hxxps://cdn[.]discordapp[.]com/attachments/1117437544540418059/1269178831877439569/s[.]bat?ex=66af1e65&is=66adcce5&hm=1cb7968e8beae137e9dd5ec67e0c6c5fe62940da88c3c7b29d3a05861662229b&

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1117437544540418059/1269178831877439569/s.bat?ex=66af1e65&is=66adcce5&hm=1cb7968e8beae137e9dd5ec67e0c6c5fe62940da88c3c7b29d3a05861662229b&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 880560.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
4300	msedge.exe
4300	msedge.exe
580	identity_helper.exe
580	identity_helper.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5060	4300	msedge.exe	80
PID 4300 wrote to memory of 5060	4300	msedge.exe	80
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 568	4300	msedge.exe	82
PID 4300 wrote to memory of 2176	4300	msedge.exe	83
PID 4300 wrote to memory of 2176	4300	msedge.exe	83
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84
PID 4300 wrote to memory of 2836	4300	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1117437544540418059/1269178831877439569/s.bat?ex=66af1e65&is=66adcce5&hm=1cb7968e8beae137e9dd5ec67e0c6c5fe62940da88c3c7b29d3a05861662229b&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa6533cb8,0x7ffaa6533cc8,0x7ffaa6533cd8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,16688908377153420151,15075816405926546702,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6092 /prefetch:2
  2⤵
  PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
256B

MD5
5c3eb131e25d5c24fe6a5574ce36463c

SHA1
ab9bcad034ebf1357d309865947585d9442027e4

SHA256
7d625ddb932016d5d016641a2c70e26042477840ea13a793fe52c890416f1417

SHA512
5eee06fcb159f28e6dc3f423a1177158dad6c411231aa011c84a36c82cf8537f78793463728d82df8fb5d26ef96d2b04dfcf2f226f3cb4963061a7e40df136f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1457df219793989bd5de2946e495637

SHA1
aa4a5ab6c0b335438349ec5d96fecc3275751734

SHA256
afa930aafcf557d2cb750ab8d1a62c75e3df335e493741bc0da5df2ce5c80f61

SHA512
519146245d8a650b61b5359b91bc225c61f774e825c3540dc09d0a0bee31673843c23e017337a2d45ea162c42d1439d6d674b91e4a61c31b92b5b4613bfc2d6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
101c7b951464207bc91a8b80a152fd27

SHA1
8173d8dd22473bd27771c58cea2fb4ef6fca41fc

SHA256
90f594e5c16793c0ee88fb403fc475adf141ac112b57d5e7ef7ec8547a0b2eb3

SHA512
dbfe81392ed505850a83719ac0f1b42f920cc74b9192cc123f8243a48f1a17a344683624dc9acf76fcedcdf08a2a3741b49396a9299d4e56667297ba6ae31e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b1c99ebc411c6cc7813353b91cb3808

SHA1
01d15a040712b9d1d150262d2edd5dea8692f9dc

SHA256
d89e0031f9091523957def3d2702139c46b2b0c35ff5d328596c125c17da208e

SHA512
0700391043a3edc90978ccc04657e652d871b42297a1329c2d17d676bf03629e03608c67a6204292fc5d188104526ac2c1055135c18790dad27971911f6472d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8645e21-d201-4d7f-bc7d-88ac8cfe9919.tmp

Filesize
5KB

MD5
97de2d8cc570524e729eff6917ec4972

SHA1
4a34f703cad2ebb45c6e99e72a5bac4f5d1e08f8

SHA256
e849e6aeddc5e810efd430335105a4ade42e20f93c7c14bdd22dd2aeb3298d2e

SHA512
eb6a1bb4a31f72c46987758e5712722d720836aab2e43575b69cd3627e942704fa6b599f48ba0f3841d8b487284504a35a2d2509a4b860b63258086723f406c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1fb3ab8212ac9b48b78adec2ec8857e

SHA1
98cb480b54c31c4c5e1035d5d2595d7f6254e72e

SHA256
6dc1ea2fd2a65bd5692baded61bbbb15c028c6a1c222b511b87215c91be910ec

SHA512
2cde53642090350b3cf42081cdf1f2ba9b0d0a0465dc5850e42766ff50923dc722d89a7a2cf888e246f1fbe65d5cfd5aed9d8318ea4ed375deae0d9816bec4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7ddde50c5fd640e822b329bdebc774f0

SHA1
20a11949b4318da306045d502a0dbb592b4a1de5

SHA256
ecb918583ab23ef12716f58220b32e7050bc771015c868770fbfeb9c07d9b6c3

SHA512
b10bda37b024e77254979d368135796606467edcf6e2970e46b221ebda42fc29afd3578240e026f5ad576e9c9157c150ffc5f80bf33a62465c197c96898face4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 880560.crdownload

Filesize
26B

MD5
7b7b12f673289d52b0b328be6272f614

SHA1
af039d49149a9899ef904210880e74462355c457

SHA256
459d7a09ee1bfe28c0053511781e7c7ba3567314d85196f5d64623ca866e7a4b

SHA512
bd11964bbbbe3fdd3ce41f3e38171c440a588136403b2c650ba33be4186be66f63aff8ba1766482de1dca26e7c72d3103beaa8edc3c43ee454dd7ae1fc3dae4e

Download Submit