hxxps://wa[.]me/5218135518312?text=Hola%20Jos%C3%A9%2C%20me%20pudieras%20apoyar%20con%20mi%20marca

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wa.me/5218135518312?text=Hola%20Jos%C3%A9%2C%20me%20pudieras%20apoyar%20con%20mi%20marca

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
5016	msedge.exe
5016	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2528	5016	msedge.exe	83
PID 5016 wrote to memory of 2528	5016	msedge.exe	83
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 4968	5016	msedge.exe	86
PID 5016 wrote to memory of 1412	5016	msedge.exe	85
PID 5016 wrote to memory of 1412	5016	msedge.exe	85
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wa.me/5218135518312?text=Hola%20Jos%C3%A9%2C%20me%20pudieras%20apoyar%20con%20mi%20marca
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffbe13146f8,0x7ffbe1314708,0x7ffbe1314718
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9774988609034317771,123496296205209399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8659ee7b-61e5-4ed7-bc74-9236d72cfdeb.tmp

Filesize
5KB

MD5
6674a04abb9eefb7ce289867127d3ef0

SHA1
d916e65397f74839108bab284ca2fa0203e6eb88

SHA256
b7234c4135b2ac065b37d2bea5e123db1c1be6ae29450db98f73e51a8de3fd0d

SHA512
5c91baf828abdd78a5b867a3f41cb57709054e62d4a5de225e5bd73cd9193249b9e8d6520387044daa03461a8728eaa018b6ea69cbd65b05fd2b19df832f55a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
cfaf00e71de545453778c0c348a39943

SHA1
968c555677e2c376b777918f8dd2019e9362675f

SHA256
02848ee2167b3eaa6f8e0d8b4a217defd4129aa3eb813d9b0d1659e3e6aca948

SHA512
276ccad020912e6469bee9078f8144d37f04b9cf619faebf8d1620b45ba3361a66133c90e500225e01dc568f013a8bbff9c9a2645788721187596052110a78d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
173B

MD5
b1aec192316e2bb2832d30893c4825f4

SHA1
bb3929786bdc5de22095c96964d1c50d9fdb0929

SHA256
d037bf54952472c61305b3945b78fe94378c53f0d56436ec30782b148c63e813

SHA512
fa32dcbf25c1458568b1f368a9ba03682ce2b1b43766fe9f48584314907252400e971c3793f817c80f299d3e46119a07932464c514a933e7f20bffb75f979e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ec7bb8a57aa93e5d0b528d91471f493

SHA1
e5ee43fcef95619b504f323dff5304edbaa2bbbe

SHA256
1c1a469707b96afc726d637783713a33b47fb87d012fbd4503941dd18a907048

SHA512
38f6cd3a2c7fd6c98214d00a264197a0e5f06e48bd2ce3c9ee06349dc0dc5f9832b78c0b5f28b78974c5b7631df187fbecc8472d9f0bcc17cac8cc5dcaa92d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec988a6cce57cf6ded09d8362e6ef3b5

SHA1
9eee9de4149938f214ec59628ee3c090da9bed4c

SHA256
30c3ef0eafb164d282acdbc036a1273819e29d116a392560c5b93450b58be4e9

SHA512
6dbb15af81ea14069c4b43f9ef49d1bc1eb194c3a9f2b85a2f3eed69fa50c7e0ff1b0d7ee0e85113e06e6ff982494f42fb294aabfc64c51060e40c9e7c9cf322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
78963fc81e72900f3cd98536b68d69d4

SHA1
11fd03c2ae9f4fccf16042baeff84ac511cccfb8

SHA256
2e1320a30d91650369315111cfe6ab4c991ba9b1257c331abc1fc9b012656088

SHA512
ca909e042212a1b44ba860ac281bfe0a6163a67914529749cec54c75096e6a5ac590b535f4c12a0fa11295776d83466bf5122d9fdcf0a5b82e7ee4a768d624e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
165b85dbd6353bd4742fee666794b68f

SHA1
2d26f89215198bed140fd0023e45d0ca00c487c9

SHA256
8e989174cfbbe606bbfd1fe225fc55046ca2374fc1e22e72e4f6086bf63c1117

SHA512
ca8ea60bfb5a67cb31e4d41abb4439944f6fd9397bb0d2f27aa97d171f4c71d4463554181747e2e0ad7aaa387dd853ce7e6b0454c30667d4bd261d8a955e957a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823ee.TMP

Filesize
370B

MD5
863a840c2039c8b5308b87f6ae74e8e0

SHA1
0c6684b2db519b081dbd80323c0b0e46da251aaa

SHA256
9ac78427ee06c362c026a25b3a292e65c0d76949bd0b2e38a6ddbf6e41b90cf4

SHA512
df42c52c4fa09a216cc3fe75f6bcf1e102fcb6454124ac0d427c6ab30d2f88400a77fe3e0a0ecc53777762107034aba7b1e0d1a4d4b4f31a25053391e40b09c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aaf8782ec883661096086f8d2cd4c647

SHA1
bb709df98b7fd05654271fba4fffbde0f82a833c

SHA256
79b45762c4b5955cf0616dc760880ac0e9b6dce99471da04112d29594659eaf0

SHA512
35ecf1b094184eb4f8c1c9b9e210546eb888b6c0bd9e64345db868e440bdb74adb587ec8eea03ab207919439cc0efe360a8f6f65c02f95ca22d8b8d19bb266a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b95dc53a-b8ef-4cf4-b710-2ad0045f20c0.tmp

Filesize
10KB

MD5
c51a9c201f22b903aa267d3c7d8f91c6

SHA1
a8a798c973c2c663ed9c422ff48d33f1f168d9e6

SHA256
91a0b79ba7b397ef70f5f1fa24f0a18c76364b1c36f667710844753baaed2b22

SHA512
1b6f071a0ca8af4cadb15e47a248216501e1b64bad3fe435be8fa7ac8b99a6cd9716827f1ad629526d9af12533dfbcce20ca96c727ab1fe1d37294e5eca69a88

Download Submit