hxxps://discord[.]gg/3gbQD6jK

Resubmissions

07-10-2024 17:00

241007-vh3a9azgnj 6

07-10-2024 16:59

241007-vhvw6sthld 6

05-10-2024 20:06

241005-yvemhawdlh 10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/3gbQD6jK

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	discord.com
9	discord.com
31	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{EF722FEA-C053-45AB-AD1C-CF9CBEDF22A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1712	msedge.exe
1712	msedge.exe
4884	msedge.exe
4884	msedge.exe
3564	identity_helper.exe
3564	identity_helper.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1964	1712	msedge.exe	81
PID 1712 wrote to memory of 1964	1712	msedge.exe	81
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 4720	1712	msedge.exe	82
PID 1712 wrote to memory of 1164	1712	msedge.exe	83
PID 1712 wrote to memory of 1164	1712	msedge.exe	83
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84
PID 1712 wrote to memory of 2248	1712	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/3gbQD6jK
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff9264246f8,0x7ff926424708,0x7ff926424718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2226914418740478410,5780927683049380777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
7f3b78203c88cdf0bdd1d843a98dd3b5

SHA1
8d26a3e6573c58621cd2150ee353c612367f046d

SHA256
205497f9e24ee32d8c2f556941d99cd8412f10773d849ee1d0f53daff49ad9b2

SHA512
353fd5acd893eee57decf645821047513155d610b10f1299b9ecf5f9aff02054d37bde51aca2f0dec134771ed69719ffca2a94eff087049f2abe62b3b47e9f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
53f3ed83214ae33d7928a65804a4c6a0

SHA1
c7b9d030a69a1b4f6fc2824641ce408e1bab135a

SHA256
2b77370942f4baa860d80261010b5c61c6e02cc0338c33b6f976c29af594d080

SHA512
7d0ddef839afeb0d0b72af17c5452b5d858f7cd2277c6641a7d6988fe805267c1f0a314ea58a00fe5ebf4a05a31eb8567b174ac844bb539006573b662683cdd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
536B

MD5
7f4fb1c8b829d1a807d26dbccea0a395

SHA1
85f1e23e9047cbd1992c095ba67e179d6bd07946

SHA256
30aca1ea3029f5914b7e1a18a4f81f4ab6444e9c4eb3352171f5b1567f0e32c8

SHA512
3f448e99fab4a3a770e9d1faf59d7abcabd4b3d255903b1c9d666ca49b695611acfc66f1b1cd75e542402a847a50165deb827fd5a7d8f07997b88eff4541417e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9c33fe6c04f27f40e2f586d696cf27d

SHA1
11439428dc0d3d65a5a648797aa84c924fc38e14

SHA256
0a4f4483ca8b1b4e16fa4c0aae2afb79427476c248386a9150fbb4f17870d6cb

SHA512
2d88715fea47d45f4d7a790594129e3b8be339b12606d62b94b7d7d587ea0c014bb2aedbfb7a492c28160c9bf335153fc10e5fafc0ec6eb92994e8673faab7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49bf1a4fa15f7c3fecd7837fc0701d37

SHA1
c637f70488a134ffbc5422cad998ce20cd1afc5b

SHA256
9d603dd6fffcac1d8521b1a93063a1707cad5ce900074c7653db3c982b580704

SHA512
b9e307bcc174305a805ec617f17e2da0006278592d70c1d499c83d79c19962f9ab0c7dce3ac20f65ce260ceccf5923fe6aa1d477e95e9a2f1cea11ada36347b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
368867c2236fbe4ed024bb253c619043

SHA1
76bfc930a1958d4891d78ba8331dd383f20af761

SHA256
16b1562f657a25893c636885550cd1f0ce3e8ac01651ca666768afc0714ea1ae

SHA512
f9cfb4b2e49811b27847f7584b79f03d001f8ac9a3e233f253d539ce86b579d5b3335f2d6cbd1cbaf16543967acaac1f651ff633d6d5ecf4979cf5492d749fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c1dcb853f3276a346d8c3bbe717c9f5b

SHA1
eeb3ee1c9b3d8fe76760e4711346d6055d5af0ee

SHA256
d15da158a2d1fe36a10d14a5167b7e35aa0230e539de8c820fd3bf32c92f8cd0

SHA512
5146ab4e78cc0db69c4b6c3227593f9d424aabc472902223addd86c98cf7876f8c9237e925af71c3e5ff635d65179a800d3151d3169fd57f76be98715cf74930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588141.TMP

Filesize
370B

MD5
bedd6def1207ed426e6c280c5e75a5ca

SHA1
172cf87f932f5799e2b81f259b3f53b392dce4f4

SHA256
e08c5505d755c2e0301bb03952c3a4a069775138247c63af0eeb4b293abc7cf3

SHA512
9080bf82f1d257a38595db24d0e05995ffd252a6661619c6bd27941305a80e31c21254199e3e2885e30f245c66f470dcf10f1af47e22faa0579d297e449b932d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a32f87f3cad2d0b3eb03bf6dd74e5bb

SHA1
631de5662ac39af67db4bb400a973b692fb493aa

SHA256
d44a00c06657e958af20de4b64c3023297182c21d1dad2b27afd66c68a25a6e5

SHA512
acd81eeb13fd14d76d7a418b4e6a9b17536c64cfe3d33bf4ec8ad3533ff23b13c92d7eec8c0fb0ea238ad588a3ed9cf50fca4b4f79f207ab3c7301f99f5c318a

Download Submit