hxxps://ingresodeusuarios[.]mobi[:]2600/

Analysis

max time kernel
280s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ingresodeusuarios.mobi:2600/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
1980	msedge.exe
1980	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4316	1980	msedge.exe	85
PID 1980 wrote to memory of 4316	1980	msedge.exe	85
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 692	1980	msedge.exe	87
PID 1980 wrote to memory of 5068	1980	msedge.exe	88
PID 1980 wrote to memory of 5068	1980	msedge.exe	88
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89
PID 1980 wrote to memory of 3372	1980	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ingresodeusuarios.mobi:2600/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb79ce46f8,0x7ffb79ce4708,0x7ffb79ce4718
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,792009038214999063,16360236026702996330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\184e1821-4c1e-454a-9742-daa945a2852f.tmp

Filesize
203B

MD5
9c28756db8c65b3140364503e30d6d49

SHA1
60598105c635f3a2221c352369e77ecc2cf88c80

SHA256
2119e8d116f5fa3483b9b59387b92667b5123799b4e83e464051aad793d15d38

SHA512
a6c1040f3f93994306d898b80982c14caec014b78005606440451f1ad9989f74dacab28e3df9e8eb0435cb340541a3b5001f89a024f74c1a800bc6d9c534f9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
bc4b228cddf7740ce08f029a7fbfc090

SHA1
2d8868f69e0a898d311dfe382aba8b17b2fd4e0e

SHA256
e50f465ce3a6ee2587e7484b937d633ee6b8b8bc3f222ce5c9533230ada4316f

SHA512
050d33c3f85ec196479586d1ad897fd75ffb732f3f02c92ac32dc0d1c46503a9d8fe6a52c8637575ecd265b369cdac7c5d0839357cdf30ccfb7f7a8186fcc405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e8d83b96e026f146aef079b9ad627df5

SHA1
0203775d97363b33fa44b6feaafbf9267f2592b0

SHA256
545370131ef0af7718adb05c3957a19bbea6d028a2b5dacf51d0f2ea9622825b

SHA512
1eab7b57abb2bdb9c3f759eaf525c09ad52f3b164081e2133e63ebdafc932b844f4c293e11032c3bd643aac26e18e8971cddc23f8ea50505535e32f1cae58817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4a396134b79ee682502b09562eab3fb2

SHA1
a12269c180545c806bfce3d89b38cb942c27c24b

SHA256
dbdb694f371e95cdad2f85b58960425cbee4b1dbdbb84a70e0ae2084373961aa

SHA512
96fc996227a932fa3b1c0691b960ab7f526e1d7ace6f8231a035748743df3a0eead6fd4e9684f69ae124fe098eb84482c931c1345feb94e99ff50aa07dc5d9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
184caec8c8f68af472d882120f7d55f3

SHA1
a0642ea67f651eed6bffe2b8f9a9f1b5083e286b

SHA256
a71faca957f07235a50ff11d946bb9f4e51a9f828baa2af6cefeaabf7b97e140

SHA512
9c212e13d8bb2ea85b94ebebd8408cd2268bad24476b23afb7992ca8ecefa620f7e4dc8d42f4de96330631fc358d3f69af6aaf29d79f086fb0283e3c2f1cf650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4206e6e5dfd045ea281430265845bf3f

SHA1
855952db42f6a5a4c391a903ec6b340342b01783

SHA256
6d3a5be763b9efb0f717bee57fb87b3bc09b9acb9a1246763bb2034096170685

SHA512
aae6793588c291912a7bce0fcc17b4e614c5a57273e45a1f68d5b138480bc602e50db578a305703e2d7e956302cc804ab35d863763ae7add6d60c24a5a24a8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac23a134b79516f719d0b2fa2b5d6b00

SHA1
9db78c31cff782605cde24ccac25e69e2e73db2f

SHA256
f07cc8601d0417f89aa6a478d27eb75eec9a9f8cab9f995788945a81ddffba47

SHA512
b2101d3adcc5a95447fb1b1948e773ab6d369fd7efcf90d2610b4b89cebe0f0222197d0a56647424522c44e09d2194eaa6fb0d21f3324e3b5fd80eba28199feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f53857dcb7696485e023e5d627aa41e

SHA1
65c014fc1be0f29b7405d60778b012d99a0b299e

SHA256
d3cd0e3d7695c6456b11c3905b8819faeb4a4337d4fcd753b046c666b0408344

SHA512
0f96c91acb558ad39f010954fa1eb03abaff1db8019e8c4a3f1135816e8c446e7edc99bffcc847f926c29fc74eb2a564c465a940a5b421b9994e41f5610a1a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9820fcd8a449d61eeac3af8e96a2d34f

SHA1
be8d98e5894561aff2aef38eaa74f32986ad1db7

SHA256
e4aa5826b765806950a9539fcc5945ac2a1301bebdf9d940a38fb7afef65d4af

SHA512
6a4cc81d6efe15b5f390fba1314e683bd0f159afe67e1485a33b2a9bca162b5b7d8d30abfb01a85424b1e36cde05f7b5462d1e9f61b0b88e30b2ab93d75a99e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
639416235689dd3d10264161a12f92bb

SHA1
372d13c9975236d3580879534e8c5a3b25eed645

SHA256
d6626d8c63df95a756ec2dc09006093dd8404f8f435d306f76d7c1becd011951

SHA512
da5c3ef7ffebb05dd82de809d5ef169655a52614e968ee90020b96c1c1c055c7c1dd226504cf2759e4dec2419a7a39799f1ab03c4af181d4629357949440d27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
e46111659468ac7d89dc9d64abb5d4a6

SHA1
40b17b6e4ae6fb593624cc822ba1c2f83555868e

SHA256
d66c3ec54e43fee9e1ef7beba933aa7e1fc4e1f67afc407aa00a13dc973cced0

SHA512
fa15a42d5b04c1b3c1aa71b5b9023d58de7fa2052682a181c13307a053302e5ed787887c4ec733fefdda630567c87daed880f4ad2c385f340f5754334cb2b898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
2de2e155828efa6d8ebd4c9dcda8af52

SHA1
7c02c74735eaa10eefaa4739ac48d775f1a105b8

SHA256
c7981e0c86689b22060a8a6592b5f34e7c92ec1ae92e305c8144d21baecde8b1

SHA512
0f9dc2d0f66e14e58388e3f09dcd29014c0d661f9c26609091b1e967ed55995ce29b7a848176fa4724aa6cb27be119b1475a06095e7ab27fd36abdad4971777f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
a9f2e60dc7c9619f9c5306a0cf12c116

SHA1
7113b39c4a73f9ebabf0223d2432547832001b79

SHA256
2a3aa6428e743e0682047140f04f8d59fdf5025541ee9c61e3975e946285a994

SHA512
48f06d8cae50a75e8f17fb1b65601afb983de71bc03fa208c61855a3ba29ae34c5898d9168f026992900cc1cddfed71be8cf444d88683aa10d2effb6d8483133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b75feecef7da1683107b58b6e9df9073

SHA1
4fea5cd8dab30b0bff4c0a77d7ce418d3085d970

SHA256
5abd6878a9890b6e0dfcca7e294214f39da80c2b382f0217f1cfc73679af7d08

SHA512
9713dc1034c891630a9fdd79625b29d205faf7a02dbcf22c2c0c722ba322406ec26425469cc138a706f6cce9dcd2f538c20ffbbcbb400aa371284a9b58f197ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
4d0e2eb33ee9242212e6ea8ee673dd39

SHA1
5aae88e97fd745cf3fbef8161173fed6f5df8a60

SHA256
4264c41fc25158d28f4211313af9c349329bf1486a4cd120c5c401aff6ef4696

SHA512
1bff9c97aebd1d7ccf5dac23f9c3e63f9e3a101d21cfba8f7140f1680f03f6563c6e450f638fed9c0455536a967c2e76d8a48f6af7e423a5a56a171036f89c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b0e2e68d1601228186b06f18c5dcf0f0

SHA1
9e6f8478d64bb1e2af15aa7e30ae398286652209

SHA256
89736e51011214c58d27d6972277b88dc4fee3909f174259c4803e8919638fa3

SHA512
db6d6521b129c2d89803c010466657468eb7bae883ab6ce505263c5e68748794278f5431d22109299580d1783dd13807b4dafed85c51ebed75d6dcf2faa14b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
15181793190d5a9a77673e5673c1c179

SHA1
fffea4cfe808c46300e29f44011cd78b74a76d91

SHA256
9f20838d6f116119a2f6632b3b29db4d3b80143ed30bcfca8b136fc5335ec3da

SHA512
012c5aaf3ce7c0506bc8ffb96607faad2ef0c1a01002edad729d6f51d4d56a08b70a8f7745a2eaf6f02f0dc0ac1fb500e8e1e109544588127ea3915b6b28fd20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587952.TMP

Filesize
203B

MD5
2f3d5e9cc56599c0bb2817ccf6b450c0

SHA1
330389ab48eac0bf9b9537be4ba09ae1d293e545

SHA256
8d6fce3ab780fb89871812301098960e21de33cc3b2c086a132d7e0cb8e7885a

SHA512
6db6792a19ed9efd7ec77617e13a35e7da8ee580e3426e38668b4a683f39ae72571b3404ca7d8e90951bf57fabbdfa18a6cfe7128a04bcb2099bac85bf82fa37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a31cd67266e0debeb18b98eb5c4248c

SHA1
43f5ccb4538bc2821b90b8712e4db46e80983adf

SHA256
4c107b06718194bb42b8dd27714e3087f1a2fa18fc6d0ef02bf017d5fd88c897

SHA512
995606fbb80c8074ca977aa1480fa0984c5292827eb4eb0b79cc61293a5f70c70bb1a66df8bece71da5d47e0321e3e401ec07a0562016e5aafa07d1fe60ce136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b84e2924e3b270c63e311ee9dace85f

SHA1
ae5106b145b8346b7486e6ff30a485c0868dcc58

SHA256
a4f48bad8e5edb48668bbbf4927f9fa9121a485370f774954281798983699328

SHA512
c6f06a3c40425fdb89a0ec549294dfeed789eb9a40d7f88a2bb51f17918caea6fb08b5b0477fa16f9e3c854f3be2487848381d6dc8d21d81ab176bc27f8d7800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
13207f6b78e995f2de74a85d350ce676

SHA1
6fb48508b20ea0e917149729b804c1b7885d1566

SHA256
1aba0088802b2129a45426be346b096d98d9815633223530fdd0c7ae868b4470

SHA512
03925c4279cf06263dc46790633bc40d905337acf1dcaa4511962bb000adfeef92a9c759bd57c80fb304ded18cfb74bed2a9a7fd0c3b7991ee46412fd03d8241

Download Submit