hxxps://discordapp[.]com/channels/@me/1208624337129705584/1208996772223914004

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discordapp.com/channels/@me/1208624337129705584/1208996772223914004

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3316742141-2240921845-2885234760-1000\{E0A353AA-E58C-4D2D-8524-97EFAD71821F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
312	msedge.exe
312	msedge.exe
2360	msedge.exe
2360	msedge.exe
2256	identity_helper.exe
2256	identity_helper.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1500	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 2892	312	msedge.exe	59
PID 312 wrote to memory of 2892	312	msedge.exe	59
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 2512	312	msedge.exe	88
PID 312 wrote to memory of 1008	312	msedge.exe	87
PID 312 wrote to memory of 1008	312	msedge.exe	87
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89
PID 312 wrote to memory of 532	312	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/channels/@me/1208624337129705584/1208996772223914004
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3cf346f8,0x7ffc3cf34708,0x7ffc3cf34718
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16439010840840854661,13872541492913191463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480 0x4d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
106KB

MD5
3865955b159ba4e5ad960bbc7f840507

SHA1
53d1b8a3da6fe343293b2a8d1c3b7f26ce0e62fc

SHA256
e0ef05dc8bd6cfcd101a3863fc3621e753fc8452f4771678267b77cf36e49f75

SHA512
886d0253b94bb4eb8e0e11df8545b14bb81847d4ac9be52b975b494b763fa1251dfe737c0ca03b11379a6856649e58db81f5d5d971947a6259c61928b740bea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
593d6aa02eb1bfa37d78646e94f54a62

SHA1
e13bcfab89d2dff37a528dedb1051330471921a6

SHA256
f3928d958e36ed2feb535ef7ffad6ccef97530d914059ba44c7689e07c94ac91

SHA512
832db7264e939ba88b4ffe9730e0ac05b856d372c7f27d267269aa591b54579aedc4c8dbc7ae3d4330e973355156862e9fe21661b393e24f467b3ea480066ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4fc7dd0aad762a99bc3d57222c29faa4

SHA1
1604c0a1ca7eba50433e45137dc7af6339a9259d

SHA256
075a29d1788f0cd21a1963f309c4939c108ec5511d9325c729e1263661a3ad8a

SHA512
792376ee198f31382d1e1d3b5f0476fb7cab925d7a6ec200ddd1cf227d1a75bf48b8adacc7efaf68b8ba2caf3516e6b96886b1b308d2085a2c1b2ee6ae5f4af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
31e9945528916c4717df30031a8f7391

SHA1
28131c6135e3a433333490ae0030aeac04f94d78

SHA256
cceae659542f477d05f2fa662b603f1403676e1d773845f93c5257f939e2e475

SHA512
17d974efe0628292d906a550babb554502e6fe1d4b468120021d2cb1c4410c9ace986598d75c9f5513d00239e4beac6e8385bbb48c3e5a2616409b50a5e2e1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
10c668b755866a8ead82aeadecf74ed1

SHA1
0ae8fb20f8c0b8a54444910d7d3255f2473573d2

SHA256
ac12cd47f1085211ef715f3910ed193b54a6b6e8d0e25b7f0adec0b71922dcc3

SHA512
142d5b68224b12afa7eaabd78ce151ff530dff6b9058e745da0ec58b8efa9d8d769216d02e3dedafd59da1d369ed7133bcc7944abad5de32f8fd079176d71c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8994adae5c6f8af132625297a5187e1b

SHA1
8b21b79df0f190f4eaea3ce104e43ebf4518ad06

SHA256
fb6556172d63168af975c1b8a47b46af8ec4a0ca789235179f53a562a49ce0c9

SHA512
bdf3369afc87aaa5e1807e5355892089fb927c473412dde4583829a115dac8a51c0bdce875c7b92e0d5427053ffc98b35c055b26e5ff6d250c357fed267f2111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2604ef4c9a3dc120f6e6253fb837298b

SHA1
a1b1da51da8f164117b22eafa8cb7544a412c213

SHA256
a361888e957ad057df3bbf2555ea3b2c38969f15279cdd696cf9c6def76de08f

SHA512
d5e51d47e9129409e3442d8afb757fcff98e31856084d44d098b3b4e6e1a02fca8e53b07d3c04b919c3eb947414702f15c38514be537d9d324107ad3e8b3149e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41be98c596f3f422f36d2fdafac869d9

SHA1
dba8c4f0d3ea1cbf03c31053bedc5939aeef1978

SHA256
771dfbf6494e5458ffb61c4f33330d53a5a24b2671fbf5f962e096d4b5933607

SHA512
291db89b9ed679b16666e4626fbd82521cfadbdd92e2ab7adf6036a53045c09c63d3edb364380876582c3a781e5e28cc2a62fade459207984f35886e29ff1af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d96bf9b5989e3d10f497a22f5de7509

SHA1
8f070750b9b844b2d1b7e921482577db72a3a1e3

SHA256
111782e28fe9b1225f69730c964b680beba609b50015c3d187e5649daef98231

SHA512
fb60c0d12cc46aa4e645c32bcad4d92c4fd04e9845afab2a53e2ec7c07c239b13e58baa7255e92f04f61e7279f97b007414f8f4ef6e7a1a5fa126550eaae2f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5b98337462c66dcc854f6fad840edb2

SHA1
51a450d40a85827fcd080a5b60b5cc063f75520d

SHA256
9bb1ffe402862247ed4780673ccd94d6bd3618fe644474b7fba0f70654504720

SHA512
c3c986ea1bdd6e6c4d52255662cb56264edd4c2e52433bc44e3b481c346a9ddbe1fca998e8d9b6e3a94e061969439e49d27895d3fe94cbd937eec8801a7a487d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5de6b96f39ecf385e7d87143b7c171c

SHA1
ca193640e48976e7c9c2fbf302365f71802ce370

SHA256
0607dcd69d76d96d00ea857b05525ac719f55dbb32851d89e0b56a9e3f75038d

SHA512
2fdd395be9a1db1428da9337cfd91fb66e8e36b1838b4c9193def078c09439d4ee2aadfd5b1afd3961ca45097466b1eb10cf746b121fa3d243c5353878d2b5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1644d06608678244479c09610629345c

SHA1
66f446d354ee8b58ccb92b8eb9d028dc430fba63

SHA256
4a01de2564e58e6d9bfcf544e627b6df302d4b2de40965032b212baec23254d9

SHA512
3fad6af790da033c749df123f88ef7828e87aaa91e300182520fccc584f47551218fa037080094c36ce1c8c756e39bf57186b5c483abe0f8c07ee9373c63117c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
ac247941ccf343f1c3a790dc478f1c54

SHA1
98579b934c6dcfffa31acc990829f8e96b4f4f3c

SHA256
fa27284facf54d068314d9cb8a2eea109f4b9672d600b1285e10141a34e04c44

SHA512
2c8bd7e961107ebd545b1a855e34c157eac19bf21233bbf40889c09a7c2a593404c74d3cf7490840bdcbb78e080de46df8d875d79fc8030b644a68f33c619273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
963cab9ccf23eb8c867b41e362c38b2f

SHA1
b840f9b321d3ab69ef6249e282450973ca20e681

SHA256
5339baaf930ee700b326c59c9e4332b84019530a6f958fda5888d5cfbc5da656

SHA512
32331068b669866734160d3c4d210516c71e39bea7af7b7176a6a1fdbb90d8d26ad13ab4fe52f62f0a020a3f79208637a03ac8f67d4fab16941202d469a0468f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb0927cb0b47d51a34fa58c6efa717a8

SHA1
11b1bdbc6744c40b6a8e61bf3fad8cebd4da22c0

SHA256
a6f97430de99d1e53c92af43adefa9b938ba4d556a9ee62164f6b8a7de9e1ce4

SHA512
d11b4bdc6a67eb6158541d3aeecba5322170afda25f60358721a33e82ffb131384f43fc71be728c3792709dc043eca2e872a54a412efc63332968ccfacf2203c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1e020304b1e8fda073bb61e7b83305f2

SHA1
331202b6c8196cc58aaa8a90961af115055aea3a

SHA256
c769be5a2cae3ca1eee559f5916c4d13df5fe30ecbd35ebb4d73cecab00c3268

SHA512
92f72058c8dd8c33bbb7d65396b8be9aba9d3b556f2598b1c6e04b35b4ee2f7c89c333ecda76b5ca0803fa8699f213bfabc201deefe874a8bd3c0a20e0e8d30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e316d292e27b783bbf7d5e4de753310a

SHA1
6462f96bcd4993541079fb2de131fb44dc41e130

SHA256
94fe3088ca063e5287fb0d45f6b0712c7c75d3cca126b6c38e87638279add3a4

SHA512
0212cacd282033e431f99ab13654d0787111c582ccfbdc414361df461eebcccc24d978e667203609bc79a67075cef3d88397b57c438ac3de29a0e06dfe533f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a2f7.TMP

Filesize
537B

MD5
e121059572a5597dddd7ebfd25943cec

SHA1
99a26a4d2117a871a43451ded15ba3ecc055a5a7

SHA256
f6d17c792fe1d82406b5f09f8909c88463469167813d6585445e6ec4151c2f92

SHA512
f493be18c5a54ed01b36f54d077b9bc03ef94f4e9bc3698ee0515a963f82be4e2016709708f43575f1e07217bb25683726d7b2f7cf3421ced22d1c7f003015e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a6caba2ecc44588835127310724891d5

SHA1
1a1ddc2f62252f90af8686b7b34ce8de2bf10cab

SHA256
118501ca24258a25304009788d7b4cd9f36694af657eb601f8d8a43b49636e88

SHA512
e5c7978f50577bb41e7c36bf00ee1f76278c5066c11c4f8d4c3925e9ac6adfecf286351686a2c915cd9ac8c49ed9b1054cfaeb11c839fc262ada49fb5d4a0817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fe28e464ceb3f9b70f16d62145e297a6

SHA1
dbddfce98873b3cc6819a5a9ee0cc4caabb2928d

SHA256
415b94703c8375fb8a2e087a1a77f3835f9c51976eb07861b1db5a12b20874bd

SHA512
df6c9d695555b77ce255c8f25b67c86492a9a052cba1ce19ddcb6ae80c9bcff8e5ea02f9b6180e54071fe101e09181ace74ceb873b23cff0f86c406bf9ad9e20

Download Submit