hxxps://www[.]alienwarearena[.]com/ucf/show/2170237/boards/contest-and-giveaways-global/one-month-of-discord-nitro-exclusive-key-giveaway

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.alienwarearena.com/ucf/show/2170237/boards/contest-and-giveaways-global/one-month-of-discord-nitro-exclusive-key-giveaway

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
3900	msedge.exe
3900	msedge.exe
4996	identity_helper.exe
4996	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4296	3900	msedge.exe	84
PID 3900 wrote to memory of 4296	3900	msedge.exe	84
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 396	3900	msedge.exe	85
PID 3900 wrote to memory of 2396	3900	msedge.exe	86
PID 3900 wrote to memory of 2396	3900	msedge.exe	86
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87
PID 3900 wrote to memory of 3352	3900	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.alienwarearena.com/ucf/show/2170237/boards/contest-and-giveaways-global/one-month-of-discord-nitro-exclusive-key-giveaway
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa21cb46f8,0x7ffa21cb4708,0x7ffa21cb4718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13869967744950015566,17434386604290387215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\964c61f6-21d4-4652-bab1-4d12fc018833.tmp

Filesize
4KB

MD5
e0ef91609b85564ecb3daa9d3c1e5b0d

SHA1
5fdca3ac084833718f92c336595daad59103d166

SHA256
1d96039730ff04afe10a01652dbac0ebdf062aa3a1d56f05b26e32ec5b31bd70

SHA512
1412678ff55fbe0135020570a3939459a14ae3ed5e204527844971375238207d0207c9c91b082f2544d4514bf318369612e1c6fadb67c632e7d60de7ae43189e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b251cb8affb2cc093033ef9c10dd97b7

SHA1
7fe39058056374d1db281eb51ad7eadf7c2bb961

SHA256
e2b1c4b7b37cc4d520411c8cea96319a56aa76cbf72efe4168a8b449eec58935

SHA512
1d487a8954190331db39024e8f69cfbc0fe5ff4e9b4bd3894d96134f6af73ebd7a960541e3b3ab4f80fc35b08089a1162dba1077b2ee2991bf41eab678d680b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b7c5b8c9b5bdc13db5b52497115efcb0

SHA1
b3ac3b2a0a52b659b0841a20418eff9209740ede

SHA256
793d07260cb93e6159b7c2da2382663f75dede013dd01b8035909c9ad4f4229e

SHA512
84016f67dbbb4eb26f5356687262d584e0fa7a5cbc1fc1684ae8ac84a662a9f556fcfa08f9f60d2cfeb6e49fe2fd3781ddea81a297f9c34d7de5b8ec4d1ec2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a70f306ba04d902dbee36de49641c312

SHA1
20899215560e579f0c521aec7e363e8413791e14

SHA256
dcba9c0cb44277ad4cc26183e8ce06e37b2859b6de9ba011a8e37305c11080d4

SHA512
a4bf499fb09ff9c0811c1c4a049d09fe0b5bd51a8f659f7893c7f8ea79dec6448c19537f050770065c8d46929b893529d7c4b360437af313f2071fd35769b594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dc55d7f0d5447b42097ea17b31edc3b

SHA1
35814da3ffaca600e5c3ac73831bfff40e82e2bb

SHA256
eff7aee7995a60ce967ce25f61b11842575b6ea0f1a38cdd5bc2423ff58850de

SHA512
e643f5200ead11be8fc56907eb12d58a2556c9a81165f7862099bb6ebcfd914fbd70120f6b61de7388ecb1ad4f5350301bee75e4f32f793d556aa545b6a77df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bcfc0ae9694b8ffbb41a2eee7ad8f2f4

SHA1
2c63a27e83196218e62966de2310f0db80808062

SHA256
4a6eaf34332758d3d088bc4ca6220355a69aae2e314cb6f9dbebc5f0ce1603e0

SHA512
68cc82111eea56818a5b26ae907e6b735e9f63414aaa24077d336d8a661ae2990577020920a765dcb881e7016248f108b9a41d566cd1f107c2c3fd3818dae9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85abb50987d0728f5f554c5eeb5f4518

SHA1
ac651117e00ba253f60f7738b06722ce6f996105

SHA256
36c0c11f1bbf991f85b05403c0f687e3b020f3342eae3d0c506391bdf67f14f1

SHA512
c4b974dd558bc1e1aa6321d2894f7dbba4f992dcd93b0a53c807fda56a2a00e147b79da16dbe4c9cddc93f54b395507a8018bb38544bd0171c80d8f90bcf6e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02a625b32079b42068ddb31d27d82a99

SHA1
f0d85e272abcffe7f9cba1066fcc7da5283d60ff

SHA256
c4b2dd6c7924aec2a656c6d76a6ea2780d8097eafa2d0a1e8db85138b5bc7a29

SHA512
5a48dfad8b8fd3632fc66d320225ba70edb8f05c6b237481831a77898454a0f9c1a1b15b0dc4cf1ae7af28177fd288879fe26aab0c40311dde00f2f8116a0c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5791a1.TMP

Filesize
1KB

MD5
cdec40bd4c25f8a603697f6432ed310d

SHA1
e6d027984f5bd37b04d1c8cfadf2e3da5fc4c4fd

SHA256
024d324921d91458179565556c111171c3403ad64b9043dbd064babfdd725ce5

SHA512
d82ddf9b8777148f0e3284d20f3318ff7a6c9eedbd2fae50d90a291f51f720edf334eaf6a7f63481c4ca08a72664ed722b0d13b9f2c2b0282775bc360ad8c389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3dc0fe3aed267c82f505628a3bf2ea58

SHA1
b3f85d436e84f3f0c523722b938eeef3ad3f1f01

SHA256
5463e880d4d8575a4c107f6d72caa0014208ea084773ca60fbf03853c062fc77

SHA512
cfa25016569fd83b46785796472fec59e5e440d0bfc2c2033bdd4d7f821d326e06ed6db81155a34e348e1493f15f84e5b2008da0b44d9d77dd0117e05201cb46

Download Submit