hxxps://api[.]whatsapp[.]com/send?phone=51936631677&text=Solicito%20PDF%20Informativo%20sobre%20el%20Diplomado%20Internacional%20de%20*REINGENIERIA%20DE%20COSTOS%20CA*

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://api.whatsapp.com/send?phone=51936631677&text=Solicito%20PDF%20Informativo%20sobre%20el%20Diplomado%20Internacional%20de%20*REINGENIERIA%20DE%20COSTOS%20CA*

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
1072	msedge.exe
1072	msedge.exe
752	identity_helper.exe
752	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4056	1072	msedge.exe	84
PID 1072 wrote to memory of 4056	1072	msedge.exe	84
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 548	1072	msedge.exe	85
PID 1072 wrote to memory of 536	1072	msedge.exe	86
PID 1072 wrote to memory of 536	1072	msedge.exe	86
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87
PID 1072 wrote to memory of 4624	1072	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.whatsapp.com/send?phone=51936631677&text=Solicito%20PDF%20Informativo%20sobre%20el%20Diplomado%20Internacional%20de%20*REINGENIERIA%20DE%20COSTOS%20CA*
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8f2946f8,0x7ffd8f294708,0x7ffd8f294718
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15592375779987800484,12893718109666818808,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
03c13891e3464e44a68e9a3fc595ef1b

SHA1
3f95277e5f92ed75715ff7b7dc23b63a31a69850

SHA256
f013d68dfa45679cd13adc918ec64936c9b883983a7055f966a8cc9aa78a426b

SHA512
61c7837bbc85b786ed17675cbf2695fb885e4c5aac5220242e08f63864c1ba4addf785af8c29c48ac4edd3fc246fa8b88c52da0eeea85cde0058476a445b37ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
25465b15b7154c9e177a64ff47c53d9b

SHA1
989170c2af990e76642d8e40203ec8e4aa9c6034

SHA256
a4f52834957d6aca6e8014a47ef0528112d6cf31ea100d0fa7103775ea6ceb91

SHA512
57edeab61b3ce7e445d1eae762ec504f343ce9d8b87d88e1864c4c0815cd87e59b0e0434314b693fa79cad7ae32184cd6975081f83622d8fcbccfe272ac83e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dcdb91e9fd63ec56c128be7bf33767c

SHA1
d216f1b680d6d74134d905f9a267801c1ad96f7b

SHA256
ec064d158cc00c4a882e52e30ca308160d8f26836b82d10543158a20645f381f

SHA512
0b47f079ad5e8ddf8d50bc7496099c61f2f836a9881c7ca21b5d0e8741cf26f98584e4f78bc421c0df9899f0cabdfbf669630f24114aaef8f67534d96603e9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d392228a7886f8907ce154c54f1877

SHA1
611d94eae04d08a1392ca86a086e1072b8ab531c

SHA256
bb9dacb08f7d890b3c80073b877dfb9df07e594df991731bbebd5efcbfce7ce9

SHA512
aecc9931e0865fb1ffc0071305c968c67b648a621dbf3cdc2b1040f560e72dd0cf5c8fcaae6d3481b915144e04d53d1577ed75d251da546f82acb5e864f8dff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffa994c17d3a0584e7381f752e882432

SHA1
a3bb1761bd3888662b8fede265b7339b88bd3ea5

SHA256
7b2c14e84511e7e707d5b0fa9500d59ebca9043af15e7cef46723f923f6f1571

SHA512
a7cf3e640d79f4948a2628215e2e8d482ef966abfaa6c44d37a3512ae244628f86014cedc5b79b30dbbe0a9631f7e12d3da30bc88a426b2b4b1fa0dca81cee7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7b88849e0770da663b41ff6139ceebe

SHA1
bb073223ca5ef4f3eb2ae3f3c01a202579a52312

SHA256
5c86b913d69a326651e074eef06366f29b85172bade9b52d8ead59ac78706235

SHA512
775f9739a6d3fe12c633168ef3d8f9e819c31e15e184f271cb07e9591ce9f50580042a01a2baa8d3fbda235b020cfb4da2465325d976f28a040937a0e54058a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0fa92c3111c3cad10145d3bd3a950d81

SHA1
10eb367ff5ae25523aa357cc470a06dada458f42

SHA256
6ac02c353e26031adf46bea20dc66e804ced58b79ba38d56c75af567c7c50efe

SHA512
975d71aeb627bea9e84ab7a6b0d7df4d89f6bce85f543c4ab734ea6805fe6bf7cb7a9f9b1fa8aa894c1b7d66eb805d6ed75e9859429ec6dd9476e3c3dff87b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0a7a1fcc882740af013adcf8ef425384

SHA1
819ddb7cb34b1ebe6115c640e460eca5ed1c8256

SHA256
80a89bfdd3e12b88222a927fac9ce8581c0c7a50bafee41f51e9c4876174a796

SHA512
984723324d422372b41fbb07ab2a5fe3513daf30c4379fb17a8107b2f42da1d084536bca1532992f05838310655d361d14ae57f8b932d0fc611ec50a70d5baa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f38f22aad3b4bff881d251ecca52dac6

SHA1
ae5d3bef0cfcb7fb2c8f4efe48da350592207286

SHA256
5f7f268dd90d7704d0b73605c5f3cefbcd4767a14ff6bedfe61fe0ac935e8c73

SHA512
806a9b6da1407c784c242bc5323464e3040556983a41bc0382e5561d491c690defd918ff699704b3ec5a8b1562098a5a0d3dffea98d218f1892b96d797d57ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cfe3.TMP

Filesize
203B

MD5
9d4fb2a2283f3f18a8ae72f40da21835

SHA1
95c852191c8e630af47b05e371e148be979ccbf9

SHA256
43be1d64890ad13945fe71205c98e4c0bffbf93bc693450c8a5e7fef8312fd39

SHA512
34a09ab47e73628926d8409ff2e996632204db474142bf2a1377c526d5f9641be152393db3d2448ef27a5c4ad88d5ae885e5201139dd443b38947d4d11c86018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b265e55173a19e0e8b0296bdd1a36ef

SHA1
df8bea5d3f94aaa4873d5f06e5c08782ba5ead4d

SHA256
735fa7f85c842734f3f0e836c01767cdfa993e13daa50c6246377328d8be40e1

SHA512
a5338fe02851a55a0c6f26e9c9f4c882be5b84ac255c092f625daf44bc8a2d4d291e0089b512fab9b1feffcd8b4aeb9e2d6c58a8963f959c16306436ba6e8d5e

Download Submit