hxxps://discord[.]com/login

Analysis

max time kernel
1683s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/login

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	discord.com
10	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{DC1F037C-3649-4BC8-924C-BB33487CCD7B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
4248	msedge.exe
4248	msedge.exe
2092	msedge.exe
2092	msedge.exe
4548	identity_helper.exe
4548	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1076	4248	msedge.exe	82
PID 4248 wrote to memory of 1076	4248	msedge.exe	82
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1968	4248	msedge.exe	83
PID 4248 wrote to memory of 1468	4248	msedge.exe	84
PID 4248 wrote to memory of 1468	4248	msedge.exe	84
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85
PID 4248 wrote to memory of 3352	4248	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e014718
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,16837181817095603165,15779537257638630190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
6b69e5fb62b461845aeb6dab9a8630d9

SHA1
4db344f0352e159d0c080439f687dffe2005a952

SHA256
6563425b896b16e87f2d4451c9a97d7144d862bb496aece090e5d25c6ba44faa

SHA512
03cb64763d2b062d799602f4f52f6b484c5512794353d547e9c27e6222cea1c52f6096b439f172aba45f32e6574f96b115774ed77479b7e83f105d290103720b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
c88a3bc77002a075b95198522f195432

SHA1
dd6ff073c9b7fa86d1a461013165a7251443e777

SHA256
8f8c6061b94669fcf151b9f8f1c979a33ad38d597be893f375bff44ad1b3556d

SHA512
e3facaf13afeab1a90a5c15f31288611e7af177fed3e4474aefee3560c5e1129579ea74857f5a3845b8f04c117e6c5af45c87df5d0b003e1259d918b7b0dff1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a420f192917807ccc21f81203e087121

SHA1
dc9cb2b5301b8262068008c8fa91c60ec8546296

SHA256
e23d672880adfc98519fd3d12a9cbc9a065cf9414b9c63fd05f3dbc24ff36b0f

SHA512
03f84c9c9b2e053621e031718b78509d3f52be181de19d0b56665f014de84f360a286d0acd9122500233244ba5b50257631715818c3c681651351ac1f150652c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1cb5ffe4027cb659a240c4ac9dd6a7c

SHA1
53a9f992685e4faf99087a97cf327cc57ec41dc0

SHA256
19f8551aee555d69bb087c59e77f8abf009075102bd65b81a42f7a84bbc8526c

SHA512
f3110d3ebc9d3e9ea295ea6172d6c9eaf4b5e79e9de21498bf13328afc36b402bb00aab8b385ec07ef55efbc5d014ddccb876cc11bd7d59f171d1c2350d81d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
647384854155c6a0408df495415b7bf9

SHA1
f39bfeaec56bf741f9b1c7d8f83cbbf2b1e843bc

SHA256
240b2d552cbcd73108eae328df45d4e1b7bdb0b3c3d9e8086e44d7aaff8e584a

SHA512
193ae9578e1b7ec718e8fbc82c3dd4ce12b055f3e9f13dd2983d45c4d1684f6ddbdc4056453aa66a8ba28ee2026532631e8233fce7b3bd85f918e57349493d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2bb3d037ff9296c4b5d545aa2d5139a0

SHA1
a29b47417c4d42fcb1658a6d4ef6f76ca9606953

SHA256
fdf25c650087b8e24efd4cbb073854027da4e5e0cd38a739cdb00073fc9d61ec

SHA512
4109d8a73c7be034296e8a7707bf7842ea3597bcb98a20eec5ddd3307fdae202a1232ba3b580a33bb8c3ae468945f58199a5d9bc7333fb4e652ff5a858e6e5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0fa0740a7aeefc86a5347365a940a564

SHA1
39f8cec2733e1b5aad9e934d352fc903d412b517

SHA256
cde7421022cc870e487a6c63cb62ba2bce5efa37c02d9e9de4dc64593cbf60e6

SHA512
3b88cae7acc19356b2d57ed9770787f9f1cb5566a9c2c6e5e4c1473007a8a22ea7575f133e37017fa24ecbe1b3c2afe6efb8081ccbdb80ea27f229427741a413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
dffac4b7ce35ca376e79f95a8b694138

SHA1
5d94f237d9488fe2382c707a811bc4c7cf32c0f4

SHA256
80a3436f4519224e0a33559829996a0bb4fcf8c7afe8063ede6cf787278b1d39

SHA512
14839ac902234237e87e5c70a2bc1d45c4c6c08051394a958e908ba59650e8ed53f01c012348b2094b3ebfa18a14ee54d72c750f7c45fc621d2f1bb973490f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ae0442724eba8659d141c8751df291fe

SHA1
e5d4d43b1c1a7f9b9a6ff2332fe1ff08e6da0b63

SHA256
a0285eff50f9314b04f2b10fac744f36a776ebf6664ecb7faf57cf07adadd769

SHA512
b39afb8ab943ab8e4aa0444bb4f73f294a3d3ab6a36a4c748dacfb10ec10ec8a1b6c155a6ba05dcdb36314ad18583ec518b812c044aafbb72b48018167d9fde0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b37e5.TMP

Filesize
370B

MD5
1a1cde67cbb04598e3947182941f0d3a

SHA1
9a1a84ad500f647859c0a7d4ae47af77955a0792

SHA256
4c2dec5da7ffea6716e3816cdf511de9108fead79dbcb6803bf6c8851b91a886

SHA512
6051fed4b5ffb66726ac9cd46266cb36f5bf670e85113fed775b4d59b35a7f6b1076c83becc0c90fb4bec7fdcb2069e69867567cb29144ab36b582a6045a4383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63ded06f9f903574d75c732923cabe2b

SHA1
31a2e5fe2d8006d21d7939698c822992bcb4639e

SHA256
0c13e02066f400b5eaf28bba0ed63999673e4396bddde76a406999126ce31f1b

SHA512
eb80e4817ced3cb504cf2c821bd9aee9cff5ece265bc9866efbe2fde823efe238891094a4131967c865ab8f8eb3ae5dd7af47d20cee5b1c160e6049a4ff5627f

Download Submit