hxxp://url874[.]learnbrands[.]com/ls/click?upn=kWyqXjpRjHUmB496-2FITBxUgh4FhKJpJaRCKpnbpTD52eWPILWcWe6V5iTM1KDiG5MCOptG2-2BMHkvF-2FzLQuHAdBwH33h-2F-2FOi-2B16mDgMuYmXHFrpat6F-2BwgttN0ZsDspsTgrfCkvZ0kGjtx1rZ6MCc7w-3D-3DFx1O_IKD-2FWztUpE2MDmwtMMiV1452bmbg4avBukMWIXdTqZike3srl4RUSI-2Bl9Su4QKL-2BgHDnGkfUSFKq5QpJv-2B3L60FusKKlg3VzGIsT4eHjv-2BoTVvy-2Fp-2BKPyznRdcJDVT8CI5iVyYm1RFhNP-2F6ad-2BZ004exQQFMbhifcrkRaZLt1CS5gZ-2BWgLHrGDoYmkHOecQV24DCAgBHXJwraVGWjPFzvZUthS9WT7-2FKybFXhf74Wrc-3D

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url874.learnbrands.com/ls/click?upn=kWyqXjpRjHUmB496-2FITBxUgh4FhKJpJaRCKpnbpTD52eWPILWcWe6V5iTM1KDiG5MCOptG2-2BMHkvF-2FzLQuHAdBwH33h-2F-2FOi-2B16mDgMuYmXHFrpat6F-2BwgttN0ZsDspsTgrfCkvZ0kGjtx1rZ6MCc7w-3D-3DFx1O_IKD-2FWztUpE2MDmwtMMiV1452bmbg4avBukMWIXdTqZike3srl4RUSI-2Bl9Su4QKL-2BgHDnGkfUSFKq5QpJv-2B3L60FusKKlg3VzGIsT4eHjv-2BoTVvy-2Fp-2BKPyznRdcJDVT8CI5iVyYm1RFhNP-2F6ad-2BZ004exQQFMbhifcrkRaZLt1CS5gZ-2BWgLHrGDoYmkHOecQV24DCAgBHXJwraVGWjPFzvZUthS9WT7-2FKybFXhf74Wrc-3D

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
1652	msedge.exe
1652	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4452	1652	msedge.exe	39
PID 1652 wrote to memory of 4452	1652	msedge.exe	39
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 3984	1652	msedge.exe	82
PID 1652 wrote to memory of 996	1652	msedge.exe	83
PID 1652 wrote to memory of 996	1652	msedge.exe	83
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84
PID 1652 wrote to memory of 4656	1652	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url874.learnbrands.com/ls/click?upn=kWyqXjpRjHUmB496-2FITBxUgh4FhKJpJaRCKpnbpTD52eWPILWcWe6V5iTM1KDiG5MCOptG2-2BMHkvF-2FzLQuHAdBwH33h-2F-2FOi-2B16mDgMuYmXHFrpat6F-2BwgttN0ZsDspsTgrfCkvZ0kGjtx1rZ6MCc7w-3D-3DFx1O_IKD-2FWztUpE2MDmwtMMiV1452bmbg4avBukMWIXdTqZike3srl4RUSI-2Bl9Su4QKL-2BgHDnGkfUSFKq5QpJv-2B3L60FusKKlg3VzGIsT4eHjv-2BoTVvy-2Fp-2BKPyznRdcJDVT8CI5iVyYm1RFhNP-2F6ad-2BZ004exQQFMbhifcrkRaZLt1CS5gZ-2BWgLHrGDoYmkHOecQV24DCAgBHXJwraVGWjPFzvZUthS9WT7-2FKybFXhf74Wrc-3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7be946f8,0x7fff7be94708,0x7fff7be94718
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3918285538159531941,9747209620643716817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f86abf246a79caf5eba9fdde6c5db953

SHA1
4acd25ede2e390320ca208ce25f4970a4eb09b89

SHA256
f19a8d83dc678a4958d178e3d371b2aa6e958ed6d7a6579362a9d25c3b8e8a1b

SHA512
6c0786914c60146f9c6a71fad91ae93878df5151a087d8b042614b53ca889307b2a293a26f0e853675d18baaf317aafc8e304f77d11f864ea7a9dbc9fa1ac2c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
767B

MD5
146580a4290fddf5be0d0fbaf0e3b7f3

SHA1
8d24e07a615a5a9094b3feb84e95d2f33f929cf1

SHA256
e36d7a3c6996b61bf1f9cfd7ebf1c02780e3cb6af75de7cfa4ff64dd761e9644

SHA512
39e012aa39a521c5afd74915aab1eb1215d58b4c6884b72ceab890d1452760ed57188015d7838013b8d66d32f611215e5c13ee44e7688e06b8ae90c5e0f6cae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dab263142f9017ca98bd781240d67184

SHA1
99f8ce1a668fcd75e9939a0009c955f93b44dce3

SHA256
63f9d550077bdfd04b02716550961912d6ca0606f2acb5d279e0d6f26e9fd949

SHA512
a206f5c3af1e553a2231a5d11e5e1086bbbab7abc1665a81058ed7ddf54b63e6f6e4d326636c78ba85345829976f50f3084b965ed997e5e443c20ad60719e03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8d9023d19f27649a225cfe86cab42d1

SHA1
978ce38022ed6f7917059ebce4f0f91bce5e5fc3

SHA256
777dc2f95d00243aec32ead0b8b3e2521ea94a0cdecdbef38d961938f6bcff7e

SHA512
3e83b7b7429e28aea0819a589d81e30fba94b6732e446fd2a16584c5efb4efedc74d5390ee808694ac5095074b3df3e2a1641ba15b9a6537ef447711cf660045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
888791676c5cbfa8878d4bad9cfe7f13

SHA1
f21d475ef0fa654b510ebe80ec6f7fda0c74acc8

SHA256
56f5abfdac3efb31ec5d10cc4fb4c5683f21e60e91101449cf7d07e2731f84f2

SHA512
473e7be4fee2c0822d084ae0c6b709d0cc7397ac56000030b012a133d706551747810b778a043afe84c338d5004ebd56dc4eb0af45c6feb0fcffe480d9bfb487

Download Submit