hxxps://discord[.]com/channels/@me

max time kernel
564s
max time network
562s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
21-03-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
5	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930051783-2551506282-3430162621-1000\{0FF8B63F-D0DE-40AF-A93A-89898E50DFE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
3440	msedge.exe
3440	msedge.exe
3720	msedge.exe
3720	msedge.exe
2112	msedge.exe
2112	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2036	3440	msedge.exe	77
PID 3440 wrote to memory of 2036	3440	msedge.exe	77
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1452	3440	msedge.exe	78
PID 3440 wrote to memory of 1860	3440	msedge.exe	79
PID 3440 wrote to memory of 1860	3440	msedge.exe	79
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80
PID 3440 wrote to memory of 3488	3440	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeeeac3cb8,0x7ffeeeac3cc8,0x7ffeeeac3cd8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,17283586543917959228,7032437372627970987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b52b62b5d738e5ef136dfd78272e98c9

SHA1
ffa056d0a73280b2a169156fc2a2bf588e049a2a

SHA256
93e416d45fc60f6682605470b5b2746be72f6b15638fb9a1054d3e7ac7dfbb21

SHA512
90d2e02717af4d848ab35c33855ae6cc755ad30ebca24c8edf5ab3341650f62db2716b6cab01858a79c5490543954b7d487a0ef7366d441e4d7373e6c40cfe4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
a48362a55554d0954365f09b4287ebcb

SHA1
24a5fe32d927be4b30689a4585f745da74299dd2

SHA256
c76550d006b93629264d4948049d8a0b3f363804e68938fb1924ef69c30823f3

SHA512
13ff9ea118e7fb1b11efd72f7bdb7d5e0d71d38cfcc8fd12e7b14e7b7eb20359c4f880cc8133acfa7e592eef34db22d644ab94087de1f675e07115d73ed5357e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cf5d932e4f0bf4076c11efcfcf943e1

SHA1
1733caf11bb54c92bb325826e104613c9cdb08de

SHA256
34cff21d0f73f12a1055c87d45124c61ee3caf9cd25e152ab8282d45563804e2

SHA512
cac93659250d49afcf4b027ca9d4226c0a9f484db5314db785e72ba34b7c4bfd7c1f39ee474c740ee1fa12e8cac38995360f555f3e213b838cfc5a6473ec765f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03ecbcd5e1402fe3069a139126306c11

SHA1
990cb22f55c28548563c541fc288897dd26977f1

SHA256
e906e950012ffda8992c476f0b71735fcea7e41f6a4ec3f755192b2b6c0dbc88

SHA512
3b02095d9a46b8746a9aef2b1b7bba4947305c1d4ec9fc2dba535560998cb9d9a2548b264fa565853ea21e3bacb3cb2a89f10e873bda40567821c14c351d912b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f54c553d4c5cc9b10430cb7c4171a5ce

SHA1
27756fc3d50d7dc0c0cde34b98cf503cd5a2f367

SHA256
dc9997421a194844e5c63796e4d78c0026f742e4054dad458fd71e2fbfa9d21a

SHA512
93b55797658e79e38f9f026cdaf2a2fd5503b63126837d6bc19166bab826364f9d8a99fc81498dfc5fc297d140aea73dfd0355f617cb25ce3c43df774b3a418a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
cd2eef546129f66c11306a46e15f3663

SHA1
6d2976ca544ebde019299de2cc06f22be8997312

SHA256
3e929441b104af152477e6eb7af394fa2198e30055223e1ca8242e0887e94761

SHA512
e977a81e7804f6c27bc68db764475aa25b28518a10eb911a762e3e843b71f395c9cae7387b263255607226501ceae2fc49c63893050874359491bb092f4cb41e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f78089923f610d0e5ecf613ec1e4fe5f

SHA1
214d2bd3096fac2b757a7a41fe2f31e4d4805f27

SHA256
271d3422c1f977037366fe74df03a941111740b85ec1dc660124ef82e9eed630

SHA512
e788f8afbb1c3bd8899e6282e0b5aea90880ef5e4b0e40f569db7793d7f6f894fca1c2a7800b2522db441039e1e8e426cbec706c4c0f598c860c91787a7566c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
9656544e21f3b496ce33ccc71f48610a

SHA1
03c8a262bc9ec9c1b919f3df1ce02dc059ac3ed4

SHA256
3216918dc32e13dc753ef8ed365a853ed92bd30543ebc25eeb5409cbb29b4fc7

SHA512
5e0cd135d7e29453ec95697fa9fa409951a2d47f088b541c9d79dcb30df3985af0562db9d32fffaa7f35c890c10c3322f981b92b1b3512ddb03e487034e9b27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59e229.TMP

Filesize
370B

MD5
219f3eabb19a6487c8871b6cbc173ff8

SHA1
6536d02b5d642d44d3896b17bfd12f90fb54e8c5

SHA256
c27b1f848a05303dc5dc01e6d579074f0c9f7229e3238b9810ad5d1b6026f97d

SHA512
ed91dac09d7e5933c0d27499abc27da877749903c170216f388c3687a5b8222031d65373df9ce2844a46b71c54d94c4dc2680dbf2e982831c93d73cd7c1d37a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
511e54109ac564f8fa5b0d5efa72e926

SHA1
ce3d13920306ccb93fe76dbf855393b2031c330a

SHA256
8f1635eb397940e2c9e75ffe2eb7658691eacaf8d1238bb6a8d3d692ca17d3dc

SHA512
72ef54809a6a5c7e525c79e0a3589b69cfcb72f4e56a8175902c40f3b82b00196355ce5c85ee2ef5f79aa8511e2e1c290e351454a739496404bf57f0ea3bb522

Download Submit