hxxps://t[.]ly/discord-bot1

Analysis

max time kernel
158s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/discord-bot1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4368	msedge.exe
4368	msedge.exe
1500	identity_helper.exe
1500	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4368 wrote to memory of 2324	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 2324	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 3932	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 4432	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 4432	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 236	4368	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/discord-bot1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6f0e46f8,0x7ffc6f0e4708,0x7ffc6f0e4718
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
2⤵
PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
2⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
2⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
2⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
2⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6048 /prefetch:8
2⤵
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2907867050685627425,17396224981135650774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
282B

MD5
5c27d69ac0f6694b299d04b03a948271

SHA1
24bde243d62e1409839b5f99d1d41b043b0e6128

SHA256
d3c3cb54fb55f88944cf461d7e7b171ce24b91353e78d553f740ff5705637b98

SHA512
b3a3cbe05465e3801fbdd99ee7ffb49169e16988ee9c5a023434b6f21911efc4057582716273bdbdeb9e92a4ccd94856cf920564b3a80690b2e40c42ad4ad240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
00dc96f2379307d691e54b8f456f1bb8

SHA1
2cdcdff9a35298a285a95501640cfc0b43cc92e1

SHA256
26ff2b25ceeb576047a452a3b0cb2fcff6498ebbf50f526224c2eb861fa6821f

SHA512
2d6cfae285e8ea70b003c3fde6a6371376cc29d6389807172160107cd28b74718ee36613e0d64152e992ae7733fcc66ed0166578faa3d695d709c357def08fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ce9a49f6b3bf78aa129d8423750f1814

SHA1
3354e5ba65f714293134dd55523216add5072f4c

SHA256
c98d281c6c13c333c52d08ea20b6037ce55623f7fa34eba4dfae66a68acad252

SHA512
82e4f466740bd75f755b60239c3d6debdb0bf5a7cfa625578065d984c73f1d6c596e21995fcd410d7ede201abca81a95adddca3df32679cc9658861d886540a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
04bbaa02adf7c86b7d31692f1c62b080

SHA1
5bb76bf2e47185839e27b40ccd0978564ae87cf4

SHA256
916c6b3a458ba16ffbdb382dd4efc62c2ba4efa5664d07d690ef0882f37cfa99

SHA512
e71996ad33dce48dcef893a9112c2e1f0503fd2d53fbc0821cf187c34779d476e4bae88abff406b02cbb42101a8cce49966483e6bd8797cad73e362c34a54c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
70f6ccf2519fce7a924538a318d2218e

SHA1
0c4eba6ef603466f7ed2c0077c6487fb9bafa6f5

SHA256
244c1cacdc789d6a4e6e7044f7ddd290a344d1ca26bd3cfa711da4fa9f7532d2

SHA512
297b150346ec07b8d83a3682914d42b532dcdb9117372ccc29322cac8faf632281a62560a442e5e3ab1a93e2a46bb01bf04352d49103f59523614a529d28eafa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
391d58c815dd558d9d4011f5d0c4114c

SHA1
e0e077b6e42154d9e515f732fd3de12180ecc4cc

SHA256
8baf50a32a6f79b9d9b6c09943705818b4fc974e8fa36e0fde374fba2e24cfda

SHA512
e69863e5a9aaeebd387516bc496a0bb29eb53b278303cebe65be539d540ce922529cfb578ca57ed598ea797f57da33b2679b351ff5d7aeca3ea66d91cac88650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
3KB

MD5
df91523a0129533444b47eeca490d58f

SHA1
468aed49fdc6d0737044f9fa960ea46aeef091de

SHA256
e310652e5969fdbad7d657bbbe0a59354c7f265e8485109ab8b8c2ecfdc185c6

SHA512
952fcae821bb2336ce1d2b83360fb7330fb90a79e0eda7a7104c13476ba3b40042c139af1ba5f7cee1015731e3897b4436775e33437580f2175eeb976ee659b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
0f6a4e0c33e5621be79f4222fbf65804

SHA1
5b8ade522f4f5eb1eb191f84a88dceecdd7dbd83

SHA256
b6c5c2b19fb8bb17967adaa6f60d500292b3b1c2dcd98a0a784f8f447ef24cf6

SHA512
f3dc72aafc26fff90876c0e9b146c7a14f0412284002f1621b26023262e698ad910cfab2efc33082d3d0acd9ddf35b26bfc97c8befcea33f0b6a426137654c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
426466c8b39b9e854f61ca60bcaae971

SHA1
6e84702dccc67ccd710eabc6f2320d96e0abe8d1

SHA256
d42cbb5bfd490478e1bdfcd41a03f9dbe76e2aee0ca77c9f8b8f96ef3d5ae792

SHA512
76c9da8bb6a5967a1ccab7d9b0b5b411ec0834a522b10453611df4886b01043302f7ee359aff9e7903aee68d99181d484ec2fd3678d51e5c25d3b5869ee5a41c

Download Submit
\??\pipe\LOCAL\crashpad_4368_RUAWYIZGKWEMSBES
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit