hxxps://discord[.]com/billing/partner-promotions/1180231712274387115/eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0[.][.]910aMQgYmnC31bgJ[.]rv5QH7S4B79j4jJ0Khf2hwC5ABNM6Mo_fl-6BxE4txE0Pyx6zaLZJzi-UT2Xt-_QhX8NvFMdw3-DJGGxZKyymUr6cqbMMdqgYNQWuvTAo3pWxya5h4sPcq6twPgEkcQRhgByK0mAV46HTtGr0Jso60I094gIU1bQzjEMrBkYko_SsQaYJh_mlWb2bhm2KPwcgRrvsZJK4W2RKQJHR0dPeBmlZPLMNvxxnNV4ypulA09ipj9FeZ_ZCnOo-rH55Ym_v5xMfxPu[.]jnM05tdWPjw6bTRcINtFPA

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/billing/partner-promotions/1180231712274387115/eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..910aMQgYmnC31bgJ.rv5QH7S4B79j4jJ0Khf2hwC5ABNM6Mo_fl-6BxE4txE0Pyx6zaLZJzi-UT2Xt-_QhX8NvFMdw3-DJGGxZKyymUr6cqbMMdqgYNQWuvTAo3pWxya5h4sPcq6twPgEkcQRhgByK0mAV46HTtGr0Jso60I094gIU1bQzjEMrBkYko_SsQaYJh_mlWb2bhm2KPwcgRrvsZJK4W2RKQJHR0dPeBmlZPLMNvxxnNV4ypulA09ipj9FeZ_ZCnOo-rH55Ym_v5xMfxPu.jnM05tdWPjw6bTRcINtFPA

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
8	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1414748551-1520717498-2956787782-1000\{6486C7D6-17D3-4A82-A1A9-2061B8780C6E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4396	msedge.exe
4396	msedge.exe
4780	msedge.exe
4780	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4628	4396	msedge.exe	34
PID 4396 wrote to memory of 4628	4396	msedge.exe	34
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4704	4396	msedge.exe	90
PID 4396 wrote to memory of 4840	4396	msedge.exe	89
PID 4396 wrote to memory of 4840	4396	msedge.exe	89
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88
PID 4396 wrote to memory of 4152	4396	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/billing/partner-promotions/1180231712274387115/eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..910aMQgYmnC31bgJ.rv5QH7S4B79j4jJ0Khf2hwC5ABNM6Mo_fl-6BxE4txE0Pyx6zaLZJzi-UT2Xt-_QhX8NvFMdw3-DJGGxZKyymUr6cqbMMdqgYNQWuvTAo3pWxya5h4sPcq6twPgEkcQRhgByK0mAV46HTtGr0Jso60I094gIU1bQzjEMrBkYko_SsQaYJh_mlWb2bhm2KPwcgRrvsZJK4W2RKQJHR0dPeBmlZPLMNvxxnNV4ypulA09ipj9FeZ_ZCnOo-rH55Ym_v5xMfxPu.jnM05tdWPjw6bTRcINtFPA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8768346f8,0x7ff876834708,0x7ff876834718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6578495850322575741,7963438694312394907,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f6d41bf10dc1ec1ca4e14d350bbc0b1

SHA1
7a62b23dc3c19e16930b5108d209c4ec937d7dfb

SHA256
35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770

SHA512
046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4254f7a8438af12de575e00b22651d6c

SHA1
a3c7bde09221129451a7bb42c1707f64b178e573

SHA256
7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b

SHA512
e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
59aec0fda420ff312254d7a88832c716

SHA1
4f5c74d9e92fe896c369089a351f04e1d6c09042

SHA256
38baedcce8f2d23a48ef71c5df52efe10536a9ec70e6e1772cfe9563614afaf3

SHA512
ba81104d340560f99838cc93e11fee13d5561ec94f94516ca7a6f7d9af75784081758a92d11544ab9437fd4165257052e5db407c06115dd95cf24d263c76b612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
469B

MD5
10d9a89d0fe5da90bf948a681cc6472e

SHA1
ecfd10ced0fe21f901b4cc9579f1263dc92a763c

SHA256
33063afe5a4ae9da964a3ada20fa8bda0e4f5cb97a7b4c2f0a5b0ec587a2f790

SHA512
9df4c4c0c72bdf42b3a378c5b1446084f5bcf748950eec8d9a9bb9bbbc5fa0ed3f22ba76f069ff8a285e2d39ec1432c11cb1e3844bc57e6125160225328f1f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f73daee1699fac073520108c04c6fa32

SHA1
504c3d7134e2bfe2d0988313845c1eccbc6219b6

SHA256
21fe2c1fde3a308511c0261727ffa4327470d87166d39124ff78f25773be5fe6

SHA512
bc94c40e19807224c7fb12ecf06fff9f4cd598ee1a7bda5b09d8657e7a6eedbb6203d6b3dea7a3948b07154c9f1b6a0e09ea0c31e3ba834cf8f8d7c6a0ddcac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1903a6e7f2a8f47d1921edfe3bd81d29

SHA1
4b143d1c5c9cd8102e2a15131926c6da7b1b2b0f

SHA256
9e0926014aa0de3f223800769621a7100351dbb4b95c64a349a56630d1f65875

SHA512
7288f959db61e6c5a8f9cd73615dd3799c52f70a973fd4b70f2dd2159324abb5dc784a4525ebc33084f6341cf7dfcfee6caf8ac91a9d0c2f06c99464ba1634d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
11ab7f223eaa82077ea3fd99c5c90454

SHA1
4c0609f3e55beac9428c3f1a901c823ce11d79b0

SHA256
7c0e349f5d7869ea649cfc6bafe50d6406ff7da08a5422b9ce5bc2663114caaa

SHA512
faf79266ecda395e40b678272643486625cf6f2367c739c12d934f89f8386b24a4f289fa3979df2498ce22af3474de5443ae0b55170392466658fe210e228cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57be8d.TMP

Filesize
370B

MD5
e87ffd31c25d6070b424572d62bebcc3

SHA1
570e91949654aaaced7f75207f6047b4b115e633

SHA256
9c92e31f0bb2e77499d55c7ec20482d93c7fe40e4122c4860112750a7e7f0de6

SHA512
226cd551b5694bc18266d84dea2c57bdbeb40d0bf02b993a4ff604148dbb79bce2ee1a356a39b53d4dfc90f2291d3e77feaa5bd5db6e115469ed62d6518d7272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ddf0cef4826b2f9854af99db61509607

SHA1
486a7fe165113f0d019bdbee1fc5cf7158c78fb1

SHA256
e2467079bbb69e4cc41f76bc4380683b77a5615f22db3e05bfaf99be78ed498b

SHA512
4379bc3b606e9cf23ddef5736a148f5ea4c1e29445a30c2a11a289134510fa15030571959a525f6886fd62670e3aa8c22c584e710b4f8d6bee8356152a93ffd3

Download Submit