hxxp://link[.]mail[.]beehiiv[.]com/ss/c/u001[.]PuKoIL7Wfh0H_yfkc0GGYKlpH6Zsaz2paRxdkDvWIOIO68FsQyYAW0Bdf_IjTCwiFP-HtTagiLMp94WdKLxltUQFsDUMam1E-3o-wrWlqP-Lxxp4Tk3tjxn4-q4dmYmqvhmbPsxmgw6dcBVgwVek9zJK5KyGS6TcdjM1rQ3k5MjpqxVfzTVrstq6oS_zLhf9N4kpwLJ87ZMsuzr7-lAp2Q/44o/hiLYBfHkQXC2VmVU0OYjFA/h7/h001[.]T92uPgGqydYkeqFfMbSXYqFzCZl1otQ4iAgzr7M-cVI

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://link.mail.beehiiv.com/ss/c/u001.PuKoIL7Wfh0H_yfkc0GGYKlpH6Zsaz2paRxdkDvWIOIO68FsQyYAW0Bdf_IjTCwiFP-HtTagiLMp94WdKLxltUQFsDUMam1E-3o-wrWlqP-Lxxp4Tk3tjxn4-q4dmYmqvhmbPsxmgw6dcBVgwVek9zJK5KyGS6TcdjM1rQ3k5MjpqxVfzTVrstq6oS_zLhf9N4kpwLJ87ZMsuzr7-lAp2Q/44o/hiLYBfHkQXC2VmVU0OYjFA/h7/h001.T92uPgGqydYkeqFfMbSXYqFzCZl1otQ4iAgzr7M-cVI

Score

5^/10

amazon phishing

Malware Config

Signatures

Detected potential entity reuse from brand amazon.
phishing amazon

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
3628	msedge.exe
3628	msedge.exe
5376	identity_helper.exe
5376	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 864	3628	msedge.exe	88
PID 3628 wrote to memory of 864	3628	msedge.exe	88
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4656	3628	msedge.exe	89
PID 3628 wrote to memory of 4652	3628	msedge.exe	90
PID 3628 wrote to memory of 4652	3628	msedge.exe	90
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91
PID 3628 wrote to memory of 1520	3628	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://link.mail.beehiiv.com/ss/c/u001.PuKoIL7Wfh0H_yfkc0GGYKlpH6Zsaz2paRxdkDvWIOIO68FsQyYAW0Bdf_IjTCwiFP-HtTagiLMp94WdKLxltUQFsDUMam1E-3o-wrWlqP-Lxxp4Tk3tjxn4-q4dmYmqvhmbPsxmgw6dcBVgwVek9zJK5KyGS6TcdjM1rQ3k5MjpqxVfzTVrstq6oS_zLhf9N4kpwLJ87ZMsuzr7-lAp2Q/44o/hiLYBfHkQXC2VmVU0OYjFA/h7/h001.T92uPgGqydYkeqFfMbSXYqFzCZl1otQ4iAgzr7M-cVI
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2d246f8,0x7ffbb2d24708,0x7ffbb2d24718
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6793702356801701955,16499182904784929372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0aee0c45ce6f777dae348119650aa0b0

SHA1
015d1692fa6ade6ee316e14885e0fd90d9940974

SHA256
5c94ae9dc5673f2f2c6e9ee357c4bc308a5f205726a06d16b1b120a5e3bb0990

SHA512
83d8fab1605459553be55b34a0fe5f65aac11448b86957511286830a59541bef31ae244b81c0dc0ebe3075eb2ecad7837290d316000b6ce155fa3edfb62972b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4866a4bb32bdbe97ea1a6e28f01ee5b9

SHA1
f2c8df96749bb918261cb30e4ebe70d783b43679

SHA256
4df64769bc315e6f655883e804d889895ff0f6375dcde4cae1a8facc87e05d07

SHA512
c09b60cceb7707e0bfe4d6566e2907c6248817434d0c944dbbb106029f629fb2f9d565f163b3cc809705eaae49c2cd1ccc9e30599e662cdb1d544686e849d402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fde8456443b2087dddad3e653d7ef9ea

SHA1
801b947dc5586c755abe3aa691b9f149a76a7988

SHA256
f261fe2f99cabdf6df80ecb39f15284ee79ffd346ca2df7d6f8b809b990324e4

SHA512
ae0a77e188aff3143a1febe0d169957bfcd7ad801037bfcf97bd551205b0819fcaade5b1818455a8229b3c25b0da7199779f34d26824179456cdd2e6812529e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e604230d4559a1d8a6da9f7c34c95cf9

SHA1
40c613f4f12fd1293fb33c88a28a36ed2d2b5628

SHA256
17feb68ef9ae20a432bae1c7ae6068ff3fb4e6879651e4390ae3f9407d76b5ae

SHA512
94f96414780704402aeeeb0fc633cdccda2cc2339bcca316b2091b93c453d4fe7fad56d36a0d94b5642cfa97bf3cdcfbd2c0373926662edb08115b03222fcc63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
283a5d69a72b5fc061168d1e9975a858

SHA1
da67a4b83a392e0a79709326d62956d5658edf16

SHA256
67c00c4281795fc52855fe9f6b29613899d8f671dbf844095bb0c85aaf04adc4

SHA512
2e6656a2a0497e596f17a3a55b4e5c5ea52cbe9640cdc7962632b04122b1e20a9cee5a4f5fed0556db30c6617c1982778fb8278ef6a2d30b91aa7f8fcd325055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0df4f7d7662473a8df82b923f9637954

SHA1
2a12cda07e9b9fe4d9324c852a1117f079237813

SHA256
7fe8e3c52a1415152e5bccb40ec6047049d06bd4e65172fb09ca82f5a6c07e0a

SHA512
e45933d7d8431be73239416e2f19b4f39a8d5c9891396cf640b8309f286bd27b80e712c971ed497d7321a2baa70194744c4b183bf97768e3a000d1000729e19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f5aa.TMP

Filesize
48B

MD5
2f87bee9f0e260d6b69fa93611dfbd8b

SHA1
4536d9add47be736e3407660b9258dab517e26b7

SHA256
3f2b1b4e91c14e2be788f61ed9b63ff4c0ce7966ec8c44cb07a36fb40e098296

SHA512
96a7d0a3a2137513ef7a81f07dd6f5c41e1da441b671d235a8090874bec4e18ec7fb66edb899b18bce284d46907e59ec5227d32702cd3863b23c9ca47fae08ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09d92359bafee33104477e895a64a4b0

SHA1
d19d1f8b54d6fe34f03be75a22c98ac5d7409790

SHA256
d1df3cac4b34cadd1dae4ec006841017e704e42884bb4e293e60aa20e31a1ae2

SHA512
bab53631640f409d3684019f0ddde7b948a1536ff9d6e6974642daa54a0417fe3f7413cafe4dd972ddf546998457942752004b9e1c23e4d5a33882939c50a910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6240c73592d2974edd44e3a463dfad32

SHA1
752f9a06f004bcfb22c4186ca046f5dce2b797ec

SHA256
b3c442463e2e3dbcb99e0b2da96bd679b92d60cf352035d75608d307d3de5177

SHA512
b82ed0a2cf3f480f51d9ffd62962fe005a34488a6c40eb57da207094dd530ac014bfad13ce1bff02243a5ae06b633cf7f451edfee83e9b9eea9f476ff4940bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8e7ec447da4440d832b776f7291632b

SHA1
16a0ffea48d19302ddb80b11d5d4d12ff30c3831

SHA256
62bba9f0367599c789a608b4f90efa69b4a479b0b1be8666cbfe49396f395c97

SHA512
0ea49bf2919a6d462a1ab93b98f535dde2faeeb92d1546281322b0b5eb2a1b178f2aa88680ed1578c9425128095d7671ddcad4bffd5a596c415eb5bc9ce17535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cec331528b1fadd78673d51926b219dc

SHA1
f5f6a152108f0f52b25590b69c8f20d73650d40d

SHA256
899f372423a16c7e69702ea36e9d617c101662f60055f728f356a307e740f5a9

SHA512
e445250b098c8477b3a470ab5b992408a07d1fcfa3f9c2b6009bb8cf73b869e19b1e8b8559b5f696664f00135c1f55455dac0c1bccc76d5f3d6d7c219c2adf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce753f482884fecb17640de0718eedee

SHA1
3a0a1d15a7691209f3d382ad830ef7786eace562

SHA256
671062022f0ffb592eadf460b2d19d2c391421b2f4c92ec5aacdcb4234da0cde

SHA512
5d6a417d3ff6987f98c36a4d252cf5b9d7e0f256ae240de8f6bfab5f89b1e47c59c93a03e609198a051bc4279f64fe55c727dc6cb423a16bcc89cd632455b1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2af6e818904555c7a13cc6d011dcce5d

SHA1
876cbaa7e4f99242217ba32706a75d31b1201372

SHA256
f4ad593fb1d84954d65c41e0e3880b6235fa65f3e7d8b34b9998e5f0e9c57f5e

SHA512
099cb28106e928119b1f17cf6111bedeb4b91380ac6a6735dc92306ead3f6649b12d005c5e53786e0f5377ad2c6c00f3fe6c04a8a8974f7961594352c0ed1463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2bc1389919ad800d8fddedc8a068e0a8

SHA1
5d57a1f3a07600644f0915fb33dbcd99ab91e5d9

SHA256
8a41a0ade0cfd1e01088608758356b1330cb77791c271f28f8fe9582ea9b044c

SHA512
9b29dadc28fe96fcaeab21292856d9496bf94845e62cb6b1f435efdd747a7324d52d19504274fb6e9d644917a530a7c5ca6470c1fb2d4ca20187906214c01f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d35d.TMP

Filesize
871B

MD5
683de8bf89a91e1a4e4764c0575bf745

SHA1
fad32abe0a2d74151f7a0ac684665e557524b8d1

SHA256
fe252acbf68c985bb087cd1073fb3710a6127a52b621c89de99e5e3fc1ccd6ae

SHA512
236237a0f7126b42e662f42dad7298c43374f0e91c242882c2040507a6fc8cfaeb226d468a77a81b187a159dd65fa244063b8b18e3d75a632fb718b86ae3ce34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b0c11b347e6ed4804c791fc8f828072

SHA1
72bbbf07f85ce5eb0fdbc20b0a65192a4f249eba

SHA256
041ff1a0c880400d30d21ef6e4ce02fed8a31f1586b39f6f86610ce42df44ab2

SHA512
ed657c00409924f31df82597f3eecadd36c115eaa8533a6028a8cc17d4593708ea78855b932002752e0729ebe4cb4eddcaa5290da2147d5e14ba6c2884f6631d

Download Submit