2aad6912a60673be831f8e203542b8ca41c17b63927ec7535062af6bd325c18f45e60bbc781df0fed85faddd3a425b261d4b90aa7141b0e099f3d184c2257e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 b4e43ce93865baa96fef5b0a42993c57
SHA1 9c7d5ccde4504435c2d9c1248a7bb235fa07d08c
SHA256 8e72b31e854e7c4e4b0189557cade439cdf07c269e08a5e0e09fc1eb325f5df3
SHA512 ed4dd56cb4d3cbaa7678cdfcfb7c193288105a756bb33ee2dc5afa17af1a5dbfdbbaef16e54098d2ba69629fbc7efe5a682fd7780cc27609f8868355dc6822e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\a78b1c1c-64d9-4cad-8898-d7dc458dcd99\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 e65a03d871d494ec62063c2d05562744
SHA1 0870863aec430dbc8a705e0a46d24ea79389e579
SHA256 a4f8047864de7444400921f2ceb1c7dd7411ed82f87fa68760742c7d5a88b486
SHA512 a6612d39024c454f5ee5b516219b1e328c9a746701543515eda225deea156c67b159072ec151ba7b863eaf8466ab36123f0184f815a98f09a1d90ad8e4b4c5db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e9b04c17d77e3a53acdbd9bb3e703494
SHA1 06cbe1a6ff49dd3c27823ee3aa3516524547c799
SHA256 716e9b8a3db37319c251b9f6a00e900f6bdc3e539694b5ea4c9048152015e99c
SHA512 b18ed0d1e9d8bb4611517b3a8596b8df6e1f0450d5138b174ef7d5813b701b3cb61171728cb4661452e2adcbd60c0ee16d19075965125f5de976b800a98d5fe6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c3622e44e8bbb8a200d84c89b8fdf094
SHA1 342143f827dedb8ff15657530849dfe0496a909d
SHA256 895a30fe1f8d320ac3666d983b624b58e8774c2271e922db5b24fe958f917258
SHA512 b9d577727a8beac911c77225cdaa5f7c29a97981d6d4eb66cafa2223335942a721899bf3a148ce31f0079c1567837df5797732c7db8f7fb452cf503ae2927678

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 634ba3cf00d6f4d36b4f41bb4ff60d55
SHA1 109da3e872699a9beb37b256b0d8e86182f3bd3f
SHA256 6eeac0596b6a00c5ca846cd63ef151736153fbb75732c2914340991315152fa4
SHA512 d31c6425a727ba64e87e9bb80436364d6ffbe035e5f740377f6cd4b8413b40145861885d38c24af3fcf4f65ad53306f02f7166c3eab85fa6fdfd7d2b7885d872

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 50bcaf0e5bca83f037e30721d1d7b634
SHA1 451eff90bf57e7062d716505248b97afe8aec48f
SHA256 7d66df341a7899fec114a8205259ae5da7ff9f9feb3a1f80e82ac40c5b32bd74
SHA512 725a3ae7d851c6dd1fe982c2bc138c0fc9790b59e45c9004486c85a812c7260bacbd6f25d905ba3f08583fb30394d10c194fbbdd1ab798b5c5523a3d0bc6f74d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 d1875c422c62f18d536e87174639401e
SHA1 958330e041c96143b644a2ff9326092af1bf9a73
SHA256 7d46952a3769cbfc98a20507328b91dd6f12bf54a26d3f248296089407364c5c
SHA512 02020efd6e1e079ce60db3c3d276ac5f07c64cb6d44ce974a598917f02d8b548a7d16eab14c8599bd8933aba30e0c8ae25b27d30a353c5df2f959fad345322c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a582.TMP

MD5 97ed43de56d604041924c0345322f973
SHA1 6650f39c135f39b810dcb27d305e823cc3f0f8d1
SHA256 3b7e000b87f751b6ae662dce4f154b69f053cf7bae992b81442b2cd7f08c47ab
SHA512 b3cf9da569c002116e50dd7ced12c1e2a623c7ce303f7b22e9fadd3a7942187e8e794b72b8d110d315d6a1ea5507e030fac29c8693ef9accb0445e431845ed98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\f37a692b-bfc6-4840-ac0d-8e776e8399f1\index-dir\the-real-index

MD5 c701e4cdcfa5e809e5027ba344446444
SHA1 67e7f0b2908ddbb529a896a78871a49002354d9a
SHA256 1ab0a3b74b7db295edc2a9c52745dc53cb531e4af46f48c0778c2f4d295bc291
SHA512 b5f3c1e267e4f337f44c23637835508dc4ba31038d3a0c42497bed9a60c298cd1b4a79dc80a7af76caa17f78fd296e65687e9b8c273f1cc8479de7f6cd1d9901

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\f37a692b-bfc6-4840-ac0d-8e776e8399f1\index-dir\the-real-index

MD5 e7059762a61a3fd202fc2d89a5973230
SHA1 6af30c5f1fbe03a8325c70476c2b90596051e52b
SHA256 f717e272f050c5e184390a638dc8b68480c9557eb6f9cdc9de4f3408b92eda73
SHA512 025d5e8b361b10a0712df7bdcd4904fffcd56164d9c381f651844dfd011883ebf0784789c5e57192dc26ac10d66552d48a48de083929c6bff8372cbed7e991cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\9e07c8be-1395-40d4-9fa2-fdbd8bd66cf1\index-dir\the-real-index

MD5 37f82fcc64c449c0fee77d7e1b0060b6
SHA1 aeeb3adfe8d255f648ed30164d1932cc20cf1bde
SHA256 cd338f0d6f6c112afd4ab311bc027c5bc352fd1feb58fb5a40ac8a18a15b5549
SHA512 7357694036ae243617b79226138614cf52273e366ae21bce6f3154f59b74062ef951dd311b3025b88237051d5e60d82ae79c79756f42e6867f81706636e68bba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\9e07c8be-1395-40d4-9fa2-fdbd8bd66cf1\index-dir\the-real-index~RFe58aa16.TMP

MD5 956da377042fedf0ccf684069db172b6
SHA1 951287e2f776d44d6cf4be405b631de4d74f0488
SHA256 c0dad5ef95a390c5049f19f96c964468eb1dceff904b018e84991476c1b71671
SHA512 2063a2cded8801c0bf5fe3ba5e994ef683a44ace9528293a2df1aa97c8fe4abf5f7c936238806655524961aca063e09c47f0e1826db46ca72912cca925b967c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\9d10fd99-032e-4ebb-9f86-a231e87fdd31\index-dir\the-real-index

MD5 e2513ace48d89de72db19754b181d997
SHA1 dfa26ca270d974189debeb9da18e09030ebca57b
SHA256 9aaa525ef23031960d28faf7ce1635829d79104032b1a9219584a3a08200204a
SHA512 52af36d9ea7c1c663084f881df103399485c6761b1e9c0a3ba2ad501ca3ee078bd8cc4be93dd2eec622f98353455299eddfeec7503a7f252c652146ceff5ef79

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\9d10fd99-032e-4ebb-9f86-a231e87fdd31\index-dir\the-real-index~RFe58aae1.TMP

MD5 f5169850b9bebe529bfad10fc7618d4f
SHA1 e921f6b7f3745e56d5f97612da2c4330fe4a7b59
SHA256 e63d0f44feb5d4bdc84427abb864d5646903a5154c59d2e06d20951dae4f1d21
SHA512 0731d432a72a86030b2c6d29f1ad1550ec6dd895587c641da4e701ecb5d4e7ee01040e73db11da2e4fdc74a7c73bb78259a817f12e7f41acd26799dec4f71120

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c3ba3c5cb8793cfe29689dc0705c6fd6
SHA1 ecdd14520d9a13a5cbe930fade02431068399bbe
SHA256 cbe5fe55296a8074d4b45c68fc82275af64e4f75749208482ec141a070ce0dab
SHA512 9457b81079a9b2b8bd59567c01d9292a7620ea0de0fb7d5032e1beb667ee73f6c3a11a3ab52956f8af6be7e2fd301ac4302fa13c5d17790ef3c0d6f2fa9b12a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

MD5 e0acad0da3cfdca39dd09d734d2b27c2
SHA1 defcf22cd43db3fabf7b0a3c0e28536244ca4010
SHA256 7394d6b187064b8be6b625f6883c7145bacba2f6c1d7aea29f6b6f00032c9420
SHA512 eb58402123228af278fc7cab7c21337e72c8326835cca1936d435d99954a23d273d43d5ab0744c7fe499c0a615731d92d9799c98212b2c8fffab219ac28ab6e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 34205fffb18e51840f8aa5c959d3549b
SHA1 a9b0a66bb2dff0d6f63b6b3a3919c518c6cb74ec
SHA256 52875ba48186effadc34b579b3a07ac8186b9b2ed55a2fcb26c80038e542d200
SHA512 a4934e39d4ddf5c537e7ced44e95c0b5437bcd7af83f6679ad1e2a4213f19668b681787fec7d7382ccf70f2e0aae65186f64cfbdbcaa0c1a6fe377a70ac72457

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d7ad022fa90d71b4a7f5cfe1a361842b
SHA1 f7084d61408993d2c48134e648590fb5bcee101c
SHA256 a20847e31906fb17e842c20fbf232d6699aa702ac380361267d224882bc5598d
SHA512 289f5ff9add29ac4e4f6a25cf527bbe9cee0f0681dea151f33861abf9a327cab5c80fd85a274defa8d6ca10e0467462429505f8c5ed6bcb534a03247e05c262a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\a78b1c1c-64d9-4cad-8898-d7dc458dcd99\index-dir\the-real-index~RFe5914f5.TMP

MD5 ad267bb013ffd87044bf854b834636da
SHA1 ab9cef25283490131f7d5389b025c949def827f4
SHA256 bad8ddafa0a15d5635de954fbf5988e9fa7ee44f4855ad502ba270c1c1f34447
SHA512 e0c46773e1b44b8ce9f575157b6cb9d4016bb07978afc0433735d4f2733cbd736c0bde98df64f09f9769e1ec9a62f3a921f6e8a44181b3fe617d223405718fe4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\a78b1c1c-64d9-4cad-8898-d7dc458dcd99\index-dir\the-real-index

MD5 0e6299149b52632512e9c92253b5797e
SHA1 644533677dbf24d912d789746d0fbdb4f247d4cb
SHA256 b65d19cb60ffb7bd9b5a87153bd8f06630677d99fc63ea71a627ea1374c884fb
SHA512 61392f62f9c976ad330de4a10d41ffbc70796cdcd12c35b9e1b2885ead8d7aee9123e465e1309987b5f1a62a163d233bb3640552184454d9b27551f49b2afced

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\579544fd7d0441717f082c9eb123588966aa57ac\index.txt

MD5 587bf961e00554b0d7c78d69f4e004ef
SHA1 3e265acbee86de638eb5d748d8508ce49e598099
SHA256 0f2f86ea0a945113bdd34fe75f51a33fe8365de3dfccead56e5d606024380389
SHA512 e2846e90be69cedf3fd4aa94ac1522ce1371e57f730d8a9407337d5464f73195a1d4eef473339a86cc379ef19043944cef528c1f05bce4e0e327f50defa87568

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 cb2ae2f165a80df7f9411ada1c1fd63a
SHA1 660b3f87fb48d36b468185400dc6da6290769e9b
SHA256 8da4e76373241ec8a88754fc0275821076ac3e0ddcc977072bfd474496267ad5
SHA512 9ffa997448f6b0b09cb97ed8c491a87840cbe545921e1102945c333555740ec53b46b37038016c48f84137812211462285f5ae7249ee2ebdfc0ea3a571431634

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ceefca9575ec563056e3a057861c4344
SHA1 844106e89cdfe4c79081c7405c7a92c525111e74
SHA256 c60e286e243083a33b8cc3691e0ea99e17467384bd95c9611c15fc4833de7374
SHA512 45f2c4965ff5705e903257e82d4e2a354711ca63cd66773ac18c174d6538ad1d6f7021924432d0cde57ebf2e349bdf7343fb89fedeb7a2b0998cd855be473f0c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a96eb57a8deb89dafc897601814a6d73
SHA1 0a7fba3b93b2b549ce6516b4356955eac31ebbc3
SHA256 021be1835f31ce60e780f714d8f50da7eb53be95a82594430b3f0d78237cd895
SHA512 a3d6f2881e5aa7eb2509cea7101fff6e9072a6d0dbc19017e0c3f0e23bdf8b5b42e5711fc335688c8833c59e55b033e34708f443f400495fb039fe790ee81eb5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 909a83c9c8f0324af97b7b6ae4e32350
SHA1 c54516617a17a40de5db4e0f66211795585e2c06
SHA256 eea49a735f3895ce639d9da263ea2e6b657081b2b93728c5bff0f2ac3459e87b
SHA512 599d1190354cc0af29fa09e83ec80b429da6f4ee75d65a7a85a2ab20fdcb9da566a97c33df815e05a997cb6ae13e1f063b5d394ab2190a0e842e7ed7af4d5d8f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6429b937169be4d0e8d22c2966fda436
SHA1 b61f578e628aa334acbb5137986b4d015bfe49ed
SHA256 aece9cdcf4c02a2aa20c3dbb56263bc782bb10bdb5bd7486b160d4569283cc51
SHA512 3b5943287566bf125e2f69a94ad2da711c920bfcd81e7876e17a0fc60995b5c155288d24da67bada786cb516d139c6929c7cbab0bbf505f789f1393e42641453

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2c0cc2b0a0ca26b6b3bc9e3fae6bf651
SHA1 64abb9c8b2dd771de6421342a79c18906b2e84e0
SHA256 4c51bbbb97f14fa8ba0941e7c5d0fc3679a1a27d6215b3623cb837efc811fa31
SHA512 31949ebbc8a6e485150d178ff5f0fc864f3738742bf5ee68ba53ed78da9e36c58fbce1f06d33629b01e2dab240070d0fb30d3a4cc403f6051c932b49e50a4a04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f916b33207c052a2253a786111f028f5
SHA1 4e7330f98f7a19dc5a61e9691edd84a543d4f54a
SHA256 9780e565cb33ce9073d9dcfbcb84696ee527683cf1c75141d3c1a7349bf9cf6b
SHA512 3d36ee6c2b8c9187b91879a5642cdd424fb72e95a60b851ba599a679fab452a79d2cfcb68306f189c759dc35b725ca1d364db2ac0ed00d20eff1c6774bd8405e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 097f743cce618a484d23af3176a56642
SHA1 0eb5fa965cfc2fca97dddcd5377f3932a4d8d961
SHA256 484b906fc4fd88d5e7a4a23d7d9945e15056329eb987aa7357850e510a4b54a7
SHA512 76a926c468966ae353bba05b39e82a59ece96c58d0eaf7a98fe0918151e31216e7bd06adbdf5376d8390e5add0172459c740d15da38876f0a823738e03f33776