hxxps://u13582634[.]ct[.]sendgrid[.]net/ls/click?upn=uz37ecHAwdhJVAQRRlsQRXszDaeAjvcN9FVx5ZRyPBvOHBzxMkL12KluIp-2BW4yMZmcFM3cNDJA1H0cJU0J73wvZw7bND-2B9c3tDEiFLkwOJc-3D43QQ_AgABOh-2FeA5uFhvs2otF0WHC4CL7gqejGRg3gngUAvCxTv6fNEKWUHTKoUdFXg8bV9LPPXKjCTiaX9IFtq0kUpS51xbUrajkHWkAf7aOUUHT0MaB5raDLaIB-2F7YEUS4Dy3A0jbsXyJwUvUAT-2BFcceOmDCGKQuVaxpNcvizTPP6gnIq3P-2BgazTlH7V0pAVBpDgfZzf70g6SHU5LdC8U6zNcrPlzGwED22G3MUclZyI5lM-3D

Resubmissions

21/08/2023, 15:40

230821-s38yesdh36 1

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://u13582634.ct.sendgrid.net/ls/click?upn=uz37ecHAwdhJVAQRRlsQRXszDaeAjvcN9FVx5ZRyPBvOHBzxMkL12KluIp-2BW4yMZmcFM3cNDJA1H0cJU0J73wvZw7bND-2B9c3tDEiFLkwOJc-3D43QQ_AgABOh-2FeA5uFhvs2otF0WHC4CL7gqejGRg3gngUAvCxTv6fNEKWUHTKoUdFXg8bV9LPPXKjCTiaX9IFtq0kUpS51xbUrajkHWkAf7aOUUHT0MaB5raDLaIB-2F7YEUS4Dy3A0jbsXyJwUvUAT-2BFcceOmDCGKQuVaxpNcvizTPP6gnIq3P-2BgazTlH7V0pAVBpDgfZzf70g6SHU5LdC8U6zNcrPlzGwED22G3MUclZyI5lM-3D

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
4748	msedge.exe
4748	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 368	4748	msedge.exe	18
PID 4748 wrote to memory of 368	4748	msedge.exe	18
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 2368	4748	msedge.exe	83
PID 4748 wrote to memory of 1020	4748	msedge.exe	82
PID 4748 wrote to memory of 1020	4748	msedge.exe	82
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85
PID 4748 wrote to memory of 1204	4748	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u13582634.ct.sendgrid.net/ls/click?upn=uz37ecHAwdhJVAQRRlsQRXszDaeAjvcN9FVx5ZRyPBvOHBzxMkL12KluIp-2BW4yMZmcFM3cNDJA1H0cJU0J73wvZw7bND-2B9c3tDEiFLkwOJc-3D43QQ_AgABOh-2FeA5uFhvs2otF0WHC4CL7gqejGRg3gngUAvCxTv6fNEKWUHTKoUdFXg8bV9LPPXKjCTiaX9IFtq0kUpS51xbUrajkHWkAf7aOUUHT0MaB5raDLaIB-2F7YEUS4Dy3A0jbsXyJwUvUAT-2BFcceOmDCGKQuVaxpNcvizTPP6gnIq3P-2BgazTlH7V0pAVBpDgfZzf70g6SHU5LdC8U6zNcrPlzGwED22G3MUclZyI5lM-3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bab46f8,0x7ffe7bab4708,0x7ffe7bab4718
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1890408182829800646,6444862606196447950,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
541851361a9bfc3baf70eb3aa5d1aaef

SHA1
9e2dcd038655ec436b4b38d4031c4e18443f797c

SHA256
9cdaa8d4e36bf6306d4a0457b7f5a58a1580d716989962d92e17d91cdfdd128a

SHA512
ffdae93de6ff0ca4695aeeeab185e5eea670ed67ab09b2a56a4240836e963bb27b5b34f77daf04ad5e721d29bef4d7129a25681114a233824314eceab12e4150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
272B

MD5
642e56791957d321541df55e96a474d0

SHA1
1f3bf66c9af5a1c76e7c55c22386d3a3be084b6a

SHA256
48ee85e8a75b5b6ce077b1f409a1fb86aba122a239f5d56988427728f55bc9cf

SHA512
e7e8844d2643e67e07ab20eea2edc0511440c6ae8d58495768397137e23f4059e795aeb7e3b5fc862303b3594d9858180b0b582f1b7f020c309bdb71d90aa41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b7ff2f0d26d78da099ff23e19ffe4c4

SHA1
cff6bf8e06ddca08702683cddbc8ce03924b5225

SHA256
b2b3086e3a104c5546760f58d433efbf296e3ebbd20092fe977ebfb901a9eea7

SHA512
ae00c5b8eb1dbe29745f1d9f57df0a81718c8cd6b0f2f4b6c5891b9b0b32ad2fc71b0dd9938b9a457d9b50483d0d0c3e446a1569113f1dae344031af42d0e38b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0be98fee36601c9113d3e534d2026f83

SHA1
7be8acd3bd31452ca4b8239a496e452ccd8fd835

SHA256
8067db19758b7e15391b046ab8d0b6fc0309eb61d74021a387eee21a0198e8ef

SHA512
0aefce6b39c8d2a3df751f717df64ee7a82d081607e35bb925a30329061906be9a95f6c08766c54a301de76e7962b16a7864b964c21b2d3272a765efa5d5def1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0e231849fa51835a2a9199535b4e80e

SHA1
f9e7788555dc84d8056abe24489b243e91f09076

SHA256
96645583268ef4cf179c510990d1813faafc61c123cd27d4c84e10461ec68aa9

SHA512
fe35dbad8fe491ae237c1aa87aed4c6b9b6f8598ed8ec1dde98e554cef1b1cead80a57eebd9d28d0ead4fbc5fa22aff3004519813c51109c5d16ad9ed16469cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5e0a8aa6be0e1ed224539ea7d5dcd39

SHA1
7f29c23a2d517ae81e803716cd1011d9f020f6c8

SHA256
dfa0546dc42f03cd886116635572addbb5cfff0aeea25a2d175f7224cfaea1e5

SHA512
dd2454abf5427fb53988fcd5eff531a9d675777bc7dafddd66d9cd8ebdb0ef8365fef82521102f60cf75aaf76141f5a2cb1a024e93d5fa136dc8fd5f919ade31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc3ad9d68f2a4252c7f109fbf949f17b

SHA1
0690f8e9db38caede09d30c3b5a1e4bc3dbd19ee

SHA256
88d3baf39438fd6182713d8228005b49ad6043cc6fc09ce6dc7d3eb38ba2edf9

SHA512
cf117220857964a5cbcdd38715fafdf007cf9d63dddd555371f1ea19112744bbed2df753a535bafff339b0e6129f57d4eacec4f5338bd7d586e8d7bd8f692d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e3ef37f4694dbba1db75d16b92e45a53

SHA1
9adcc83d70d854174d620f542b9ffd09c312c5b2

SHA256
ea477c3eb3988e3522c9911bf73ef1ea6be6eca45af3077d878d46b8f0f2f25c

SHA512
88da8c045511943ec9d10b1abc3771f854fb202f2d78ca56f902abbc356004aabd8a080de00da55ff7b55347e1c898d112f4f44f7ecc441eb97ea7619e24d357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dc558cda0eb3a5abdaa96f184a4f7c81

SHA1
8fb1a4198bffdb13df0a6fc84ff91588e8ab92ca

SHA256
f0a7842701ed23c8a0b3cbb825f28daaa80b33ad24d0d0843a1d6c3e8c5b77a0

SHA512
9a2880a7a66682d8145df88548f4c35bdaee70638faf4004575727060a5de1148eb293783ad5a46c6f9090aadd472b4b13a4bc2dabafcf14be2c384ae83fd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
df631789d108132643fcf315bf9ab0aa

SHA1
932f615c745513300933991135dda8187b00ad50

SHA256
4fa59a83795fab9b2da2668a0b1c4099460535bc5ae545b303291d2c63369beb

SHA512
95746c2c777ae25bc7c7e8ecbdcc91f8a2074d2559e2ac1daa2994db8b680146931db8e893fa63be2f35f8396e4dd6df2077060f26c97a67c1004f79fe1bb492

Download Submit