hxxp://discord[.]com

Analysis

max time kernel
1040s
max time network
1043s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	discord.com
11	discord.com
142	discord.com
143	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{7BA93D34-7427-484D-A83E-94621CF1ABE0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
3216	msedge.exe
3216	msedge.exe
3956	msedge.exe
3956	msedge.exe
1048	identity_helper.exe
1048	identity_helper.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1488	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4292	3216	msedge.exe	83
PID 3216 wrote to memory of 4292	3216	msedge.exe	83
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	84
PID 3216 wrote to memory of 4636	3216	msedge.exe	85
PID 3216 wrote to memory of 4636	3216	msedge.exe	85
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86
PID 3216 wrote to memory of 1128	3216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3009584355580252101,2962656106759492544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9b571741147900773261bb413fbb1a4d

SHA1
ddf8c2293cd4b986f1ca3aabee30610ac1034e96

SHA256
ea3454e697e04473e33dba3c1bf4335c970bdfcfbd97c556c044b4f194359b42

SHA512
0e8d33020f066ec8e917386cd789b04b5454aefbdd2686c84fadf00bda8fed32f69c3e09889dff9c55eb029b5988441854ca6fdab6a9bea6ae966cabc44808b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ece51e30bcf3ef90c9d57d2f2a19339c

SHA1
05c207f66cf18548e78a011589e8d8cf487117e1

SHA256
b81599a1c30db0bf74dec1e713fbf3f3cc9c63474bf552c923b9cd68623825d8

SHA512
afb995dc3ff012d84bc3de6db01351a96d95373c11b8b141e73169b879274fa58a062efcb0730c4cddfc0f3435fa5352c1f47dac1ae2245775b524dcb6123ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bef5803bfda0c7bfd39974728bc33848

SHA1
6414aa94aa07837ed70d52da0d39ba14c59984cf

SHA256
5368362e0bb650a744e24ece12922a177968621f87e689eeca18101ef65b24bb

SHA512
bdb0e3ce1214f7a295e4821f575574325391511e9c7e7cf9db23c16902c1b9ded17f2f36e0e3045567f973321483a9e52e3ecaf6519d1cb041d88de043a2b09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
17b18d8ad38f1a62413d7f8774f03311

SHA1
0c1e56be8ab1c820651756881a812ea9b0b1c85c

SHA256
9d13869480063916897d4a911ca1138f18b522408cf1d5d377f678ec6d4e19c4

SHA512
a825227df78b3023ca98787c9527060944ff78ffb424d91803a278e2eacf374e206e01115d1c4c5eb7f8a1fdc15157b79f5ae1e677d5f91f3b3e65a99a9ae66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed7568be9c1020ae6735d3acd712266a

SHA1
7429730fa216936d7d4b5b1a14b06ebf00c1f17e

SHA256
ad5212c6da31a637b75019527a4201b7ed7203aca5ed5c4895e7da981ab5f9b7

SHA512
0259a7dcd04903d15dbd13a421c1616ed0c3a0dd26aaa0797f3cf78d800ab5ac46dc015bccaa7fdc15398001210f86b568685d5a0849a90a0671f3f3266fb911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f34a2d58dabed996e96b002246a67a5

SHA1
5ad33c483b8c6fb343f08b2919214d759ada05f5

SHA256
2ded883c421c5ab5fd60bb23ed3993c6a366560d69a43531153948ed2e11313e

SHA512
b16eba823e9eac6b06e885275574fba578a27efa79bcb24cc83f43d1b34a94a20b99fba3ec968f791b93ca2125037cddd49ede690ba0023d783d3a6c8230beca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc9a2088bdb1ad0ef2c2d0b1f752ce7d

SHA1
4179b5c5229fe6556489adeac5c4523884e5a90d

SHA256
868656569eddf3ecdc2024de78059e6cfd34e38e86577c4dcf9f2cf5b8169001

SHA512
0b757261161c431ed298232a4d17f3e1e74f347d050d3ef3c4d89c876597be63b68eba8d26fcd6046204b29c25b11c3ee9cbe9ee31bffa98e12c8bb151c5968d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84474cd0d25ee97cd9cd0b4403fed9bc

SHA1
b9bc2e1e3fd97064617848c83d7ee08bc6ca33fa

SHA256
5c29f525f7f5ef967f18b5003e0bdd64b07e553fa2a79d2426001e3b38738f99

SHA512
4fa74c79040e896bf62cc2325df3c37fdcdda270f1988f433d227ea59682217f27666308e2b4f6f08d28b6a56c40d097351457533916d58061722e80b06675d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b5b8e4230d62befc7664a8389b04f06

SHA1
a672bf016901d0c656414434b6bf288d6b1e305d

SHA256
fe5ba36ef730788dbf3a2fd9c4ca02ec999393cdaf1d8c826f13c99577698984

SHA512
ffdb598c566f6cfd3b2adc58b24465e85773eb11cabe0025ebac5d981a9d4314604b456adfa00780a0a5a482c48611f6554f175bf5a963041ca20a4046efcb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ec19a3e4611d9fca896e844d30f94d40

SHA1
54073f6193abaa96c766fc5a25c86f85bd6e8254

SHA256
18ade18edb963908a0eda7e9b38b3dc02185a1f0f75c3c956c568f74e4084b67

SHA512
ad8fcdf49d59336997dfea84dfce32061b39328c0175eabf26e873c7c61f59ffabd4592a4d07cf859c13ff9a8bb9f21da16f79e8473bfb8d829aca170f57bea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fde96da77782564323811ab229324e00

SHA1
84e82444db2dc7fd7dc95ca2b61e05bcc10c6dac

SHA256
e5c427b2fb260e4b0681248b897d88cf97a679868b15c5f022ef1381692fd4c5

SHA512
e0dd8cfb34f7785e8c44157d698ad66ddf9a3bb2c65067a4c4db958fc8507c24ae0e3849a5b8db8e923f762aa7fc425ad83da204ecddb7b57623ad91c8897494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09d929f8a4e158db05a7b0de3d67e140

SHA1
266ece13e805a26af9238f12e140a8d1a553208a

SHA256
2ae0881136046df91e0800065f7eb5598fb6442533e61ad007f3226ec8a1df6f

SHA512
ed8baa1def3768d8d1021da25d4b653d998a76b50f00e1ad0626dfd3c7e3d39c2134432edb6cf9c7e04031ff986e752184ab8f645ef9e0a12bcaee8c0377caa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
375592d1025dd4822629fcbb640f0ea2

SHA1
607eb7c6c3f1d2dd90b6c49f138921617304c82b

SHA256
7ba3876952246e127c9c869e47fe704bad78922cb1528db6fede2641488e4930

SHA512
ff2a3fd9bf73cb315a9cba51ff9686ca7c1d20c4f8ea81fc82978177f4fb58097820c2724727e9603c3cdaf29f8e27abf658c48f918316b2cddb2bf5dfbd5e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90784a00c0afaf24ffe05eda0b5600e0

SHA1
6eb93126891f04da50ab9be025272ae50f718459

SHA256
00960eda9c9ed522cbb2e801e60f2ff27d8b9d24d334503b6da29d5ef53066a6

SHA512
b189f15486f9dbf3d3810410f93e03f345c5f8d5ba610a3f07daf0ceafb64cc357566973f5fdfe9fc6171245d3a8cc770d94021f45422cec7291954c8f4d5f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b5a471bdb2a4c2408d791317959655bb

SHA1
fa84e5d67a991d50c76a622b759dabeb1a57a5a9

SHA256
f652a0f7cc74d06ea31e522601ca7b8a812af6028b5eb5ce383eeaa14cbad436

SHA512
379506f7b577af771395b383d3157dc67122cdddfc43bc76b472e2db98a6f63fd1943551a880c809bef2a973f390461a2425ccdcddc2e4d399058acb6532ac5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580318.TMP

Filesize
871B

MD5
7012335e2a2a098a120f398c31bd1ed1

SHA1
c83deffb9188effd86af82d2258eb840927eaba3

SHA256
b8fa09cdbfea8d76ad4aa7aa7eccae44f60ebbc2cb57bad0f2b5c23fab99c54f

SHA512
729a5f449fced69f9164c4489134cae6ab3022098baf5a50fc16d31b0eee759f7868c4a35afa28cdfc8052a7232bd2ab3912aad1ad3957fd6b2363eb33cefc07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
08e337c58d1fc46efc9e6bb624ac9382

SHA1
dd5f3550e22d142c9c1d63882628c6ac3fba81b2

SHA256
e3e585ceeb57df8f8f467a3c362083b638f80725ac7d27b7261c85f4a7c9b7a7

SHA512
fd1b13f855e0f600276ed90273708bdcde416229ca621bf8cbefa407ccae73b5620e75592cd6387d3994df9622b170cb58e77c44cd77a6debcc2b1ac3bb73eca

Download Submit