hxxp://discord[.]com/login

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com/login

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	discord.com
13	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{11FE48CF-40BD-4C85-BBD8-75A2605F3B40}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
3620	msedge.exe
3620	msedge.exe
4012	msedge.exe
4012	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4092	3620	msedge.exe	83
PID 3620 wrote to memory of 4092	3620	msedge.exe	83
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 2732	3620	msedge.exe	84
PID 3620 wrote to memory of 4432	3620	msedge.exe	85
PID 3620 wrote to memory of 4432	3620	msedge.exe	85
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86
PID 3620 wrote to memory of 3756	3620	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,262645613939968936,384234379382584809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
76a2c8d8ec1a2648dd3c2b6f4a498ae6

SHA1
13cd4b50d0f8b3882cea306d476ed270e0629223

SHA256
a463b80aa7217b03e7cdc7ddc60a24b55c8eb0b1924d17cb6300f33e2cfa6df5

SHA512
954968b187f7f175fd3a75912d961998cab34fba9a5ec81879cf28acfe85c9559e56c4090c9e4c7214c4765f11b4771699b9f5d13926abeec3d4f3465179c3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
96896f7264d7b12422affd510f1e2eb5

SHA1
ccc0995fb722f25597c1a16acf5f941d88ae1e05

SHA256
23321b6821a3a4cfdff49cf047108c113043a8647b104ef0f1bea07f7f176eb7

SHA512
609d9d1361b3aabeb97e883aea592f03ac6509f7e57c3eaaa7939f26528837e9a0e81d21e7f6a18014451cb76bceeb49841f53aa82201ffbf32f52b2e07e40e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
5fc5931a31ea1d7152c2d925f211bd26

SHA1
b19fe7b57acc309570910914a758ae78b0431b86

SHA256
b60c6cf8b7228c144c3c161da194d13014dc7ddb61a7da976f8a3b1bb066bdda

SHA512
dc5c31c1e25a3d57f16a27619420f159bc3cdab4b6d5f7c4ae9e6a55419a421267486f8cf60c8d2ef65e31367b2de7cb4fe56e11ae91a49983b8c363e3e32362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88f359dbe094eb9518bc57d85cf6222d

SHA1
3a35fdc459a7abae22c4406eacea506a3f6a7c82

SHA256
f0a0a5bcbd98646795ac3c1af55432b3dcdcf8051d9086ca2d026784a79e8bdb

SHA512
634e5d929af98c71232dcb9f2f1fa0336129b6c68080ec5c93439ca75e676d40e04dacb51599dc4b1195b0fe662d18d1cd8df2db204d70f126398ce53d81468c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f264be4df8cbd346ae37056fbef6db52

SHA1
1078c8d815072460a00e201817e8cf33dc92e437

SHA256
176cacee369133bb268cd2bd5b69b630b14fd00d3a906f1cd6fe53710b49fbd1

SHA512
c1c9f1a3a6e0137d9a9e57a4dcfbbea976fe01e4ef336ff78ae152c93d4d0d7ae84918fd4d764adde50e81a41a73eb36b28be01301bf3a79f62c2ec8fb3ceed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ead5993cc211a1d6d4b3c9c17bbf7798

SHA1
0c44eb83d2ce2e696a5f3d5547b8d9338325b86a

SHA256
f40e3fe235eab6324f37c4ca9e1112deba78bfbcbe6863112e32e995bd8c4e94

SHA512
ed803dfc35960ed0426c9a583298d02457d34a9d1dbaeb2520fd90f7187ea258d9f7cd8409c6788419d0ad27ff4726f9d6eed6f25f2cbd2656e0b6fd7dd4c096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83cac8ab03869d02a0d9ca8b80e6ee1a

SHA1
2b32c5459efc1dcb9e623b4b01a9b9182658032f

SHA256
cd435dedc7a3215bf02ecc02bfd201b84539174f4725f541aef6f7ff4233d304

SHA512
24f084ad2971d8a61911f6949d2ec648fa809e38855dc0c65c771d65c2efba84e7961ebc9b55798b779d7da06f6bbb8d289fa197332c4f803604bd7580c383dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef9a06b4b151e0cbc5d01626aee6ef99

SHA1
6378dd11cb6b0a829d456dc5b4a5fb80ce185768

SHA256
be5fcb75fd9b264b47026af6efb26cd8d85d4051679986a08bd21b3afcbe9848

SHA512
9aca3b58da49301a23254888ddf044e811d00206011433bbd2844ca0683f97b0f1805a797e75c96284c10e52cdadf51ede00eba3b01eca95b61ab7c5b7e5f81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
1fa5a6fd94b4ca9fc5ff79d85cb2ef2e

SHA1
8262b9859ebecaf621efb2353ad09c333bed3526

SHA256
357d3c40292ce626ff8f176cee5c0fc1753486bb1c64dd3c8d60b2c458eb7e70

SHA512
2cad807b1e0136717518905990451f4d171f8d8da0e254633dc5c68956d3282efe6a3eb75f98afb77cfb62e5be300131b73eb8231ee1ca538dc9495faa9e9249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
ed7cf76f7c56d461f620f54024427c38

SHA1
952edcd91b1c0f129bf278767e9dcf167074fe90

SHA256
48103f0502f9fbc1037c143452964d021c05ed30ded36ecc189f9b66a810caca

SHA512
3db06ad8712914bf0fb15cb7ebf14136106974eaa98353dad41def8c429c29985e9b93aee65884e19c315ba209b3d006b170c5c74eb3ab82ba037a053efd7c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85010c434433704e364a931bfcec1cb0

SHA1
c79ae32cf3f0eb5043bfdf05f245773aef814ede

SHA256
3ae55311fce9886c2eb2f0b1575cc7aca945f356fece8cb8231244aa26d834de

SHA512
9f6924181cb00e4a10058bc0a1852cf83b9ece10b0e0bb252ee7653f63877364d44fd2729b8af5d27841637bf14332bc74ad3e335955f44ac5d079338b1d6591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4a1.TMP

Filesize
370B

MD5
cbe2c2885c2c9b2596bf5665fe65d0e1

SHA1
dcae38b7e7a3ff311dc33c4a7539716970dac4c1

SHA256
deaded2efaa3f444ad38f7135e13adf9aace89cc0fff52a71c0a6e83f0c231cb

SHA512
36e11289f1af0b5e01e9e41238e997d795d239aa318f1705bdb26ae4a536f14ef41cd21acee04f816a5b0f45207504aae71716231ef4c5ae65688281b5dd93e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0388f47ac9f577d27fa61595eef90a62

SHA1
be784df395d47688a5f88a4f51592252157f2100

SHA256
0046408ba4be69d1d87ca39f7d0ec825b62ceef0373286bbe2411deafb12eac2

SHA512
3d7f4d5f931f1b491f125e1b0bc0be1cbfe0c3832d63567c2fb1e2043ad543c208d5faf7c2c4bdc22a4cf2b7264197ca5a854afce23ea64828b4a9387f96be5f

Download Submit