hxxps://raw[.]githubusercontent[.]com/proceso05/Conciliacion/main/Accion_Legal_Proferida_N%234567890987654[.]tar

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/09/2024, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://raw.githubusercontent.com/proceso05/Conciliacion/main/Accion_Legal_Proferida_N%234567890987654.tar

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
12	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
2968	msedge.exe
2968	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1276	2968	msedge.exe	82
PID 2968 wrote to memory of 1276	2968	msedge.exe	82
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 1476	2968	msedge.exe	83
PID 2968 wrote to memory of 4016	2968	msedge.exe	84
PID 2968 wrote to memory of 4016	2968	msedge.exe	84
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85
PID 2968 wrote to memory of 1692	2968	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://raw.githubusercontent.com/proceso05/Conciliacion/main/Accion_Legal_Proferida_N%234567890987654.tar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb66946f8,0x7ffbb6694708,0x7ffbb6694718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1440 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3317918588930809118,5984658819396884232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
5ffc5e323afa02fa0249ee41a36e75f1

SHA1
c39ff6f29d73e13e6828c9984b880504bd7f2cbc

SHA256
45b00051e5fb7f6f0cc09b992bbcb2c99264b193e4640c276dd4962182aa065f

SHA512
022f93f3cabd010527674eb1c49f26994dee9d685d86cf2135479641e6b3880e2b970b7ea71eacf26c9ab77b677b42db046d0c2f9e8841b5dadc3b08ed99af5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5d8164132ab767ddc70c12e5abed4c94

SHA1
8a2c2620d481c2df9ca770fda82d987c28bb4676

SHA256
80b32c5e5debf7a0cfb3b4f0ddb276b19f6a61f7da2daa1a82335115d057f7fb

SHA512
c15f210390fdec1c35ca7cc32db7068e9ed9eb0711f92fdec452de66afeb7b781d097e7ef635d8974cef03b64df5471200925d5ea380b79dc8f1416bda5b04fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b643d71daa7a2827a17f11f41e2a9844

SHA1
804e03b5b84dc780f0b72992d70ac8b4356b10ea

SHA256
073b61901c5773ee5c655b0f24780c56b5d08a1d9f80b26597b6a6b3060b8ca5

SHA512
ce677c0bf0f5b9dd6bc09a8747c93cae5026a3d96bfece4dbdf7481d992e50da225b731fb785e0658ffe6279ca6dea4e316ddd610b68701446dfa003d4f11940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34046651150e7976084480c78bde131e

SHA1
b63ae5b1eaebad992b2aeeab2bcccb1ab0c8ef3f

SHA256
e67db33f9649d3844eabe788a4eb85eec5e30262dbab2d79cbbff41067229e05

SHA512
d981ae81a4b9d0184e6979a4b2272709468043c54feeb07dd08ee62cb3fc5acbc13442c35967763d9970b69068b7c0f12eb617d199448c28a15d9498bdd799c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e6c79e9a547e39fceb83d2808455ed3

SHA1
cfdc7489aafe1a20e83f0d82019c527a69171197

SHA256
025effd5cb9cf3d42612c90c957c568072db1aaf33c97fe9d54a7959bd8f059b

SHA512
297a1663088c35a853d42c659fbb006d165b1842f86078e2ec203eae07ad9c3f1d2f062c309c57f91860296973f9188d99d35ae1552cf83eccb7ca483b5e0f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a772a2dc6ff7a8614e0e0ade1b8c9b53

SHA1
6678191c09496b0d66d1a928ded692eed8a71fcc

SHA256
1ac0e6d42e42dc491061a2580df597034069104240f6adcaa19a8836d77c91ae

SHA512
9c89ae4205b3299c0d097338a8d54e31ccea9f7390394f6c21a45114e20a8a4bffba07e44fbd35201afe8e41045dd35611649b8917a399ffd00b77e1e6fdf859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6e526ff65f4631d62acc7151c63a747

SHA1
a6e98e4641aea0777887c06bcefbd0084583c4f7

SHA256
8fd33c748da8183b450f8a49321c15ffd76974c61b5c5239abd6e1f60e646ce6

SHA512
2d149a90aa72fc985f4ccedc5c6cb2f94b772e3b85d8cbec20d78de216cce4ae7edb2d2c9059e4d108130efb04aae3c10b973991bcb2a979398bc4335ec0bfb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a052.TMP

Filesize
204B

MD5
e94dc7bf749ccc36ed3ae6d6ebfbfdce

SHA1
a2d1266006b06aba7451fadc80adb9ab82a21b1d

SHA256
5ffe549117ac41d0a15e9401319c09c45457591fe34906c1ba4a3c552e0b5f38

SHA512
4b8322458e549b62dae1581d480047e4ead34c23ee2a91ffeabacb201bd07db1f8fd4acec4cc3e8554ddb490f72971b0ca9714a33acdabcd89ae0159a25a7f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73b2355ad26647926f2d0608f0c5b781

SHA1
ba0abc990a74c9085f914cca8932ab78b2ad1cdc

SHA256
9fd223e3d9cd99eb46063621a76e9b095804d55196787daa26027311594533ca

SHA512
a8983a169a26ed9cf21bb36ec2ad20f73d0e9641d020e0a7cd7927bcb62a6f6adbba7172037e28890ec698e856724c5ef3804e9b5745c23d5df533ff01f58f7b

Download Submit