hxxps://discord[.]com/channels/@me

max time kernel
1160s
max time network
1192s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	discord.com
11	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-513485977-2495024337-1260977654-1000\{514764D8-2F71-4495-8A7B-C17440882BA4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
1968	msedge.exe
1968	msedge.exe
4068	msedge.exe
4068	msedge.exe
5224	identity_helper.exe
5224	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3356	1968	msedge.exe	90
PID 1968 wrote to memory of 3356	1968	msedge.exe	90
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 1780	1968	msedge.exe	91
PID 1968 wrote to memory of 3940	1968	msedge.exe	92
PID 1968 wrote to memory of 3940	1968	msedge.exe	92
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93
PID 1968 wrote to memory of 2368	1968	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4e8546f8,0x7ffd4e854708,0x7ffd4e854718
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13571169707837222127,449527021499296149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a2ee9235696846ea7da4b8a89557fb5f

SHA1
03d2bee5282e2ba64aa4ac05b7f25f31e1206107

SHA256
400de6931bc5eb58cd86c39083c40fff0e2b6fcd04a54c08e9f22dc118836fb3

SHA512
f17166d92de9f939a1ff188f9fa701ca602c59c8d48ba98a1704b5c35eaead1c018c9fd77f9bae20eeb1d0915214ca23e6aa4776d2e03888169bfff7e7e2e55b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
c88a3bc77002a075b95198522f195432

SHA1
dd6ff073c9b7fa86d1a461013165a7251443e777

SHA256
8f8c6061b94669fcf151b9f8f1c979a33ad38d597be893f375bff44ad1b3556d

SHA512
e3facaf13afeab1a90a5c15f31288611e7af177fed3e4474aefee3560c5e1129579ea74857f5a3845b8f04c117e6c5af45c87df5d0b003e1259d918b7b0dff1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72a93eeb13187f33cf8b2d0865e081d3

SHA1
e36521b6fd50ae199c45d9556986eff252b0fba6

SHA256
bdd01d395ac54a3bdb7458534774d2a95387d96af804b85179294fab546e3050

SHA512
18ac180a942607bb52e3c56f4709e346165a893b8ec646929834488b028c1217cc03cdff50656552a3534bf06f74540dec9bf67c6e55ccf6c626ee2202e45a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7eee5e02c7ef2753c87e144b43acee6a

SHA1
1794c431946407a1089c17cd659500d6c80e5726

SHA256
ba46ba5100d4c38e78981606e38aeca5afd9fb46226972308fa0307d835cfa5f

SHA512
911f69f3c3b6bee1b1d8d97f84d1d804abe49b5b8fcadb0fbca6b1e985db4f131495a57bcb861077f3440e2366ddb96eff2fa6a9209f8b087f8eb10a3f5272ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d7640a092e1e13d0cf0b2945f20bdbdf

SHA1
370e187e7fcdcafa7f3f9dc20bac599be002a7f2

SHA256
f923c0bc353431ffa1a2f2ade9fc0f4c88569e26956799e520dfa59ff29638ff

SHA512
806c00d1540fcd50a62b8e93063554298103f1a7c2b43484414f465eee48cb5dd3316c9ea1da98997c6ade4efcdf7b9973b61afec0ef05175c8fa9b619e5b2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3685228650f09f1304d9ed801ffd00b1

SHA1
ea1c30a06b7ad402de525d9c74272fd9d4f81d78

SHA256
193b16e4a759be5b95a2e1a5bb99ed5cff65a666168d76ddd6ae387e9321b975

SHA512
fe0e3120fad0fb6966c76fba3c68da6d450bf2a20cf00cc75ec5117e7a78a78f7a58f41c37ffe04fb86f3ea23863add0977f77465bc89372a47c41a90c557feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ea390233689670f4c7550b31ab023891

SHA1
f91d90cac85e2e78985a0017dfe63fa7112a5c1d

SHA256
b9bee130054c98566cfc14a45edf0b680e66d8e8c7a6bc94c020aa8ea69b6608

SHA512
12adc9276379009cd61bfd0fd6285f1b2013abc42c584b735303cd9e784d354d4e340fe0bb5d21f4e14f3128294d397c4ce4f420f54b0807d7c1b3ee10edb0b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
bbbeff54213490896c5d29ee5a7137b6

SHA1
d00dbe3540e3857e18527d90cc68aaefaa8e3a14

SHA256
de19d76d9edaa239424e651c6fbfe570b8b55abed35e7687cd62027613726ca0

SHA512
a04685e37e66b0cc7c6f5e53cbb1271344cdae93be19ec20618fec893f989482178805b43a446b2e35e6bb512266dc2e6cbfb718c381049f2bab1a14106a78eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d0cb7de60520a7edeab4152f6c0dbf85

SHA1
38cd8ddffed46731431366444526b1c4b6a925f9

SHA256
4dded40a83fd327aa0206cf95cd1f2778563dd0bce0aba3f182412d25c5c24df

SHA512
894574e1b6782667b5fa01fb99ee830d58449d86306fdbc52f41a1c08c67da12b4dd9dc6334388087f24c81e54d5efe023182688d4f886234d31feaeefe6eb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
7ab08fa35f43d1a179f9ce3e7421ed6d

SHA1
ebb558fae2258f647865c289c9c389b9b143e463

SHA256
bbb6d2a2442d46cfa02d61633e23b9d2a3280c121523d206f36305dff3bba748

SHA512
366d3536d05768a3cfef71d63f452916718f6e5b5a4492cbc036ce943287f2eedbb98c8ae82f87d86c0df3547302316f851d419ce74e7df9714a1039204e724c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4bbbc65e5c3c4620c1c2b0936e229553

SHA1
9a50b6facc4ee38aa597b81972e4f77f3e2df257

SHA256
380957b2ec67b135ae33ff54fe0c51139aa730267173d519c4523db23f289d37

SHA512
4d736a8c37283a168185809940c2f7ab9e0d4fb5e8fab251214b36d0390126341bd09c8ac6b54d4ab827c919e51d09671eee984c676cbf3002e1f09624d89d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f20c8192aba51cde36d01e14229d2e8f

SHA1
5709d7f6401260a2237362fa257bc3f86f4072a3

SHA256
484ca87c35a4266b7fe7c632bbf63836a51756c62e1ae577b365a9a0eff6ed20

SHA512
f160bfe6d66fc67fd50d357fd6c4ea90b6d3c0bb5bcc2bcea1a3a5e25192ad9d5bc42bae40e61fd3874b35efe27a9fdc3bdc7c7f9916fbfb07ecb88f5808322e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59d45d.TMP

Filesize
370B

MD5
071330ab307aa4c7a5be9e24f958b798

SHA1
946ea1e16a37348ab741dd538ead2a5515f99b18

SHA256
0ac85313cfed04abbcc475bb48b5e2c281f3dc616b1b17cdd626bf7b5d1e8b37

SHA512
cf1ce2a6a35f56406e62e3b2e1a0446df835e69bec8d7a8c194f31268b0c5757c79e06eb442ebfe15de39a44bc82ee5faecd336f3b6e6039468b8612e2478dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05708af4c7886afe085ecf30c1de1ed9

SHA1
3bac8fc694593cd9c6d1461bb528afdbf6ddd2be

SHA256
fae3b8e08feed4747786a84e225c72e8caa300df0dcc86741cddfd8a255605a1

SHA512
6f4facc3841a6fa79e4ac0bc1650a51b6f75b0a40184bf2ac5889a88de94621b3f183da1dd5d1bd9021a1ec6f02c5963511d7b2291a6fbceebcd47bbb2fc1171

Download Submit