hxxp://fabricaplasticos[.]com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fabricaplasticos.com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3616	msedge.exe
3616	msedge.exe
3456	msedge.exe
3456	msedge.exe
2424	identity_helper.exe
2424	identity_helper.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3456 wrote to memory of 1056	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 1056	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 4892	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 3616	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 3616	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe
PID 3456 wrote to memory of 2620	3456	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fabricaplasticos.com/apps/xncggoub/bWVoZGkuYmVkZG91QGVkZi5mcg==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4d3d46f8,0x7ffc4d3d4708,0x7ffc4d3d4718
2⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
2⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
2⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
2⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,18196628315492515817,10890332108000123795,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3560 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9757335dca53b623d3211674e1e5c0e3

SHA1
d66177f71ab5ed83fefece6042269b5b7cd06e72

SHA256
02f0348e2af36f2955efda1613dc6480f1c68c8e55f19590b7b58e9355c6a940

SHA512
f13351398f5dd5b6cf638b174dc50ddc782b690c6d4736d48941923a3425b5dff4a9aa0da22773e9abc9559d40f020f268018db902e0a7772b7b1f4d21126f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
9d8475a02f972063cefc0f0f9e17007c

SHA1
76c0acf70dfe5cf3d9e65502a37d13c2db77c787

SHA256
4c3e1c9596a0d586cb7e25c6d2a725c4ad08fd110d04f219d2822e516b92bf39

SHA512
09c3fe7ca5413e6dceafb25e17b4f3e8714fa16c281f8d84332fb8b6336a873ba2eee4a4e97f99c5f66a18ed91388bb7c93c637e204d8f8d7ced09d7aa1c5f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
655B

MD5
0a89071335f7f0e75cbf8d072e9d1c25

SHA1
6def3f6461057b76aebe2d099fdf20fffeea7e42

SHA256
ba89f1fb0d4f1036892779aa895af353a007fc9ebba3d260219a5ca2d41ba479

SHA512
4e75ae6fbaf55d0cb0790b0817e3ac078a1a3e7d234d9c4239b73df93efb8c8c056289487a731a903fdd8f0838ca73641e6fc53c7a156f84b2544451398d36e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
6af8bb5b280cf5ea5a7b30e4f73aca22

SHA1
5e513974d4fbcd9574a63512c85b422ddd4c5950

SHA256
f9b3801249e50d97ff7630a7d5d6436bdfd3a5340e27f829bff3aab37862d79c

SHA512
1c632c6756e29070378329935baa674f90c838175da2c4a2b35494c816cc5018bf390aec6fe8477267a8e634ffffb7ae70d3c2b1334c40609926eaf5907d1398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5e6c9d077d5028c68c6a68a96adfc4a9

SHA1
5ae8792b7d5be46f593a2e694367dc41385845e6

SHA256
935c911630be0c4d505abc4c9f9259882c133422ad3101c0bd6cc537c9fe666a

SHA512
06d97457c4244414484233684f9fa67233136bf4950861764be1ed0b1b7c7192f4e07c98a7856fd59083138b2682bbb1664d42cfbb070f39d800a85c2433e70e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
100358037244cb2cc73ecfee55bcc5cd

SHA1
cc8c8cd8ac11c8290c92ad5bfe2cc86d733b72e2

SHA256
d6898ead92cbdf9778b58556eb5eab6441d3bb9c341220ee2d8e51642338964b

SHA512
6c81c3a186ca62213a6313d15c018a25b780e24dc0577522ea43ae7bdfe2c68b85e815317c12b921e5b78cc8510bdfd410aaf44e06056594e8ff3ad6d88c1ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
c0499655f74785ff5fb5b5abf5b2f488

SHA1
334f08bdb5d7564d1b11e543a2d431bd05b8bdd1

SHA256
6aa332a4d21802b2dbcd08e153764da60f538ceb0daaaaf7504ba8f67c08ef03

SHA512
5f0cec6dd823f2b3ac62017383dbbf71ed38893724312ec75e73fb197e0bcd5418bb70fdfe9150f5ca495d5f8547d8a08618bdacb5010514a3cb1101437d698e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
5b9f8218ea0c08f4e933222d50e40ce3

SHA1
eed00095727d34f1f3d46ae3872377b9e0f6ddeb

SHA256
ca6c95523b2397b62caeb579ffa307769c5fb933a5472095ea14eba19b3e207a

SHA512
8a2f782ca846208bf3ece1a6a55d4c4106f42aa71fa88eea26a33f355f89e81042a133c96e7bdfeb0d9e238bfb9f10dc4eeaffa8e9e92e87324c45de8c209c9f

Download Submit
\??\pipe\LOCAL\crashpad_3456_LSFUXXAVQFYMULRW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit