hxxp://www[.]uam[.]edu[.]co

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.uam.edu.co

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
40	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
1316	msedge.exe
1316	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1416	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1084	1316	msedge.exe	67
PID 1316 wrote to memory of 1084	1316	msedge.exe	67
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 3836	1316	msedge.exe	85
PID 1316 wrote to memory of 2796	1316	msedge.exe	84
PID 1316 wrote to memory of 2796	1316	msedge.exe	84
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86
PID 1316 wrote to memory of 3920	1316	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.uam.edu.co
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb94846f8,0x7ffdb9484708,0x7ffdb9484718
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,3199820032419749951,11208495587109310017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\456aff91-190f-41b6-ac0d-5da38b54fc38.tmp

Filesize
10KB

MD5
2b19a103a723c69c2ee50dd30a8fa4f0

SHA1
32e8ef38267049b0c7253e8c4280c44928d97e0a

SHA256
0723d672637a5df14d67be6166503b33bb15aefaaedc1d9bc7c15b1958eeeb12

SHA512
fe221d91ce7bde94373ef652b01c1805eacc441aa8b6826a37bba58ae8d4972f11bd42bbf3a818c5514e2e451b60ae09cb2baf07e06d4ef2aeb978816d9f6cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
47KB

MD5
709f7544bd3e74c424113e6853948595

SHA1
a8c1d9e6c8493091727f0e303e45ab92b773343a

SHA256
0f2a35c8b824d54b483d0b2ea10964bb7af8eb6b1c86d40efbac4c55e1123a2f

SHA512
c2ed4cbb5e48d04eeb63c94d7d88acec5af101c2da003a34379023d8454d810ae357d0b4265da7027af38889fe307ca597f815111295ed62520f39aabeb2020a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2fe2c0454b6246faa5e530c47789773c

SHA1
ec7fdbf12419d8ce6cc6386168886ea58949e5dc

SHA256
b7efdd8145932e219dff26052f29d901a97086dad856ba66eabe355ab5d88e25

SHA512
951108804fc70b177bf1e99acdf20497e3d80a76cd90f238287bf2e37ab622f8945a44152ae775604098deb31f764a3ac4426556e4c23c22bd791dc45814a9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7e272818d0fc052942758f41fe50d2dc

SHA1
0ea9b047bd775af4647574f29882358e3203e7b0

SHA256
9cbfd632a74eb2e42ddd3c02a67c296df4f9ee618b8041fb22f347f307488dc5

SHA512
fb5f8d4dc38f000040dd8a36d4989357998fd24fe768e5e857a6989ed845bc0119d36bdc358ab968bcc9bf8f5c5fa55f1b80ae396d3ad8bf8978ee10965da524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7917bb1e14f02497fa900b9024a2687e

SHA1
e5bbd23b968545de7938db57c1da42f767180eef

SHA256
cad14cb96beb9278d2decf8b46dd29fe8de72d10e48bb8847701461591aa80f6

SHA512
8011f793785ab7954f6dce367829d82c8fe1999eae72a5287704798fdece1228f92747d8fcc856c24c127e64a562042b7dabfd59c7236faae4d12a89670ffdae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
344478009b5fb4a517a2c3ea3afc6047

SHA1
a83614477b88c4a1e09d573ed0cfbb51042afaf8

SHA256
74ddea8de16edb6c00a374733f1db84f6a00ea8e66f19af96955fd257f70c54a

SHA512
e2bbca724c0f8d3ecae86d7438d923fac3e655ca96ad897b07709e6322a134c7edc7b0d74521eb0cde4bfebe180616a39b089a1e9641b62f76d9332f93b3a0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1092f36675c95adba98a659798a0e0bd

SHA1
bfdfc41b99e1d8238086441805356394e2f51195

SHA256
69a9d1f034dd0405c1dd3443b9bee2dc88d55d3ffe53bd2c5bc82a30093f3153

SHA512
bd1a63ec334c13ffa831b4390922bcfc7714c0650a17e5768e1209ac8a2a4b22d9f1eeb35c5ad1ee3674ae598973cc7a1b0711eb51e80ac639537167438208f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
195f089c4a87c53180a36fc2cd68bf05

SHA1
e6ca786fa5276bb505947872437e2101e0648770

SHA256
df1cb589db9f3ca837fcdea65579fe2c5281eb57442d1697cd195f84dc267ba1

SHA512
3baa5869ce0be64683685139e3fe1fa0ce88073a37d5663a6cd5cbd71dbecca92d8e8f15a2d172ce3b965a319be6aed44970e21e21ae8e146d86b250bcfb5552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e44479bd-d1c7-4799-b987-474826b26cd8.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
436efc57a906f4271fbbd7a352a9db43

SHA1
3ee1d1282145e63936eb51313da0d00629ffd89a

SHA256
75fbd796ee92ecbdcaa839a28fc9ee0e4421c010e86c4d574bf837b6cae45e9f

SHA512
d0c3b11de2eb41bdc64a633113a0fd59f1ca8bd1040876246e8379fb0b16a2c7cf1f08a7d3794fffefac1f3ef7e1098a28316b211d2e90e56c5f17a81c4d5587

Download Submit