hxxp://email[.]voxer[.]com/ls/click?upn=hTzayJPyjsonWcQxe5uNQxOWhzzoyb3wAwDGLhAUHIUYjIaQ34KG3Ww7IUbEVZu14phT-2FX1pK9HaHTZLWDACqt2dIOBkssf-2FCv7wwPimtNOpQLAnPip0SoD4fSze3J4QsuUEXvu2IK-2BZEmtROeBza2aYXBQORmOxcOyaXc-2B7OYx0eyyYSZXh0H93iYpgkTUoRSf9NpXRlV4n3r6VMRWPcFdo7QVgI9IHSm-2FKVQkuMqw-3Dukll_KHoBh4VGVzrvIlR7zUMzJSJKttYFJQ56XGQFVK-2Bhd301VjywQ7CWYiUHTLkttIM-2FAmQvlSQXzL-2Fv6zSAY-2Bxv7UJxynp0Uj7jpMWMrwGrSQq-2FYixQIdbU0YPiZ-2BoAsb6yVGRZFgIOlE3OuLEGIyT-2BDk6LXdvByqyZIw-2BERWNTYhJfpX9-2BruvDvWl1tUaa63vl4QF5ArPorxXTbOAr6N7hRg-3D-3D

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://email.voxer.com/ls/click?upn=hTzayJPyjsonWcQxe5uNQxOWhzzoyb3wAwDGLhAUHIUYjIaQ34KG3Ww7IUbEVZu14phT-2FX1pK9HaHTZLWDACqt2dIOBkssf-2FCv7wwPimtNOpQLAnPip0SoD4fSze3J4QsuUEXvu2IK-2BZEmtROeBza2aYXBQORmOxcOyaXc-2B7OYx0eyyYSZXh0H93iYpgkTUoRSf9NpXRlV4n3r6VMRWPcFdo7QVgI9IHSm-2FKVQkuMqw-3Dukll_KHoBh4VGVzrvIlR7zUMzJSJKttYFJQ56XGQFVK-2Bhd301VjywQ7CWYiUHTLkttIM-2FAmQvlSQXzL-2Fv6zSAY-2Bxv7UJxynp0Uj7jpMWMrwGrSQq-2FYixQIdbU0YPiZ-2BoAsb6yVGRZFgIOlE3OuLEGIyT-2BDk6LXdvByqyZIw-2BERWNTYhJfpX9-2BruvDvWl1tUaa63vl4QF5ArPorxXTbOAr6N7hRg-3D-3D

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
1324	msedge.exe
1324	msedge.exe
2556	identity_helper.exe
2556	identity_helper.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1020	1324	msedge.exe	50
PID 1324 wrote to memory of 1020	1324	msedge.exe	50
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 4380	1324	msedge.exe	84
PID 1324 wrote to memory of 3852	1324	msedge.exe	83
PID 1324 wrote to memory of 3852	1324	msedge.exe	83
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85
PID 1324 wrote to memory of 1072	1324	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://email.voxer.com/ls/click?upn=hTzayJPyjsonWcQxe5uNQxOWhzzoyb3wAwDGLhAUHIUYjIaQ34KG3Ww7IUbEVZu14phT-2FX1pK9HaHTZLWDACqt2dIOBkssf-2FCv7wwPimtNOpQLAnPip0SoD4fSze3J4QsuUEXvu2IK-2BZEmtROeBza2aYXBQORmOxcOyaXc-2B7OYx0eyyYSZXh0H93iYpgkTUoRSf9NpXRlV4n3r6VMRWPcFdo7QVgI9IHSm-2FKVQkuMqw-3Dukll_KHoBh4VGVzrvIlR7zUMzJSJKttYFJQ56XGQFVK-2Bhd301VjywQ7CWYiUHTLkttIM-2FAmQvlSQXzL-2Fv6zSAY-2Bxv7UJxynp0Uj7jpMWMrwGrSQq-2FYixQIdbU0YPiZ-2BoAsb6yVGRZFgIOlE3OuLEGIyT-2BDk6LXdvByqyZIw-2BERWNTYhJfpX9-2BruvDvWl1tUaa63vl4QF5ArPorxXTbOAr6N7hRg-3D-3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93ca846f8,0x7ff93ca84708,0x7ff93ca84718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3632439816878651280,17214254191673327075,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e8152d787756fe1c46553e5cfdef1b12

SHA1
c9396e49cd7273091365919c15affa0f92fad24a

SHA256
4772e104b270734844f46c5384fc0ff7da79d7485f0c0c81dd307c1706d54876

SHA512
8efd35cd21fcaf89a66b125cd21b5d36a87fb7a1028e115d0dc5c218dca271ec0ab9da88abfbbbdd9f711f409dc72d23f96230521f792c0c75b9eb9e3a6adee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
846B

MD5
8fcb8c6124a84f05446c41ba64757215

SHA1
e1a732333dc35c42b4ef9ea90924c44ec676f2e7

SHA256
99be372804f0c11f93a7e7423f1bdf3bf5af92fca4f8401f1247bb185f2a4ce2

SHA512
3e0658de72048ec587f5bff403101d5d1b3e19a64fd68cba52f8e8a3a3fe1062981427b551cb5b10a7a4d1bc4eb584e9e2280290cf737628b24fa1f81c84617a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b8ebed69465f2a4934fbb2f0bb72c30

SHA1
f4b9208d93af57ca0b316eedb39e1535e033cb7f

SHA256
7ba4c750cc4ef6116a77f5c3e1530bd70540de54f45f4d7620fb1f791bc6d62f

SHA512
e4942f9ec1437225d8e4bdf1ca46469187ecef2f62273e80c00a56ad8ed609f3281f250bf847d907c28a46de232d5d755638d36e3cf9df1df1f2142238e59ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b4c104931134bdd6ed7fd132fc877cd

SHA1
ad787a9e181932f3e79853bf5eecb1de0b36d47c

SHA256
818608ef5615683dedab50e92ebfad6555f29da36c4995edd640f42ffb6920fb

SHA512
28d88b05235a3c198879d21c48bae1c904d6e4447a3164d555c6aef7c74336694c99063c33e39f2f8b9bc57499c5098bdbcfef12c866eb98609fdf67356361fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6d77316678aa4527bceada3699f82258

SHA1
80db4ed400adc0684ed36e545c3ac05e2c1a9995

SHA256
2aaabf259ede1a3290c85bf7bb108c6feb0d77d5308c43bb5a75d280b190f9c3

SHA512
723a3b95f2bf0695d60d66df911b1ab35c0367edfd44f0f7288dcd4b58a66fedabfd4597580394264ea5ebc501f8954960ac5166dcc6df3a5ec3eefd4a8ffdb2

Download Submit