hxxps://landing[.]managementevents[.]com/hs/preferences-center/en/direct?data=W2nXS-N30h-LDW2HSJGZ3Q--GbW3_T7fY4kKVC9W2HRqYY3zdV4wW1YZVwy2KxpS1W3P8MKL1-YQbfW362wF33JQdKDW1BCn9Y2Kn5RSW3FcKsH3Y1GnbW3_BFkh3K25SlW41rT3x3D_Fl7W3g6Ccf1Bm7RNW4kc03s3_tMPSW3K7ZL543FYlsW3VG2_Q1_qdTQW1LFr_S3Qzw-RW4kl1kw3d8YKwW23l_x_4ph6pXW2PygNr1_sMqVW3grGGf4mlGjfW34606G2WL762W1SlvQS235_WkW3M40Lj3QDt3NW239q031SdDKxW2Pn6YC4mv9l6W2vHphV2MnPHPW34r4hQ36F3jtW4cy6C_1NCc9CW2TQVc02w4sKHW45S51m3ZNl0YW3LGwJ34fvSDvW2xxc-84cP2j0W2CMMWk1_tzqjW2FCCxg3P0rHnW36cFdg1NkgKYW4fJDYS2HCsfTW3QBL6n1V3jRjW3yRQd51_6p01W3CfZ5H2qMYD7W1Qd1YJ3HdJWHW34l4BT4fcp3xW1Q0Qp23jnFPhW2MqmYB2KNMkDW1Vb1Ck3FfMnbW1ZsZT01Z97VFW47LrT541XM6MW3GTHXN2HzQ87f3P7WKk04&utm_campaign=ME%20Matchmaking&utm_source=hs_email&utm_medium=email&utm_content=319051566&_hsenc=p2ANqtz-_6JWbcKpESD4kchalyDaaNBiXj3pnMmI60c04IWbCrAd8k9PaOZSfsmu2UpI5DaNxyiSK37PXhhVDXU-pxo5ekPz9XwNEV-rf9S8wWzK6e7ENHJBQ&_hsmi=319051566

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://landing.managementevents.com/hs/preferences-center/en/direct?data=W2nXS-N30h-LDW2HSJGZ3Q--GbW3_T7fY4kKVC9W2HRqYY3zdV4wW1YZVwy2KxpS1W3P8MKL1-YQbfW362wF33JQdKDW1BCn9Y2Kn5RSW3FcKsH3Y1GnbW3_BFkh3K25SlW41rT3x3D_Fl7W3g6Ccf1Bm7RNW4kc03s3_tMPSW3K7ZL543FYlsW3VG2_Q1_qdTQW1LFr_S3Qzw-RW4kl1kw3d8YKwW23l_x_4ph6pXW2PygNr1_sMqVW3grGGf4mlGjfW34606G2WL762W1SlvQS235_WkW3M40Lj3QDt3NW239q031SdDKxW2Pn6YC4mv9l6W2vHphV2MnPHPW34r4hQ36F3jtW4cy6C_1NCc9CW2TQVc02w4sKHW45S51m3ZNl0YW3LGwJ34fvSDvW2xxc-84cP2j0W2CMMWk1_tzqjW2FCCxg3P0rHnW36cFdg1NkgKYW4fJDYS2HCsfTW3QBL6n1V3jRjW3yRQd51_6p01W3CfZ5H2qMYD7W1Qd1YJ3HdJWHW34l4BT4fcp3xW1Q0Qp23jnFPhW2MqmYB2KNMkDW1Vb1Ck3FfMnbW1ZsZT01Z97VFW47LrT541XM6MW3GTHXN2HzQ87f3P7WKk04&utm_campaign=ME%20Matchmaking&utm_source=hs_email&utm_medium=email&utm_content=319051566&_hsenc=p2ANqtz-_6JWbcKpESD4kchalyDaaNBiXj3pnMmI60c04IWbCrAd8k9PaOZSfsmu2UpI5DaNxyiSK37PXhhVDXU-pxo5ekPz9XwNEV-rf9S8wWzK6e7ENHJBQ&_hsmi=319051566

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
3612	msedge.exe
3612	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 380	3612	msedge.exe	83
PID 3612 wrote to memory of 380	3612	msedge.exe	83
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 2216	3612	msedge.exe	84
PID 3612 wrote to memory of 4132	3612	msedge.exe	85
PID 3612 wrote to memory of 4132	3612	msedge.exe	85
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86
PID 3612 wrote to memory of 2252	3612	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://landing.managementevents.com/hs/preferences-center/en/direct?data=W2nXS-N30h-LDW2HSJGZ3Q--GbW3_T7fY4kKVC9W2HRqYY3zdV4wW1YZVwy2KxpS1W3P8MKL1-YQbfW362wF33JQdKDW1BCn9Y2Kn5RSW3FcKsH3Y1GnbW3_BFkh3K25SlW41rT3x3D_Fl7W3g6Ccf1Bm7RNW4kc03s3_tMPSW3K7ZL543FYlsW3VG2_Q1_qdTQW1LFr_S3Qzw-RW4kl1kw3d8YKwW23l_x_4ph6pXW2PygNr1_sMqVW3grGGf4mlGjfW34606G2WL762W1SlvQS235_WkW3M40Lj3QDt3NW239q031SdDKxW2Pn6YC4mv9l6W2vHphV2MnPHPW34r4hQ36F3jtW4cy6C_1NCc9CW2TQVc02w4sKHW45S51m3ZNl0YW3LGwJ34fvSDvW2xxc-84cP2j0W2CMMWk1_tzqjW2FCCxg3P0rHnW36cFdg1NkgKYW4fJDYS2HCsfTW3QBL6n1V3jRjW3yRQd51_6p01W3CfZ5H2qMYD7W1Qd1YJ3HdJWHW34l4BT4fcp3xW1Q0Qp23jnFPhW2MqmYB2KNMkDW1Vb1Ck3FfMnbW1ZsZT01Z97VFW47LrT541XM6MW3GTHXN2HzQ87f3P7WKk04&utm_campaign=ME%20Matchmaking&utm_source=hs_email&utm_medium=email&utm_content=319051566&_hsenc=p2ANqtz-_6JWbcKpESD4kchalyDaaNBiXj3pnMmI60c04IWbCrAd8k9PaOZSfsmu2UpI5DaNxyiSK37PXhhVDXU-pxo5ekPz9XwNEV-rf9S8wWzK6e7ENHJBQ&_hsmi=319051566
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc49f046f8,0x7ffc49f04708,0x7ffc49f04718
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7444458010877820576,15954302484450589072,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
6eeb79fb85de5f6a101817e69965103f

SHA1
39391e658a4b209fc9ee03b58f11b42ffb4bb822

SHA256
a9c248cef0beb32561824a30933ecab82a0132decbb1e3bbaaddb6727296f1c5

SHA512
625c769f09179afc068de8be992b8e59152b73b1f473842c53bb5eb835c3ffa765c93cfb7cefd55deeba4291950ea4b6c3f42e9c66fc49ad57bd71039e4cbfe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e85568e579faafede9fc9108d678202d

SHA1
bd9b7b2b8128d45a4c91625a408333cc653f574c

SHA256
6c5adb4233855347afcdb8acbe5de7e6a9eb4a8f78a6d3b6d57f83b41e8cc94d

SHA512
cb38292881dd50d317f0327570ec9f1cc3011d8b3ccd488989b54f68f486936f6e9b9f88d0b28166272c9330f51d2a36e9e8a0e8f4f1cfff55ff01463d635273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1ef00d64a8b358b6f2b79fc3764e5ab

SHA1
300ce5b4e7cd85a5de8e9a892c09c2215ee70473

SHA256
8208ff13fc47fadca5782f02c1e8e8ed7cdd1e4f28e079e4342b07db0f7c39d8

SHA512
ee43d67421be68ea895e894f4483b0f7988f757a5625d25dbe9c7e32cd4868523d2a83f5f765ed0a87cda1ac3b82bb249417dfb3afc39104880ccec8300c187b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0c719d4-04eb-4810-9388-ebea67ba6369.tmp

Filesize
6KB

MD5
c5a38c7838eddaf9bf29d8c114b5ee96

SHA1
11549d1e6936ca7f7153cf695066e92f4531a2b6

SHA256
5c772de3801d1de9fb812a0921e1636d180ad2e2c4210c1215d02e69d059b0b7

SHA512
83692cf626702cb989152b76c1dcf519af080aef138b3b333bbe8954e710ad31e70239052a9bcf38249eb0fb68c7cc37e1e6b7fa76ef0665e2711e5deb4376d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91f113e4b1ef2f13bca89ff739baccf5

SHA1
79d6830b15ab03c3a177dc09d51e149e05f7dabc

SHA256
ba5b09f2ac6f7b2a13784be90db881c09f1647ad08860352e9340a230676b401

SHA512
c410c48ca0793d4ccfb07eb8e73098d2678773fbd9bb06650e11603a9be93fd1e192a2789ffc8d6a5d85ffa59ffaa6c57e2741bf261828b3056ba6178df39738

Download Submit