hxxps://cnd-discordapp-com-attachments-png[.]vercel[.]app/api/115032488403195089812009140610308505808jthWYF[.]pngex=65c7e960&hm=cb2e0fe2bf22fce7667694c8345607a008ce37de7eef62da7eed62da8e18dfe33520828f&

Analysis

max time kernel
34s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cnd-discordapp-com-attachments-png.vercel.app/api/115032488403195089812009140610308505808jthWYF.pngex=65c7e960&hm=cb2e0fe2bf22fce7667694c8345607a008ce37de7eef62da7eed62da8e18dfe33520828f&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "193"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
2392	msedge.exe
2392	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3520	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2144	2392	msedge.exe	85
PID 2392 wrote to memory of 2144	2392	msedge.exe	85
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 1392	2392	msedge.exe	86
PID 2392 wrote to memory of 4228	2392	msedge.exe	87
PID 2392 wrote to memory of 4228	2392	msedge.exe	87
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88
PID 2392 wrote to memory of 2340	2392	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cnd-discordapp-com-attachments-png.vercel.app/api/115032488403195089812009140610308505808jthWYF.pngex=65c7e960&hm=cb2e0fe2bf22fce7667694c8345607a008ce37de7eef62da7eed62da8e18dfe33520828f&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc72146f8,0x7ffcc7214708,0x7ffcc7214718
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5191946616458259808,6427794407544772059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3957055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ebc5355d27e2b0493a03994e0eeba320

SHA1
1c735a1a16417e46bbbfbd18be054263c928df43

SHA256
6571dbcdc9cca8efad9f2555fee3b52cf0c46bbdc5d9535bdb72de8965bc9be5

SHA512
33e8fe324c575c88b7fb5fa2579cda70ad1c654a7c7f9284b4f935e75fa5936f4133f981b660b506680b96b6da11752dfb35109bac4c25ead8a0ce8d46c91249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
559B

MD5
b93fa238854c454cd065eddd7d4c0566

SHA1
03b1a3ff9157cf527974f1ece2063016823e7373

SHA256
31b6e79efd2451f1ebb7d57e57a098270e631cfe7d8879dbaf36a477e8467563

SHA512
0d3a9b098a192c6e9bdc9074f528305e8bb0b092549b8b4bc44f2676e1aaf06385e5bc1669df66a6bae16b59a00f81dd9b49a9a9edac23525df72c309969df47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58178c1e6a1afc859e72859078e0f168

SHA1
b1409e3362d5af983f1965b352d55dabaaa928e8

SHA256
0c371297ced35346834b0901be0ac5a1180041720f94b582a9f5b30b357bd6cb

SHA512
b22f89440287ed64f9383db449c203440746cdb933ccee138ab71f356e7f69d550cdb0593075506d0d55f84edaa0e1bc261dcedcef3f884e48ce6b72ecf24b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32b840ef37b1b8cdfc35b166607dbf95

SHA1
a8cec079f2150e063d653cb8ef14e7f358ae3b4e

SHA256
50ffb8091dd3206c2311f151280d1c2fa2976b6be0b8d13ce0b10bba1ec37e26

SHA512
bcecaaf8556556ab74e582d8774923b111e1af418af77a014ace9e9e6b13c871b920a0b0013f746dc996b9a37f1c00d184a1ca6bdc92756e6220663fff772e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6066c23424cbdf24ee0de45bcb348658

SHA1
0d57fa962ee9e355dcca617df13ed5d9d0ee6344

SHA256
7b954d371a264db001c5b65871e52acd5eb862fa90a5d5abaefe33b3643d24ee

SHA512
3d97069fd52b6b94b8042e1d8fd0cd25ba1b5022aed0827245cd644ce2eaa907d5a12f26ce8594d48761f1d8fef0b3187495d0dc6998bc0572bc68c295c0f528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
c49c2e37af615cdcbf310e8b4a64cc11

SHA1
09eb30b79217259d2f0fc149ee97da85a984f6f0

SHA256
703c9930f9b3861fcbfba9161455827c3d525a17d70963c6570d6b4c9d48d194

SHA512
c04cd4ac957a0838100b1f06502353411ab0115b7229b2c4b2cb43f6162702b772da9ecb8ee107e79ccd600b1e02125c73c6251a27cd854d9039521c5b81b1f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e177.TMP

Filesize
201B

MD5
d0afffa7e28120e5f27d66aef7ca0196

SHA1
9f71ca7d251b39e59d56d1a666e774086a91e35a

SHA256
a73e335c1d38a896b40e18d4fcf81d8004592e4d25c408f0f77e0c6278d5122b

SHA512
7e379b6cf26007a3fb6d83cfa294864740c214468784512e0ba4ba35f34cd603af95222a91b9b013cb581b0d4fb9728896dbcb8eca7772469680f7ee4a76f9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6f751d9559262038f0b2beb9271054a

SHA1
59bfd222d74b9190330ebed3c5249bbcd36b15f2

SHA256
608911960f528a2606f35a5ac441e5de0ed5dc8b8502711d6fe336b26d7b64fd

SHA512
998fc2697ba4d3559ddf3c7a600e8eb0dd1b3a2d61ed49ad9f4349072090e324b0312949d22d036fd5ccc4f5e999a0602d41cb61d4eb7a1e9c556a4a3d950dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6507b1916d61a9963e8eb56d04d95ba3

SHA1
a9a4162840e1855e44f3590001f18c8f2d7cb9a8

SHA256
21e7399e3636077dbb420df6bd414d1210c9c98466822b86012d345d306f6b9f

SHA512
90bb074b8af7a2613679da28c3bb1a408acbb56e9ff866ccbb6fbd2f534196f27d80e461fe408b86bc545b18c15bd3d92e8017646947499d8f1d4c8ffc534737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d55ff1fd3c79d4a8987cf82f631c268d

SHA1
b0be1c92f22b5d93022342c11541406ed136f4c9

SHA256
38ae7ea13732925f720b6fefefd4958a87020113d1e83655898231de97183d54

SHA512
6bd70a4562ba4ccd10877e78c45350a1e1a197432371e38dbb293f75026f626defb6d563d42974d800d5d3d189b9db9e80e98c775d6f21c4a370e24b024c379c

Download Submit