hxxp://Discord[.]com/app

Analysis

max time kernel
1800s
max time network
1790s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Discord.com/app
Sample240606-mt4pfsdb2w

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
77	discord.com
8	discord.com
15	discord.com
76	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{68D4B5A7-BB63-415D-9C95-4DB255A221C5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1364	msedge.exe
1364	msedge.exe
3524	msedge.exe
3524	msedge.exe
3792	identity_helper.exe
3792	identity_helper.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3644	1364	msedge.exe	81
PID 1364 wrote to memory of 3644	1364	msedge.exe	81
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1172	1364	msedge.exe	83
PID 1364 wrote to memory of 1376	1364	msedge.exe	84
PID 1364 wrote to memory of 1376	1364	msedge.exe	84
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85
PID 1364 wrote to memory of 2836	1364	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Discord.com/app
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f56546f8,0x7ff8f5654708,0x7ff8f5654718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1746090104629970068,14492111201083215699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x378 0x50c
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c085fa915f8ff1488400b3fdb95c6c19f7cdeb9eff1b958b5d4f9b033ac44e50
MD5 cb6fc337b665a1f8e5345c2e1785f693
SHA1 9525d53c92c2c673b5b666a428ff257d36cb84de
SHA512 5415bb488f0af1da442a76026de980b1b5d9f480c7f319e601f440bc2b618726bcb10107f501a4b6f4d54c559a925b9033b0641ae43fce4487a414bb2665eb2b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 179B
SHA256 8f8c6061b94669fcf151b9f8f1c979a33ad38d597be893f375bff44ad1b3556d
MD5 c88a3bc77002a075b95198522f195432
SHA1 dd6ff073c9b7fa86d1a461013165a7251443e777
SHA512 e3facaf13afeab1a90a5c15f31288611e7af177fed3e4474aefee3560c5e1129579ea74857f5a3845b8f04c117e6c5af45c87df5d0b003e1259d918b7b0dff1f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cc1b7ce84fdb8e5308374e7a0c32df388e70327b7a8fe3e732f10aa2ae679d2a
MD5 36a27198430c220350ee365f2d1c5370
SHA1 9580f9eca5600c399fb8fcea28bb82bb79af3aec
SHA512 54c631599e89e807409f7cba89c8ec08ee38c633bade6f91a88798025525f27c5269fcb6ad8c8cb483044ce4dcde4f003a34f4d0f99b8a6921852751ff916229
SSDEEP 96:n9kQ11O73XwpvWMoiVmdeHp1kZU7QUWQyV+VDCziEwb:n9kkYzXGWMXpQ4Qro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 145b63bce1d1c596a7e5123dc5c424f03a1feec090e727daa2d308926b9f6dd4
MD5 09870555574d5f150ff0638b8d1f69a0
SHA1 d8fadab61ca75bb1c7e8d0ff2766d0b51ce4aced
SHA512 3a12dd04443ccf38981fb147bb75d50e7371487f7bc9c04c1baa3f79e36f4855e97e01de9e56a48cde8d06627d2e736bed2122fd68665e26440e994ad244256a
SSDEEP 96:n9kSL11O73XwpvWMoiVmde2uF1jp1kZU7QUWQyV+VD7AiEwb:n9kShYzXGWMmuFhpM4Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 783001de676b4768e22ecc19ccc16445ab030cab941ae0124d27a2fa12e2d16f
MD5 e4e46875a8ea446305405dde2da5bf3e
SHA1 b5fa9f13c1a2ca34e5b43d9e70a2772193508485
SHA512 72454887dab55cb25d0ed63fc8aa4ea6990af813fd5683a054e0f5104cec4666678aba865449217981d32bb67920df729feb4facbc729b598095fb33d8b61b42
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 58cad4a419588db18d4ce0756e328ccaed96ca9fd9708855559f8c29bca868fd
MD5 76e6c9d4a3904f8d1ba3ce1ab6d53bc4
SHA1 ada23b07785d20945cccc06c147736192e60f632
SHA512 6ddf07c20f501aac0596b49f4176585dcb03f874f6dbec3ffa23aaca43e3940d8473fd93466084124329f9edf52ea0e54fd70ca1a73ff3a444396682efc53689
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 fc2ee218ca1bb80f0f34e928c2b47e9214e768a25af99c64db9757c03e57bdb7
MD5 1bb9c1fdaf981396312410285975a122
SHA1 6145c9dfb33864848eb174e85d8bd24c3a5b4f5a
SHA512 0149601414601b2107e3a0a5cea95d9cd39e54c3f51a314e7853d7c4430907535866fd2ef0a1b78f4fe7d3ab552a03c21c2bb5b635110a823a7f53b080b43cb9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 53be04db2ec9a7988473168ef1ebdda4decf1391c97dbf4c2270fafeac817577
MD5 da57960dcbb89de7cd953a23eb36c66b
SHA1 d20946e67b25acd6a0001fddcf4b7d9581bf13a0
SHA512 e5877ee3cefb4e48796f70a7e2ac947429970c3541beaa1be57f531381fd70214623c8c35994facffae2bcb350c384e2143fcd3dfb22b6a14d440c47cdb58594
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 499fd90330c63fb06c3f0d1e6f29a781a1a655146aac4ce712f023713cffd06a
MD5 91f7fe04e6f6b9b7084d0f3d28284c68
SHA1 845bad685422516dcf4aaafdbaf24c76a68f7b78
SHA512 3a248829707eb6cd2f138634ce9096b88c0da55e8e85cd05ecd39fbe1993944917fa96870cc2c390bc8d35b21925c0fa743c10265f87d7d192c7d8e74b9d6c67
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 5147f2255aa1d57005cf100687c740accbcdac25bde50efdb55ef153d5f85225
MD5 a9d3a6cc59c3235a842fe713eb722dde
SHA1 53f68049c749639bd6b5c02c9408599031ab6942
SHA512 1df696c01540e6a14931c501da8bf9ab526f0e65f0144ab5a744541c9adb2068c7f380a02b0eba0ee7a02d90b67928474c23ed817b9bd34638850d5ca6e2b761
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 cf268763e102e1945ecee1064c45f6c7416e4f76e5c77645946d083fd59a09fe
MD5 684904f951f641de189aa45ee4aeb76d
SHA1 8a5b9b5a4b98a698e8d8d8454fdd58668a0fff13
SHA512 37a602b70c6763bb8f0823b446e48dab82df25def0edc42b32681d1afb0fcda5f55b962774a35bd789807e6413aafff9f1a084afdb8a64bdec038ea46a45fca7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588dd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588dd4.TMP
Size 370B
SHA256 3bec7328f37db0b3f29b0067c1db6a88ee130ce22887e2ade2ce7be5e1ab3b3b
MD5 66784f9affce9ab176fe30cc2472dd8e
SHA1 7ce0ad893274a4e32faa9a88a6830fda32054a53
SHA512 d2a51d6aa0bdcec1ed47db2fd4ccfb79f4e57d4c591774e8b24a53ae5d1410edd87a84c6a9958b04428ac81536c2c0c28ff5ad94de67ec6b9ab045985fe15b75
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e818447a47ffe6d51202141df7b7cc9849678ad6b318a4bf02e6b1f083e2c82b
MD5 ef30eb3aa3de13fe0e4bb63215c31732
SHA1 e740dc6a967d2962c080368b1ba5e194db96717d
SHA512 541de018c09ae70c75ed6fa461d751f07f401241fa8a8908bd3c5840b00a1ce6154bd81763d176e8121b6fba759f4003c563587ba88b5106f9db82c9849a8bd2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmxB7ne2RU8o5E3z2OMDCRs:A9iIxuERzA83h09RZxYmxBjuEaOMWRHM
MD5 SHA1 SHA512 SSDEEP

Submit Download