hxxps://mandrillapp[.]com/track/click/30195602/ewizcancepago[.]americommerce[.]com?p=eyJzIjoiRTVRc2ZzRW00TF8ydDhtaVoxTFdhQnc5WHA0IiwidiI6MSwicCI6IntcInVcIjozMDE5NTYwMixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2V3aXpjYW5jZXBhZ28uYW1lcmljb21tZXJjZS5jb21cXFwvc3VwcG9ydGVfaWRzXFxcL3VyZy5odG1sXCIsXCJpZFwiOlwiNTYzNjliMGVhZWQ4NDQ0NGJmZGNlNjk5MDdmMWIwNzNcIixcInVybF9pZHNcIjpbXCI4MTljNWVjZTNlMWUyZjNhZDhjM2RkZjcxMzVmZWI2MzNhYTE3ZTBiXCJdfSJ9

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mandrillapp.com/track/click/30195602/ewizcancepago.americommerce.com?p=eyJzIjoiRTVRc2ZzRW00TF8ydDhtaVoxTFdhQnc5WHA0IiwidiI6MSwicCI6IntcInVcIjozMDE5NTYwMixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2V3aXpjYW5jZXBhZ28uYW1lcmljb21tZXJjZS5jb21cXFwvc3VwcG9ydGVfaWRzXFxcL3VyZy5odG1sXCIsXCJpZFwiOlwiNTYzNjliMGVhZWQ4NDQ0NGJmZGNlNjk5MDdmMWIwNzNcIixcInVybF9pZHNcIjpbXCI4MTljNWVjZTNlMWUyZjNhZDhjM2RkZjcxMzVmZWI2MzNhYTE3ZTBiXCJdfSJ9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
2708	msedge.exe
2708	msedge.exe
3432	identity_helper.exe
3432	identity_helper.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1016	2708	msedge.exe	61
PID 2708 wrote to memory of 1016	2708	msedge.exe	61
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 4436	2708	msedge.exe	84
PID 2708 wrote to memory of 1608	2708	msedge.exe	83
PID 2708 wrote to memory of 1608	2708	msedge.exe	83
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85
PID 2708 wrote to memory of 2088	2708	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mandrillapp.com/track/click/30195602/ewizcancepago.americommerce.com?p=eyJzIjoiRTVRc2ZzRW00TF8ydDhtaVoxTFdhQnc5WHA0IiwidiI6MSwicCI6IntcInVcIjozMDE5NTYwMixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2V3aXpjYW5jZXBhZ28uYW1lcmljb21tZXJjZS5jb21cXFwvc3VwcG9ydGVfaWRzXFxcL3VyZy5odG1sXCIsXCJpZFwiOlwiNTYzNjliMGVhZWQ4NDQ0NGJmZGNlNjk5MDdmMWIwNzNcIixcInVybF9pZHNcIjpbXCI4MTljNWVjZTNlMWUyZjNhZDhjM2RkZjcxMzVmZWI2MzNhYTE3ZTBiXCJdfSJ9
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2a4b46f8,0x7ffa2a4b4708,0x7ffa2a4b4718
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16446447222371761552,16222208529900398781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
199B

MD5
5b94b151f7820c492bf3bf99bd67c893

SHA1
c87e1f85cc31607832a76a1a95f95a7f417682fc

SHA256
8f9607c94ee56967615f308607ea5499b675cc3e3eb2be7f872675584c490c6f

SHA512
7d9eec363fba810d67e008ff50109a76af01a007d15615b7791b4da4c16d76c6d2fc4cf8dc0194b7203ee3e0bb304f213e95822c61d72cfcf808d732f62023b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e76713ad4df31ee8d0686b08c5e9672

SHA1
ba82b20e27d5d606ce5c920738d1f1a6e26a047c

SHA256
1f392d81b8f173006c221869a113d07db58bfbf25a7974f5805830f3e71d2b77

SHA512
c526aec2781846cc78f0617962fa5268de133358246a41b61a1d6b64fe650ed048062e8c082cb2c9143f0ed3298870541113b37fbe45ba1e27759f30b9f846bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9bea2c51566b84984aa0060ce9f89e5

SHA1
196cfcc905726c8c3a6fc14e3068666bf1c95668

SHA256
8ec5a3f8d5faf07ab125e1d5178c4abca018b0600d1c82308c707083999a486a

SHA512
5e2dd6c8022aa60f2d865a2f6ca86ab01f35af8229a44478f7f49ecafec1465e241907c77326d7a41f769ddce475edeb9c91dc42c58670fa0755a63686e0c192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76a9e74a8e7cd4a96c2ad1ad859cb987

SHA1
6375cdb86bd3b9f941c614463fe00d1ba34a7d9a

SHA256
232f4bd019339745a7a73c3bb5e4d5386201ef1eb18eeccf586fa4979a6ce732

SHA512
5bc4dc83931bf3826b539fc9d6fc307919d1a960ff7b2847356b600bb0d67062fceeba9611ae540430c6d4b2c06eb588e5ba14457553dce4402cc24c9dbfc685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d0e9ee445c573284d406bc41814906e

SHA1
f19e388263b1d76add14a5edaaa561948e4807c8

SHA256
0a1391071208c2e81f440ecda8c6447278ae9ca8b1b7050dd60979606915d393

SHA512
68bdcf729e026884fcd9e812a08a0bc85b7d23074a838b29068b4fc049caf7b358da20de1969b456360e4c2db304a8c52b97c8d695b2588e0833c96add31fd1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
788d33167e75f497acb73581dff27313

SHA1
d6882c6874a93e58d2966af7a81eda30726e2905

SHA256
795b8da40fc0e912c0c59b2a5ef5d9947da06bbdbda8182b15397a6e9be87588

SHA512
66d73f61144222df37f2e3dd9c8c998527a6b181a8e6e46d38441b33a61f50a08026ac472ce79222695cb69bacc0dc19a35680b307656f78175960dffe23540a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c25e10db09fc987c1c5c65ae3739cc34

SHA1
850c35e826ca1f6599e1d9b2ad25c6e26a62005f

SHA256
d5b1982ac3c083715c0b072f70d976209071a6a05e3aaa0ac4b378a2e8419a81

SHA512
967cc70fd2ae54a6a8bf7c94ea9067e8c42e014973f863f89b6ad7a7c2532f6a7e0e9ce8169de427d89980ac73e67ed6f189baee7197b43d15d4b41fdd7ccfa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab1271004477396dc327d523ca20a333

SHA1
4a7a9e66d2610aa194085e353d11b35499c7c8d8

SHA256
4e85ee22eabc3ed5cd6b2208b09987ea117ec27ba0be1a6486e6b8cf2e5f901d

SHA512
042a0803ce22038ff7bfcadb0c445bfae6f100d4aecc17fe527bd0eda4833bccbde7c6d56f063a5a3e9b4f4afc2a797528bc22102aa219e589e33d8884aa667e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cac14bf4c030ec7c3879489c2cded16e

SHA1
ac9d8e42567980558dbf3ac84cc8cc8b9cd4f95f

SHA256
ff29a2ab769f89ba5afdfb77c3f3c68f9448daa3cd69d81491ee7e2f839abe37

SHA512
348b5efe0915d784775d9cf11b4794a4ce54af6a83f1fd0c5362a669220b1f09787bc1064404a9dec70d890d1ba33dac864e0567079809eaf3e9f3947c0e8395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b9842bdc721a591287fea868de6762d

SHA1
b94fadad14b830056986577244ac88ba357da956

SHA256
69087e65d228a6962fb48295398cf39ced69dc65750573abce86a0720fc6d5ab

SHA512
b1c471c415aed116612554ee48e0bca2a929dda2730d759a4e3649d4039dd23fdbe34d4197fbecaf098b953c6e3d941b65c2533452f04ce3b78b2b4a82b16efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62397718d834ce3eceb5787b52463c0b

SHA1
1b8b71e9137e15207dd56613418d893d24c4d1b1

SHA256
4bb74d169df2a05722afab944d0c13148b48e3ae404da127f76454929916070d

SHA512
d97e18620e87fb3fe670c9caa8ff920551052a2c80b7e28db0902440a8c43ef05ee3b3a33f34aeef82d08366cb86a36a270365dcabf72581be94db5e4aaede3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6058e7760add68a2f4d4c05cf71feb04

SHA1
90ee7b66a0336d887e2ca39cadf0600052eba997

SHA256
91211f097d596bd9f7342eefd69eafd62074c9bce9d77cfa63724afa8e46d5ca

SHA512
437d799d31b0efce1ec707abb57ff1e73ef97021c3b1cb10893fbaa3322f97469019e7f19d5621615ded999e7f67c540bc5804fd541ffa38badc693cad57596a

Download Submit