hxxps://discord[.]gg/websluts

Analysis

max time kernel
60s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/websluts

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
46	discord.com
47	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3538781373-1545967067-4263767959-1000\{27DA272E-ED2D-4448-855C-EA920B6CCA27}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
4368	msedge.exe
4368	msedge.exe
3124	msedge.exe
3124	msedge.exe
3764	identity_helper.exe
3764	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5556	OpenWith.exe
6004	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4576	4368	msedge.exe	95
PID 4368 wrote to memory of 4576	4368	msedge.exe	95
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 3416	4368	msedge.exe	100
PID 4368 wrote to memory of 2640	4368	msedge.exe	98
PID 4368 wrote to memory of 2640	4368	msedge.exe	98
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99
PID 4368 wrote to memory of 5000	4368	msedge.exe	99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/websluts
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c1e446f8,0x7ff8c1e44708,0x7ff8c1e44718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3816 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11321566607734574871,8385994950093527227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2412.5.1781497572\1850361329" -childID 4 -isForBrowser -prefsHandle 4640 -prefMapHandle 4636 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fb2787c-2a2b-4d70-b6bc-c1dd27b8af91} 2412 "\\.\pipe\gecko-crash-server-pipe.2412" 4652 206a2919a58 tab
1⤵
PID:2444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2412.7.992250784\417585848" -childID 6 -isForBrowser -prefsHandle 4372 -prefMapHandle 4664 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {834895dc-cb97-4c69-bcc6-ccca93bf50fa} 2412 "\\.\pipe\gecko-crash-server-pipe.2412" 5076 206a6b1d158 tab
1⤵
PID:3364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2412.6.1849656143\1154456672" -childID 5 -isForBrowser -prefsHandle 4864 -prefMapHandle 4868 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82c80bf3-a4f0-41e9-8de6-77178fb80da7} 2412 "\\.\pipe\gecko-crash-server-pipe.2412" 4780 206a2919d58 tab
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SplitTest.js"
1⤵
PID:5928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SplitTest.js"
1⤵
PID:6024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4db60c9bb06ea5452df26771fa873ac

SHA1
c118183a1315a285606f81da05fc19367a2cdfe1

SHA256
f168242e74bfde18bacb9e18945a39bb447188eba916c7adf0f342ed8d82281e

SHA512
180ed98f9d5a14a22687a099c4a0ba6b586610f7b8b4c8de89f3b91713b07a2ef3726fcd318cb4e270b1745213b898037d29cca4b490d0c91833b797d69ac406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5b0bf4edca2187f7715ddd49777a1b2

SHA1
eb78099013d0894a11c48d496f48973585f0c7c0

SHA256
562016f9159ef363fcbe62ed13ee26052b31d4f67dc5ea6d60864a7d5dfa50a1

SHA512
1039b98cffd32ca4c9e37486b96e01b167d76b19dd8440a21da4932d677c463f4c5ce2260239e8337f59bd61ff3111905e23ab71d3ca5b20e7d2935fea7952c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cc24f0a9ab7938b726817d4224f9d0fb

SHA1
201bfe6ce13e523acc4e3f75d4ae17312c8037e1

SHA256
4ca5441d7d03c94a63cc49ca2bf6e43fd029e4f8a1d5a0664e0aebf3c05da3fa

SHA512
e96d7a53ba8afd1edb7db57c5a686e6f4a80b4586cd105a15d8f094dd95c7ccd8cb1856f712cdace968db57a60da3c0a1ad1629c66df2bfca9cc4d2adac3f9f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
a291eeb0c22ea02f9aacd1624b91a7d2

SHA1
3620e47b4b780c83be11e8c65f46bd36c0adafd4

SHA256
ef585b76eb4d1a4580c5b255c6222fcc96c43cf52966ab6b1cc7a248b3bcd813

SHA512
5b68914c1df6743a04c7a251b0b75b7d828a1beb351ef6e0433f4fa46ba87d57fb6195b60d382f8af3636a14d6d845eb1d046b813b3e1b514af732752bb2c9f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
833a0440204168e19be47fca9bf5dd44

SHA1
1000eb79052cd03b8efd6599c73e190ac6367505

SHA256
154d3f410ac440cd850624858cf2a906a04e6677912b21357098ee136061c4c1

SHA512
022d954a5254ecc79b89cf56cd80a92027c53fbde4af4a0043859829813c39f551909d25da4f8a381846932934b104336732e0f939321bc89489512dd937f82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62ee39a9f80dd0b2c5ae8cac5c64743a

SHA1
86f4f2c625ecce0fbfc61a00db52ec974e476063

SHA256
fbd3de376108b15103b53fc7253e9aa2d0eb446bb9a0b026bd1d0aba14fdc14c

SHA512
639e085aa5d20a5b471964fbbebd510467ee9cdb62f006adbc69a5854d08dbdf40e7f13bbff834d7c9586e1c982c7ecd0992bdfa7ee7f593bfc2727edaa50779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
068f9e1d9a424aeeb8fee66a3a2ed5b7

SHA1
7392a1a0612b0d699724bc3f4e3f12c610ac296b

SHA256
dfe630d1ccb3e69525ea175bbd9f4286f0b313180f6621a3d493d33e0b5a5ddc

SHA512
141bfb5d0356b184f5a88cefc5bac121dd3a4d42a6d36c0b26c33f1d0d6b8381caf069de961490e9a2782400f19a70877ff1e4c7b6b815743b6598073b29485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
d274491ee8beec05884529eab37e4e61

SHA1
2715130d004258654d1f4f8595ae7d3dc8c63c8f

SHA256
993ea2d5b92373c1e99a4e70fcf83bd8145dc62c1415d725ca0dae3e7b32ed6f

SHA512
af8a7ba6a103d7f5feef02cc797753b166da4f1ec97b2e20fe96c67c170657053c2631f16e52775ea4e025f776e26f99410a67a860a12cd895f0bc15b91e6187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581170.TMP

Filesize
370B

MD5
bc956143177f2d5cda2dde55a34d4c40

SHA1
89824d9d61046bd735ec6f72c563952a9fc38fc5

SHA256
750233474870f70b36ee021eb2ac096e9906fd25c4df0da875e123c8509dfef1

SHA512
d4c9e8c02534bc9821e89fffa3743e1d73f09d59fd016fde9292ed8e112d64a0b25060c96f0d66a112c26a3906828cbbb9e6d4725461f93ad5fa75876649d399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
305b1d8f7fc98956d17b8997b6151a09

SHA1
475a279ee2a4db0a851694fd6fc8dd01ddde5709

SHA256
c0e7577bffaaf32cd8ff1631c71d372a90ceac2186e3bcaf5189c67033def670

SHA512
7025fad94488bc110889fa362cc98bfa9d6f2ba1c0d8f281363c9afc719c4545887d0441ae947ebb9f98cad75b08e5207e5b0b4c98277b374a3c1d9a2777178e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad6ca9f0450c75f947c2a348edfc4bde

SHA1
cbd1b8c5e96b64188ea2d9afa2b6972a49226ef1

SHA256
ab6f318106a8c787dbdc1907d536fc2020a7219400ccac84db2529b56ce02653

SHA512
dc7990b34ed979731e2874e87f91f564ad8e2634974510519b5cffe603fb3818826921b8f4bcc808969597ddd8eaa2f03522646264c83b3567d8a521a7c701b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2da71d0d458c6eb21393b94745c0b3d

SHA1
3c704f03cc71bc1ca5b044972495c3dd68a9bd13

SHA256
55a3b8c3e0de4732d6a9af834271c92aeb094935763b322fefe320b57357e4a2

SHA512
8568c8dc783a67d3cbe0b22e8306a680104ad49780ceb5094404831d997cfcaa99aaeb06940e0a7e8720620c2c1b22947884d6675bcabf2d1390342f98cb3ba5

Download Submit