hxxp://www[.]discord[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.discord.com

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 discord.com
9 discord.com

flow	ioc
2	discord.com
9	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{35F1FD45-4D18-43B5-8003-DC4F24AFF411}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
3556	msedge.exe
3556	msedge.exe
3380	msedge.exe
3380	msedge.exe
2356	identity_helper.exe
2356	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2904	msedge.exe
2904	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3380 wrote to memory of 3884	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 3884	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 4336	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 3556	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 3556	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 1812	3380	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.discord.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe6bc53cb8,0x7ffe6bc53cc8,0x7ffe6bc53cd8
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
2⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3156 /prefetch:8
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4684 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
2⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
2⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
2⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,15353997325724067159,10617432013467113010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3416 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5757be1d1dda8dfec4d635c473d6c672

SHA1
c572762d581847955a159c6b1003b1a85053af7c

SHA256
83955494c69ae3e0cf7337c5f0613ddb16a2059da300d7f4695a97b6a42ca65c

SHA512
5d2380e399f7cd510f047bfb9be2d60bb1c262e0b03a4880bbe342ec6b79a3e735b002f3e86b67333fde56a2d688e6614e3c5414078c9cc6f4f5823bd4cc8db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
17fbec00b8033028bb91b9dd39d74716

SHA1
cba3f20c2e379433d0831c8c87d98ab071bfb83e

SHA256
8b35860cd9b85a56deb8eee9ab6106f9286a2b3de0bcf7175fcd0cf0aa035e07

SHA512
4ffc91ad2d0e6d52de5fd3ed54cea18cd99d43a83bda5eb14911bc38849b6edc11c8ea1762ddce18015635f97a9142d2029d34e01820ca0b25dee63cf2884170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
870c01cd8cb558d8cf33c8d048696db1

SHA1
16eab0a53f3360d95678290379588fd523604183

SHA256
c723746bf3fa0eb419303a7ce958c289dcf47299f39c04e810a0b13d8cc05df3

SHA512
c88425d1f702b39388d9791e3fac460a2b589e14b43a71322c95913341ac09b4d5f2192dcb31840ee63b0ee021bbf29629dd7c6fa3a485cf88acd6206a38c7e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2f32dd706439248a48cd8c567c3ab2d5

SHA1
02748369f19baaef030c99e784d3d9e72861f25d

SHA256
dde52dd8b3e8b0e06e337730fd5e3f2ab669442c767861695ffbbc1a49336883

SHA512
c1cfb1f06347a2f6bed41dd1027573c0dbe9babe49b8f534e6ee49661dcebee66becfc56b361e6e0057e1c1588d53c7cd38b49fbbdda4cc18a3e9f99e1a9f349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95ec86e4ab1569151229da1f03f7235c

SHA1
6361e04ed1bdd04f2b33684168f79d04bb32f492

SHA256
e5c1fa36b88fa8a5bddedaa5a5f67a94f4f71095b42e639277ac7050fcd1b3d5

SHA512
28bf68c423ab41fd90f6b66b5190595d75f689a2d42c0a3d00abdbe6422d8adb11b660f045f3bee1e8f86d66db684b9673939023292c2b680ff8b70aea13adfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3968224b5afba2abd2d8de80714a880d

SHA1
4c9b446c6f38dc0037218a8e8967361c45fc5e87

SHA256
1bdc6e99f4c1a9c15ceee63e949993a42afcf270c0174e4e12ff366ed8d189a8

SHA512
faba79b1cfff13a352fde836739d7ce22dbd4f032dc6599796dde1b64beb87211db11f177db4323ed350f3441792076154ecfe618c362e1ffb0daf3d7e5e0042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
03a2f97f0e0823c462bd7269a335cd8a

SHA1
aa5755168960180cdb5195136e690cae76615b52

SHA256
54da220e61de955b011f5881117ee7f76ae41c78eb93a05dbcd98fb1235f2b7f

SHA512
5b42bcc194c5804ab3291d294df838ddb2e33eadc19b97f8b1b6688e9e8bafef2b8dff90c3bf24fe7c3f63873a03c5f510f4fdfe6893c269ba646c8b1d3270d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af09aab577da830e3d2c2fe24398cc1d

SHA1
a631b3e3cc9733bbbbe10ed684088672179b1974

SHA256
e9837235762d8e47e10a9966709f01a3f10ef86beef3a4390a9036087a2144f5

SHA512
a30d8c10fd4556ad3debf1fd47ef769525c6840666ff7d6f81730719d434bad5b0088848bc281d8b59b0121bcf36181cee032c9aa09831904f26a4d923f73474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6fb730ea3357d7debd596412f778b79

SHA1
cbc35a2e340a11480a8f82e04e9431742115167c

SHA256
7f1a4e201501634a9efc109ecf7bbe6d275fe81c04e33aee5538fbd24161fa43

SHA512
4576a629ea291bf1822fb2782138169f476e1ec8e71d39de42976e8c38dd451b26eac11ccc2c7a16c233ea4a0d33e582e0df33e65b4485f37e7c07fa49cd1fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70cd06b8bf8a00c337a753de168d8ced

SHA1
d4389a32a2d265b1db8d187e2dd666789d78de60

SHA256
9763eb5ab5187043872dba386a564244f4dec3083d03823fe5c0136ef6c22a8e

SHA512
67bc0604119bfb6217453da13bea00029cdf9ae72a8f5dec1d5ed90e31aa486fac249575ffc53d206590d3faa7bbf8bbe566df694a83c624a1a2f615f327c776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a63e.TMP

Filesize
1KB

MD5
81400157d9f7105839deaafbb01ffed2

SHA1
543775f38fba74e050c02f5ef20da2c18ab0d85e

SHA256
bd070a0a984b0322b3e8cbe44dfcd61d260b356a1630968aa4590cce027edada

SHA512
4cc2be84179aba6bcfd75b08ac6f914794ec7e90b27400f6d82aed420b70986c743f27a768929e549980789a1042078318eba3bc75c45a43301f0b67729fdbcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9178bd138b3d6bbb7c41310723ee3602

SHA1
1969130d5a42bd53ef0e0062708b05101d9e80af

SHA256
3e2bfc95cccac222dedf66fb8a8859c31767fd398d01b408ef2b30531b922b7d

SHA512
c862ab2528067500b943c9b24e08dcd4e080ff28f3d30764dce5b970ddb55cbb0c3c62a2be7e87ca644f8b2452f76fac6077697eb9e4462d769dc24da538bcc2

Download Submit
\??\pipe\LOCAL\crashpad_3380_OTYTJRGMNNEMKPQN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit