hxxp://discord[.]com

Resubmissions

05-09-2024 12:11

240905-pcpkbazgpn 6

05-09-2024 11:52

240905-n1xp6a1bmh 6

05-09-2024 11:33

240905-nn4b6szhpc 6

Analysis

max time kernel
421s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	discord.com
13	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{4EB67829-C6B8-461E-A84D-ADD7B586A9AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
2348	msedge.exe
2348	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4944	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3060	2348	msedge.exe	83
PID 2348 wrote to memory of 3060	2348	msedge.exe	83
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4460	2348	msedge.exe	84
PID 2348 wrote to memory of 4856	2348	msedge.exe	85
PID 2348 wrote to memory of 4856	2348	msedge.exe	85
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86
PID 2348 wrote to memory of 1520	2348	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd490846f8,0x7ffd49084708,0x7ffd49084718
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,8927028861478557635,2721092471899988351,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
0662b9e6d6ce697f067814f452222299

SHA1
d3e8cdc8172ee1080c11b22c59129b96b50f4d88

SHA256
017f4fadd9f93c4561a8b7ecbc2b0f9f683a91584f80fa2efdcc8a70554e23b9

SHA512
389500aa5a5319c8512ebd1f527831a50626d666070083ac89fff67e6c12c7730b56992d616abc8df76c4f97f6e40581b391e9e4a8ae19dee77d7c84a76b4d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e0cbf578956f144180916968c58dd937

SHA1
32025623180d275ce4e2e9d83a47ec08718a5592

SHA256
c21359cf90febc3021e405e6e09edb3ef092d64e2195cce4017a9cc7f16a4bca

SHA512
4a6fae5120a854f2f3f408375fca3eb1e51af5467ef21a5d1790a1bf66d08f08f7213318ee820585f30267acb87ef9dfb1261ef522ae4eab03f9067082de458c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5409020f65db80380026aa84ab1afa3f

SHA1
14c1b0ebc45ed810041e149af5a35c45b84a22a0

SHA256
8fd0052b4905ea7f20a0ea614b4ee6ec4b3accdd4140a5204230eeea9d73f7c7

SHA512
df3c9245b2dc7e98fbd2bf129b6eacef3660578265b480b3486ebd2f5d0cd090b3c7fc61fdd16372514978a8aff95fa2300bd7b5260b4684b426d8e6e524056b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
033dd03453f8de0cce49b92e8e0be9bb

SHA1
ef7ecbe539ee7a7806c5889190572ec7fb8fabab

SHA256
52c24ccfff00b8c12f91d355f5a3bc3bfdb9db66f892424cea44900483dfe206

SHA512
bd3522a6af74e60fa3465aa0e199c12b299bd72d7cdcaa7dcf785c29b313a18a3b23cd83c1463b270bfdfef23af3851ef8943937abb998eac66e0501dc228978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
323eb2e730c20b4733ca9a6b5e5d8025

SHA1
f844ef23aadbf047863371c8ca195840fd8f496d

SHA256
126230bf1a522ab6182143c686ddce01126390d2ee4bf1082544ccd6877cbf2b

SHA512
aee356522d65411e0325dc9552de313fbdff8dcd06e9151b68e1368658c30ab08bce97d6f765db124ae7f125e4357c5ebef966c335c8a9a59570e5170eed2add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c7343466d96edcf51a9e0e939801262

SHA1
816136bd8751dd9e8cab47c4db632d3fba23f742

SHA256
aa58b13833b28e8437ce45f1363ea6d422dae76819ec357fb8f4ba70004907ec

SHA512
4c5647c222201c72941a517071f77d5ca0dea825dd217078a821aa80c218178b255b58ab2e94f2cbb3c670a8262aad5d440a3c001922c1ac4d609843c97f0799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7e7d5de023eeb084b925e123ece329a

SHA1
02f4307f200344dc2cfe18ce8b27a5bf26e4d0c5

SHA256
80b9813fa93476b51c9a2cd11b9da359eb6abe9c9a68c7844ec4ac5098c5d1f0

SHA512
38eb1136608d57971faa785cf0c20ea1d7ea1e7b84cd126bf6b574e5afe5b4a6b1ede7532fa3c55aa4e8a415c5d0b4c7b8d068c0e3ea3b54a92c9d72c20201bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
715634fed50a7b27e10eee8eaa254601

SHA1
2e204b7fe21da8012c7c2f07b55b44476b98871e

SHA256
3cf2a5dc65f76d7038841a7be2eeaeff1579b5fee5baab00144a7d31678b599c

SHA512
bdbf415204ac601d7eeb983b45097ed6652e2c688503694bb2a62d7e26fa80f0b21bb5ebc77f026cfe72e7a0325bae2e635a361421e0a0102712e46c24b00083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3c66e3d51d754e483c8d967a10bb2fc

SHA1
d464c7b68e39466083d08dc313f454d1ccb42491

SHA256
81d974aee4a979814cf3d4d261327be2298682e9be6b272ed8f557653a5f9ef1

SHA512
87795c4daa709008050a11de8e16be5209332edf0c2458e78d119305f75a7a787b97e8d4f8d1ec3e167c7231a0b7fbb226f90bfc9d52eba7adabfa7caf9d1838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5840ae.TMP

Filesize
872B

MD5
00a82b460a9e38b89d0d95686ae6f495

SHA1
b1221df217b7719a5363eab6d230da2778c79317

SHA256
f9ce741e8b8000f04290384c8bae509f39338a1cfba682507aef09ff6a7b23cb

SHA512
54d9b008591b8cea99c7c73e57fcafacace10b607bc9b047d2f7156590aab47ad72ded630b8cef2bd39b54fd802e9aa9bf2e18e23c87140c0ee2aee5930b60e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cf1008e57c06a23f9261aa15523b5d89

SHA1
a92bc9cc28b3bbfc91246e4a8519be9c5ca422cf

SHA256
c4ed071244fd098fa3754d68466848fbd3773f070b50dd321d94a0e86ad6d8f0

SHA512
c49c588e4b1070e2255d7fcf121e3452ee4f387f730d7de00088206c9cba5f7e209ffd6ad801af4375aed5ae313cd8e0c15b6504c21277d8327d6feee866252d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1ad70cc62578387ad596b8607bd2fb1

SHA1
25d371f2fbd5604e6484bf6659f274ab9e4b2190

SHA256
8e1edc962e89d3ad6be07a7f5b06751d1a805508dceea392db75e421931c6689

SHA512
ac93e84cca1d3e5997fd07bcf04352cfbc3e36033b83e1ee995123bbc8a9305f55dad835af38d4b50742147d5708fd4471d241b5ab4889c654f8e5ccc599e152

Download Submit