hxxps://estudiomartinezleyes[.]com[.]ar/local/v3/js_host/xlsdoc3[.]js?v=568933&e=bobswansoncalendar@ameritas[.]onmicrosoft[.]com

Analysis

max time kernel
310s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://estudiomartinezleyes.com.ar/local/v3/js_host/xlsdoc3.js?v=568933&[email protected]

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
3828	msedge.exe
3828	msedge.exe
2224	identity_helper.exe
2224	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2848	3828	msedge.exe	83
PID 3828 wrote to memory of 2848	3828	msedge.exe	83
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 3440	3828	msedge.exe	84
PID 3828 wrote to memory of 4416	3828	msedge.exe	85
PID 3828 wrote to memory of 4416	3828	msedge.exe	85
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86
PID 3828 wrote to memory of 4916	3828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://estudiomartinezleyes.com.ar/local/v3/js_host/xlsdoc3.js?v=568933&[email protected]
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff25ef46f8,0x7fff25ef4708,0x7fff25ef4718
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3136 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7175317436682854917,12796233416472640909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c17d1c2e91e41deb03bb6306cec314b0

SHA1
85492f8596f63eafefd69df3ef473855d23631fd

SHA256
670b35861ae12ef4973421fde5090db1ba9a9f9dd8a88cc98181fe9fee3b9fda

SHA512
9a609f5f0e7de8e57d59883b00ac3e9b309954e069ce89da7159efe451269b08ebf10f7c43e54e015e19c4160232dc53730cd964d65287ce26620dda24c82bd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
195B

MD5
af1ba2ff87a188e8264775298505ad9a

SHA1
6eb17da54594246255362f35abb3ea4380db8c07

SHA256
dab87ea0c86b810e236ceaeaebe34b3acf71ee0548c7aab29ce0eaf9397b3213

SHA512
cc37b0d4c35bba10c9f7d5d02fd0640854383e201c745f0b27bd0e44de16329ad839f76a5ecdf9713ca69b85e0c13f5fd66f39083d2aa3d99fb4370fa848ac10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
195B

MD5
2eff436d4984cc44c6fd47e47df6118a

SHA1
2bcb999375b0abde714591eaf7b6927d85cec0ff

SHA256
632a97f6c0871da946593adb98415684dba7f1c7c23b158e9715a99b166a3875

SHA512
183168df772c8c6aa5158a67075c958fbd050fda209ed549582f0db0a089243f8fa1dcf2d524c9ca1d8031689dc8adc102448bbd6f9b39770525e66b3999cfd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c88b07d23794532636ae2cbc9690d4c

SHA1
069636be1a80656dd8f3057f5a5b42da978f8530

SHA256
c8b26f4a7defea356fe70f32e1cae6e31e05e21dfdb7fbf91301e2da3733d47a

SHA512
8cf3d6c9d1c2e476fe7fb6131c25919d795c7676335540f6fdb8fafce98613b7373717c35d0dcdead8ade4c5b89d4b80293150a11b55092678ee95cbaeeefd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07ffb1f184ecea7d2645227cee27a77e

SHA1
67e74b008913ebbf328ac433c524a3812e9cb433

SHA256
b7e1d72e10e712c0c3c37239e9583c024d7ce5576b6563e1cdba8b821d9d955e

SHA512
5aa97e7871c5d7a8c5683aa124297ecb50bfbccc4f9d7cc2e88455900308e213f3edce01d4460b80bc7f4b8b6057a20f8f7720c38478293b5998f02e71ec1b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd4aa118ba67ce4caa5cb8cbde72d774

SHA1
18662905d30a022f0094aec61b9b7779a939ebcb

SHA256
c7b22389fb8182a9b879220043e8f74dcce1bb41eff4482a5aec29efc80a2c31

SHA512
a88284aa584be9864363fcb2c8dd6e5b5df67b0d5cf95c25699f8d48d0f87d3d800bac7082383336a3830469bec0d702bcda07fb30c6e98a88b5b1903e6b0e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f220854173f1955aad8f02b0655384d6

SHA1
dddc9753f699363e7d837b94785f6b0e3dfa8899

SHA256
4c3a6fd3b302f31dcafb527d779d215863f2d6d16a18c90b245f857f60c5a274

SHA512
745d85bf36fe2aefbec1b71582349423659dd733708ffc7d59b9909b0001cf12dd5e85059f9699879bea358aa5c423f09d4985615bb80caa47a381cf7e0ae8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1f76327f5ca2d886d8971e9abea38af

SHA1
f75dfbc54396ed6e26a0c5041923e2a00cae1445

SHA256
62b8245ac624a5b7c1697d2c129244d2fe2718df8bffa2ffc4c537de443d68d5

SHA512
c7264d1343497b43510a464521580f0c7b549731f970d2bf768980cca186712c69413fe77046e6aead595750709a254853823c3d68b26aa1ee66b052eb5b3498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf18aa610f4ab82df52a168e34bdd8fb

SHA1
e084178775a3603ce3dd0a4060abf3afb64ba224

SHA256
95f1341cfabeb00f1871ec98a0d2295913d9f1d437858b5c659b0216024ce2d2

SHA512
d1bc8239c8216a3358275c4c5fbd0cfac89422dd5d7352d2e2dbc5cb20ccc151aae9b3ff7a4b336a0320f4c0684a4a263f82070c97d195a7ae7db2d53e874fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a4da8508659b5c625dcffff528926373

SHA1
4e1c6dbfbf56f7d038cf24364a4dcab6364f1475

SHA256
6ad37baee5335c1587d56c2c7d699ded7678da63ed6113276687d16332bfd4ea

SHA512
a2150f1ade93f0848df05df874312e0002d08a6b4a35943261bbc26cb2a34173660465112ca7a8deb9384253d06a8c7f7b1ed46db838a4f7421ae47e58e78115

Download Submit