hxxps://discord[.]com/channels/@me

max time kernel
242s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
21-03-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
5	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-647252928-2816094679-1307623958-1000\{64AD2EDE-3707-4853-A855-F6FC14E3D121}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
4724	msedge.exe
4724	msedge.exe
2732	msedge.exe
2732	msedge.exe
3448	msedge.exe
3448	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4712	4724	msedge.exe	78
PID 4724 wrote to memory of 4712	4724	msedge.exe	78
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 4756	4724	msedge.exe	82
PID 4724 wrote to memory of 548	4724	msedge.exe	83
PID 4724 wrote to memory of 548	4724	msedge.exe	83
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84
PID 4724 wrote to memory of 4416	4724	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffccf9a3cb8,0x7ffccf9a3cc8,0x7ffccf9a3cd8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,6454134897224344326,210820468124941857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9788ad5d-7806-48e2-bd47-b484a82ff112.tmp

Filesize
203B

MD5
90b746f3539609acd48ad21be6713bf7

SHA1
fefbe2a10d77bbf4f081c9bc1a2f284069a96531

SHA256
ff6800bf8e465fb80b10764d39b28a092bf5b7af44194b58385bd7c7f56a2a27

SHA512
a95efbac6c7774e4fb5daa82c5af3f5f52fe2f3c84331c3d808ed0c7e0ff2a690432d2ccb0e9a25469138b56b9449d36ac02d8611ad9b53627fcfbb4f9eff7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
91b09f3ae26bcffb97164009c2a568a8

SHA1
553f61222c18f232611f7b0b706429ec3453ec20

SHA256
986a3210e8875822a50fa053b0e92b94be6e1d984d2efe26214d97cc7eda3d66

SHA512
a30582c8c11192fb648611f9b6056f9de4dcecf37224e88306415d17ef21d2944b0b728632ca1269219e61a6680d3969ca0c808c5e187247b8ce9ad0f264c598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
116B

MD5
a4241c693fbb0890faa305764d6cf50d

SHA1
e856d3421567a3cfd8d790825d6952ba524fe463

SHA256
197eaf026300dfbba19cdaa31982c92741d973f655d875b6362246d6f89d07df

SHA512
7e9cdeb74e86bbb4afcf620a148f82a03f38d3a0d370ea37143e7cffce45109b5bb7638aaa77c97505d046a8ac4ec6f9e4dd630c54ffb44b57296d066d308bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
ad61f859c8bd8649653c3b516f9b33df

SHA1
7cec0e8f74ff52ecbfd5163905219ed879b18315

SHA256
321bc31c921f3135cbb7d950d37ed7c252db71fc7233a0a2a929eb187c980e13

SHA512
9f6eba28d84fae269f18267e65998c62e6fdec6b8c752fc3b383e330e45f6e7255bf63268985f26b63f9e837bc9fb58455cd11cb5e3a3c20ed36fc7447443e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b29174d9d94395b579807ab802ecb493

SHA1
2c6c9a333d6ca6551794cb797698674546ba69be

SHA256
3c5273be9c360613a437d6afe294bd5272a7fd114ccb6811623abade4f8fdaed

SHA512
c14bdfd7d2088712fb1cb6bc5f1e6a2f1089929c7512b15575b903cd04a46aeca54f991d9a3a60f3b23c7a56ac3e772ac825c0b88e019c37d39c075396e4df15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d125aa21877f7755a8f2262dee29ae4

SHA1
906c3fccbce26a4213cd3ed1a5dac982f756ec00

SHA256
5c332d7fe0cdc91e4aff1827c3284080328112589b131e46148455c5ce2f8361

SHA512
6883ad660737930000443da49bc24fccdb1869136e0a93d8dd9b7f94d775419884e99c565f722870cf5c745dfd943c0475265451fbed6cc1323ce6e40492a9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb8df1a5fda9dd10c103c80bd0a227b4

SHA1
2f2215161ab8b820b61822052b89a46cb255abab

SHA256
d1b81a2341d17a6516673a16b780c7dac0ae40e6c1b99c51b6a0bca127b111a7

SHA512
96d2a8c92d1fa62d7f5d67e1695660d0384b6fa7d01b92d9faa7c72a4e6f41fcb9bcf04ddc42c90014cd6329f19d7b03b9a0d357e21409d3ca0cb384c7bbbfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
297a0f242ced1f167b727a6da0c91666

SHA1
c40bd170d93b25c2fe4965b05be5bc689b116bc7

SHA256
15e0b0cddc8df13662ec5cd8b8035438577e517b5c8fbf7dcc2202a21002b074

SHA512
a6732a9cded3cb6746e7b9f01e04c29859849559225371c6f3f5ddcee04c54b834eccddbcc980f2ca190f4cd1d69ccea2f3b06369c60a22f92e1b0ffdf6ad5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
570b3cfa16a7fe0460430a0b2914f231

SHA1
7227b618d489f9b26901e5557ca04dfe8c777900

SHA256
0028547cc78a0da88b9f3f78c02983642300bf735564ce915ed626e4cb8b7451

SHA512
d677899e7e44424be4df0369b1110ff04e2f5f63a42f6a87afdcc3b75e0a3435173dd2885610258a5099a05704e2e9fd72e5fc4c8921ca4b50297b6e901a50bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582aa5.TMP

Filesize
203B

MD5
51fa5a6765ef767a2a8aab3e66413295

SHA1
b886839c3114c9269710b62221df6a4ed841e8e0

SHA256
e0d8c63dbbbb06ceec0ba6ad259437e26ea06648d3e08a2a7f33080b102acf28

SHA512
501977d77ab58d7350c8994b780a639154e9bec6a75c67e206fb551871d5c0fc988cab9ffdfe1b256d4f665c2e0d59330a26385fec9ec612c864246764fb57a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6bc2d660f968e3b52944a3cd88b38f74

SHA1
a7119329ce8076548d5243f35987b5e4e3057797

SHA256
8ea38c348129a8477e319c65b305161d5b5bff6042c1666ea0ac6f08cb23e35e

SHA512
9f6739ea6f295c9d3f6d6f87269e4e3a713ee690990df0ef7421221d914886a6a270ceebcd15bc67aa3ad164e01cc4a27bec54bb0d441219ff8cda6e24a4127d

Download Submit