hxxps://zetatijuana[.]com/2024/04/scjn-avala-reforma-a-ley-de-hidrocarburos-impulsada-por-amlo-en-2021/

Resubmissions

01-05-2024 04:51

240501-fgxl2sae36 1

01-05-2024 04:24

240501-e1ckjshh33 1

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zetatijuana.com/2024/04/scjn-avala-reforma-a-ley-de-hidrocarburos-impulsada-por-amlo-en-2021/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
4152	msedge.exe
4152	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2288	4152	msedge.exe	83
PID 4152 wrote to memory of 2288	4152	msedge.exe	83
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 2448	4152	msedge.exe	84
PID 4152 wrote to memory of 3748	4152	msedge.exe	85
PID 4152 wrote to memory of 3748	4152	msedge.exe	85
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86
PID 4152 wrote to memory of 4924	4152	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zetatijuana.com/2024/04/scjn-avala-reforma-a-ley-de-hidrocarburos-impulsada-por-amlo-en-2021/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba2546f8,0x7ffdba254708,0x7ffdba254718
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5035410785603131991,16270250839115730098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
39bff638a2e07d66acdfd8077a44f8d0

SHA1
994ecb541387dd6db667742567f68656cf78dd6a

SHA256
cc1209e47d5c7bb166b188dc52a4277d453a91c5810f71a9227959641e990a90

SHA512
1710188fca34d5e64804fd84bd789939d8144ce6bb00cb04dc6de1252da3f4dc0e2f362b104c586122663f4799028aa1c46d6d449fa5c926e6b02643b2d9d2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
35690e3549daffc20f1eccbe5b1b5b71

SHA1
d610ca682bebda5722b5df40acdb35362d7a2f06

SHA256
8e3bbe33bce0a0e43f955f23e5246ba2b8e49d4dab1cb0584cf1bfbedb08caaf

SHA512
5ba16aa7c7cbee3b7a49186989ccc5ae3e14ecffe7ede9f4b5d268fa23015644bb3f35c34f72042433b10a6ea4ede0b2304df1a8f218393b5fabc870f2dd35fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
364f6d4307934c29905889778919fb42

SHA1
fc03a7dd5cb23f496d33dfcd150b2c8c2accdef0

SHA256
f30dbb78b6dc4445ae3fd979baf5fda84952a221fb768529ba659518224f81b0

SHA512
aec2f412f839ec1c917a51f9e5a65c1bb0b6c18fc320df5837fee065080d5b8259fdcc8b5c0d12171d060820e48b484bab3dc6e3f2f20200f574d66b8c4c2afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22614f6af51600e4637b4a5660966eb2

SHA1
25dcbaaff1b038605b3a35d9df11ce0739125243

SHA256
b0a58827e2505a4c6628c157d8a2c096cc4677a2823569911f1e81635c1d4026

SHA512
c7568d25788abfe6a8b706fc0117417f0908d55ccce1c7321f6a46922e42a0dad382267bb39e1577d56b1bf28afbb796bc5d68879ee2503ace09788b8240d7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c28067e2d38921bfb073b5482febb01

SHA1
645d22af12cd6e768ceff4a4325c773dcf5abb73

SHA256
099e9c15865fcba76d558f77d6bc73b469519ceef8f45e7ec56b3189e6dfe9a7

SHA512
119805e640ce70c19f41a583c6269cfa74317b84be3dac2b474bb7da08d6e2a1504bc5327daedd76eba4d228d144c8ff6d8f40e292e459cf6b22e020eeecd92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e185489ca87b1c18e7bddf68e2fda271

SHA1
26b8027b99d2ee3541d3b0d722248ba3d0328eeb

SHA256
652a4196b1cc8053f0ea9261a095239ca61713c0835da7eb766265487b17fde0

SHA512
1316724a6accb10ceb3895300724f1297eab74f707ddbf3e593d199932238c1d24168e561bd3d7ca868214d02be885c0a7495ae5833b03553ef83f02aa788e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
667250a185f7741cc55eee49137c4a9b

SHA1
bdba4a026802a0c9f2ef39df5bc42ab9c05476ba

SHA256
0ab236fde8fe734bf30e3b8225ccbdc873f14ee8c30d868020c1539751f890f5

SHA512
866f0a3d710eb2d246b47450567903ed3d59691fe321589aba9862b129e920fced0f31891dee70d7e2945ad05650a1b82b6bece7ab3b0b25f520fe806a6883c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2060fb1ff87fe92b335fd95e01a57612

SHA1
18f6cce121e5ea22eee26dd02961f89fad1c8124

SHA256
e5bf190448e5e3c7819b1afef1f0d0046c0ecad9bd572634e4c46a5463d8a81d

SHA512
83dc20d4af02bd76e9a163b8ee5bd74f7d2edce7806dd0da538c80425f3d2a165f77fd37a02a638fa08d03d29479750c278a03a72988cf9b47c8c8dba5d1d933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
1eef93b41ecf7374953d224f25efbbc3

SHA1
532350036284b1fcc86f0557f409c61b0daf5d4c

SHA256
3996931fbf71a7c33e4480f2111dabe176b1a6563bebabb9cdac15133c2a5a4c

SHA512
d4a144947228aaef021761f29e585c3440def797d6d84c4eb98cd0153a4fd272b17411b4e2748ab1cbcb092e7ea8601c56371b487d976392937bff815fb3506c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
c1aea5803ac435056f485c3b46514dfd

SHA1
e355d2a8aa6bc5b583ff5a34e99a17adea8470f8

SHA256
84f71bd80de181b69eaf21be7fbe62a4aedbcfcb63b2fc863e995dae7918cc7a

SHA512
4f7fc4a35c6bd44e8072387556e377b5178cd927f7c1776da28f4be0385915203151aa53fe9f00a272b3b91cc120f3253873fdef9045d8e75b05dafb54181404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
92cfe9c933d1284f8e8404de5b419e73

SHA1
276223d4ffd926c64984368e15822abc5dc812ef

SHA256
955dd8f0779c588244a95494824e10cfbaa53991271409eee224813d89f9ab7f

SHA512
c204e4496951f54a0a4b1d64f811eff4703305532386b5cbda203c701a55be3bf327c2a70b87bfb4d37af8c67a762e6c90ac6e829bc90e57e45c5565261f5f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aae6.TMP

Filesize
706B

MD5
d9aa25d330ceb61d96ade71c09871bb1

SHA1
e1b7b6653e3294755df7eff7735480442af3bc21

SHA256
ab2aff7f61ebdac4282e625aaad69272a836817396ebaf82d3fa0ac8f29d99d9

SHA512
cafc8355ceb7aaed2b7fca5acc44ff7491e6ca9f3968cbfde00456aef2aa6e9f6d2c1e086dccfbe9d215d7fd7ac0d60c769980c4978287eb331724e12e310c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b118c72101b4948ba0e68c7e7cbc62d

SHA1
4ca7e6c6ebb1d92b12b371efcb43824cf5c0c5ef

SHA256
ed4a4a8e1645b25160cfa05bfb6e690a9aaba500bc78ba2420e8f381e530376b

SHA512
358e0094df6eea348ee66853df4732995a57b59ab2bc397210491b3528f4b382b5633ae9c14109fbc53f8d02c540d43b78eac3e4bcc62bb559d2b70e9d0156ad

Download Submit