hxxps://discord[.]com/channels/@me/1276721192165834784/1276724256201375845

Analysis

max time kernel
1735s
max time network
1768s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.com/channels/@me/1276721192165834784/1276724256201375845

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272559161-3282441186-401869126-1000\{74A2C53B-EFE3-403B-BA70-83382198CBF9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
3772	msedge.exe
3772	msedge.exe
4372	msedge.exe
4372	msedge.exe
4472	msedge.exe
4472	msedge.exe
2880	identity_helper.exe
2880	identity_helper.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4088	3772	msedge.exe	81
PID 3772 wrote to memory of 4088	3772	msedge.exe	81
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 2424	3772	msedge.exe	82
PID 3772 wrote to memory of 1372	3772	msedge.exe	83
PID 3772 wrote to memory of 1372	3772	msedge.exe	83
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84
PID 3772 wrote to memory of 476	3772	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/@me/1276721192165834784/1276724256201375845
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa643f3cb8,0x7ffa643f3cc8,0x7ffa643f3cd8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15973595937240601500,17683856650644472848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
6dc8109ca70d608328bfb809216f12be

SHA1
33de94cd6b43958a1f36d184f3f4a796e10391af

SHA256
900da5452b27ef16bc17fcfbe7e34cf1682379f1826461489f6645c308b3cedb

SHA512
8be4e37ac8dc41c997027f4f6cd1cddc1233c32c2568dca7545390020b043bbd8cb4f26d583b96a702e4ddad7593208553c62a21c2748daeed206ff98cec7b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
c88a3bc77002a075b95198522f195432

SHA1
dd6ff073c9b7fa86d1a461013165a7251443e777

SHA256
8f8c6061b94669fcf151b9f8f1c979a33ad38d597be893f375bff44ad1b3556d

SHA512
e3facaf13afeab1a90a5c15f31288611e7af177fed3e4474aefee3560c5e1129579ea74857f5a3845b8f04c117e6c5af45c87df5d0b003e1259d918b7b0dff1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72cc4961b5637804ef391d2e6977cf8a

SHA1
32d9518756e627c5b2a451cbe30bd16842bf3782

SHA256
5c79b40b5895dec35bc90531099393160825b87448943c2d057526221533e9ad

SHA512
2e23fdbbf9e39ed6c03191038c32876fc53af1120cdd4f2216191ba4bcb4769d47cdf19709add5de2c8b635a1e09a2b3d7533a9e60aeaebe57587e79ab313e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a877408c47dfcad0ed176ed97aa0e7b

SHA1
2c0ab2f1e24b7016d2c6bc69f4624fb3b3218e55

SHA256
a002c2fe1bdb8bd63c2bc4c32efb774483319c8bde19dede6e73508f4054bcde

SHA512
af7225b4f6346297d4326b33770880d808c4c80031027159084d75bf4bec6dc067b2b979847aa721ae15bc063a28def17bf1efb66851a3de46ded3d928b4ff12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c51f8617fd6476b0f2439796d304a8d6

SHA1
b8c44e6daf0b257df8986d7a2ed6b70451119095

SHA256
340647ff8a919684bd4b55263ef41ba3850c970fa515b827c1e2b9f86d3c7d28

SHA512
c040c809d8aa446141b0f0f5a48245c491178f6171ae02150956b0b7791a01b0d520ca65f8f4ed75333c5c4faf0243efdf4fb9ab3046015c750f63fcf5f8a913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
6fdc03d5702ce4445cc8bab4c9b4d9b3

SHA1
4a05838afe83176fbe790469a7fec86de05dfbd5

SHA256
cb6f23f10f870366234cd6d5804025725a3df27923ee3617d704793479203a15

SHA512
8e5ba5b9999d74e941a224859633e56b47a75643f365b22cf776ec8783cfa35b763809a9985eb3ff0dc5ea74f1f467a32e6998bd932f613951b98f0ef8efdcab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
16c2b43f9ad3f6da293225cf0ae1e0a4

SHA1
4ed58a1f77f52f11b6eec452e291c3fa9f64b314

SHA256
157f0757d02b5d4e7d4d60ebd693e665c8fd1d41f8053ad36c742b24846ee49a

SHA512
adcaffb7617444cf365405bdab5085aff8690b78797c23c599032f4015b7c45d135f8d1ab684b0424b1d2f69b67f76b1acf934fbde55c28004ba98a7ee7ed1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
363ac1b4260ef4aad65b3e578900d477

SHA1
ee86d9c6c9bcbc296dee195190ea49d4fc6f234b

SHA256
875eb3bc0fc982afb002aa84ec5a519bdde3a449b2645776bea8e49a81952d3c

SHA512
ec7415cde254be734379d9f3cd55e2c2941b48deb3c1aa5aee8ce28cd3d5b0e5e15d486ee07761bd655a589bff574bfc33d5a22507752fc348f93d82a7346c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2b170888b2831e9d813d3103c74a7967

SHA1
61c1ca0d97dfbd9293d03ed87061e8e5aafff294

SHA256
470f5c19f1476ebdceb31e7d70918872a7e06cefaf48f466584a176c171d172c

SHA512
33f50ab37c909f6f5126801ada36b4ae001c6592464f70facf177f3576ca4bbf8ac756725b47b96826e8d54b9b22fba2dd726947a1a10ad5a145c1bd00aa0f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d6b8e.TMP

Filesize
370B

MD5
4854fe84bfc8d80c0dea93df0b7395db

SHA1
98020fbfc72d90c5dfe6e5543a1226c2bcb1d0b6

SHA256
9a4a9452962471b9e5ee8206fbe6140190a4403cdbd82a83772d00c6db159b7a

SHA512
609c257fe9b10af756b8661e9f1a21365af45d129c8971061f123bc8f6ee5c888c3d9f04b9116fee6473b1bac4e806df4ec332a5ff3cd804eee2d99800dcd469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
007eb4daba19fc98a45232992d3af98c

SHA1
46c379feedccc60764f5f8b1dd699fe084bc8a1b

SHA256
df9ff977d4af48bddd8144386c0723e8223606be4878738b75e1a3ddcf2f3e71

SHA512
ca454757c38ff739c800edfe4636bf69bff0c997bb54851d953dc360c41b3592008c3da83a1587f5a195a31ac909955bab9840df2a8199051501661442da44d4

Download Submit