hxxps://link[.]mail[.]beehiiv[.]com/ss/c/u001[.]OrN5tLvfMMPXTCQkX34W9cto1AyqcUEbfYEB-wNg2q-wtbvjoQ6iat4aBJlbwh2swtVTYXHMG9HJyqJyURPK6iCoVGRFNXXhHcdxzaudLPWyfrRfQXE4ljP3SqMhT3l5YZHBkWubFXMRJ3MH-Ak0rBMCKfeoK6jDM1B07CcwE9E0tvjcX2jGgaJzbxRR9ncgmVsNZBdU9fyeukQDEXCrdAgNUI59e6dOrNLdEtCWtb7p6RuO92E511LYOR97qrEs34O4GOXP5RBpqAolMuJN1Q/473/eM4SB1fhToKgQhf42fH00A/h21/h001[.]-KJfhbEtPrjHoNiBMTF3zdlzUlC4KiB4vTglRwYT2N4

Resubmissions

10/06/2024, 11:09

240610-m85v3ahb56 1

10/06/2024, 11:04

240610-m6n5jaha73 1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://link.mail.beehiiv.com/ss/c/u001.OrN5tLvfMMPXTCQkX34W9cto1AyqcUEbfYEB-wNg2q-wtbvjoQ6iat4aBJlbwh2swtVTYXHMG9HJyqJyURPK6iCoVGRFNXXhHcdxzaudLPWyfrRfQXE4ljP3SqMhT3l5YZHBkWubFXMRJ3MH-Ak0rBMCKfeoK6jDM1B07CcwE9E0tvjcX2jGgaJzbxRR9ncgmVsNZBdU9fyeukQDEXCrdAgNUI59e6dOrNLdEtCWtb7p6RuO92E511LYOR97qrEs34O4GOXP5RBpqAolMuJN1Q/473/eM4SB1fhToKgQhf42fH00A/h21/h001.-KJfhbEtPrjHoNiBMTF3zdlzUlC4KiB4vTglRwYT2N4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
2256	msedge.exe
2256	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1112	2256	msedge.exe	82
PID 2256 wrote to memory of 1112	2256	msedge.exe	82
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 1868	2256	msedge.exe	83
PID 2256 wrote to memory of 448	2256	msedge.exe	84
PID 2256 wrote to memory of 448	2256	msedge.exe	84
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85
PID 2256 wrote to memory of 4196	2256	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link.mail.beehiiv.com/ss/c/u001.OrN5tLvfMMPXTCQkX34W9cto1AyqcUEbfYEB-wNg2q-wtbvjoQ6iat4aBJlbwh2swtVTYXHMG9HJyqJyURPK6iCoVGRFNXXhHcdxzaudLPWyfrRfQXE4ljP3SqMhT3l5YZHBkWubFXMRJ3MH-Ak0rBMCKfeoK6jDM1B07CcwE9E0tvjcX2jGgaJzbxRR9ncgmVsNZBdU9fyeukQDEXCrdAgNUI59e6dOrNLdEtCWtb7p6RuO92E511LYOR97qrEs34O4GOXP5RBpqAolMuJN1Q/473/eM4SB1fhToKgQhf42fH00A/h21/h001.-KJfhbEtPrjHoNiBMTF3zdlzUlC4KiB4vTglRwYT2N4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,4919588056473050848,10519674634278091377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
56KB

MD5
e8c898d52b914f28b1cf0e0035e30367

SHA1
b4ad41a57a4309f62551cede02a0e09d0be76017

SHA256
1436a5453a4e5c1d7281d2570fa289bb70001243f3a7423693938cb8b5fa1da5

SHA512
2e4f55c0b759d65878ffd5e32412c89804b44e3c45330f7c56c84020ee9c78e8df837f6d77638f45ffb3a5eeb8e9e610505010ae7e297328f903faf0230a20e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1f14f154697c363a19411b83a7085a67

SHA1
074555072f36d19c4e483a44405b68ff84feb73c

SHA256
37a3b3b905c8bd4f312f7f26dfc047a33a6882103835414fa64f72934c82ade5

SHA512
528998f12391856fb4a228c2fa89aa649ddbe5e539fdc3ce8803a4fe05bdea068a833ab83c7d1fdea02f62cefa9c00a5a7397e03daca47c46ce9571565263483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
58d26713f044921e52bb352298b87d49

SHA1
5ac71ada726f50db6bc277123fdfaa9262a2e1b5

SHA256
1f2bc9067ae14a3e0a0aa1e3b9c4e2fd20edec3425bdedfebbf3d422485ee7b6

SHA512
c37e42c53a176ce4cedc218435ee976996b70d8c42afef20ce050c5a2418727e6bed4bf31e84afb4b8f7d526a1ea0eff453e01f2dec8328d35fe52d6deca7dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dc0aa7374a12627fd8cbbe1d231f07f6

SHA1
9831aecff0ba19a310a2a4713fb068a2fb4d5292

SHA256
717ce7d86db9ff7aec42951b79f53602e22e83d556707c28ec086e9939f9b6a7

SHA512
b837fa819d6a9f2b666ad7114d0573ee974c0a5406be8e40007e32226ce58d64f2d435f58ad52b9f4769a8ae49f203db3bbcdd7f7a8aed4694b19359b9f40840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
61dcf9e3b672c568ae89c5c23c827ac0

SHA1
291fa24738d7b3a66e5340ecc6bb59a085bc2d97

SHA256
331f492c7fa694568ffc6e65908fa2e0fb8a9b28f2b10ed883f19e4466de66f2

SHA512
2b5aabe789a00841ccc446932fb19c463cf0ab8315e7cec5a7c3acab080845bc4d38eadfd4994cc29e82316ceb00fe0c67523edd4ca860457425c01156c2189d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b28a4983cb54ec54324742eb672d2f8d

SHA1
b58db1012d6614545fdfd7ed26d7bc0b4e33337a

SHA256
6171cdc4b6705d705d7afbbe3fb671aef9b75ea06b47ed2d48262d9e43d01b40

SHA512
1f605aa61e0fe3d8a1f77a5591d0b06ce28067db671a4b633059fb554314e3e37669c690ad80d1eb075a7c971d0ed716807a5b0bd3cde1daa0a343d6d493d7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0cd31bf102eb68eb7d43207f718c3130

SHA1
ff9e4207dbf1c9dd34b85ac35407cb7dbc6f4e34

SHA256
5a4c70ae3177fe51160022634b6fddcb1b20b0a3cca6c359a6dad81e1e5815fe

SHA512
565abc90eeeb5fe5c0aea74923ba370aa11369ac1b2eb44d61e6a90dfc3c31a5b68ddb4044abedc124563c8b932727bff19d63fff11d7b0ca66ffab21a896cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
16fd0c025eec2e59a7787db49aca0bd3

SHA1
5f1f075316715632a37ec5d11da0d813d91bfb6d

SHA256
ddd3641145463be02853cff3d54e6426cd88b36fbb6e96ca2e8484ddf215e787

SHA512
15e586c5b8f38b5479b37255f29b9304955f89fe37de8b5f710d284a0508c822de3db176a517ebfa6a650b831744c723f5d920189306ed27b08fd809e7d14d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b4478750c9f4f4fbbfe450167ed4c91

SHA1
71a9b7a9003ecdb550e08111de1a92e98c8aab10

SHA256
964aee2d8099f789c814ff4c2832df2e31eda16ce00032b75fd4a1aaba63fc2c

SHA512
d3c94b0528cbadb44406bd8b5e143b10740dbebe655c32da78af9a646f323d2ae02dee04c178fa8a8679a3286d8943d9cb7f9957cd73e1c6c20b9ee5e700d924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
0e7f0c0af9e28819397af99dd2126d1c

SHA1
ded4d43ceea8fd22e5f05b0ff78cc8f59bdacc08

SHA256
52272a4abdc03d5a1345054e94528fd434a32f729c04f403973b31c46723a3a7

SHA512
74d4040fd33ff0c71be7e68a65bdf78fffd7b5664c8abe3b570313f34e540ea27c796e5a4a2caa58a7d7ca97e6dc4838c668b7ea359f0a3b18f7a2e9cce91875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
aafc1e1acb7b75310d6bc5b96f9bc4b0

SHA1
5126a5347dea767b7c9f89770a1d6d842c13f8bd

SHA256
a2c1fcba36ec85640df93d6ce564fea33564da7c98223494fa8de31f117fc6b7

SHA512
889c0bb8d977e9d6d6d1b65a95afee8a144eac061868b9d486557c5a982ea8180081f2835170c97ffccfc53b13beb37d4dce82affea9714e0bb3c2df01b1a29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
15e94d6cbf1119d3e48429c27328e474

SHA1
1b7578b3836ca3edfe1ea26d72a333ef99c8d8f9

SHA256
18f30d4abbb0475f470991169cf26522610eea3dd46ad45d990147ca303dc5e2

SHA512
5548d8bf5df4c08afb6dbe17cb63d2580b1528dcc623320cba50db68d6106365ec6e3fe9562b95612b805a4391e60d2e173a832b863c07ede855e161687cb0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588ac6.TMP

Filesize
872B

MD5
b2b89b8a951208bbb4696d98f8663134

SHA1
a86723d8a62e7ca5686f928e922b2ed37fc21cf0

SHA256
bd8633d3771ffc682014cb587a91cf87d05649bc94906611f0d9ed431bacd360

SHA512
0775cfff001c535a307e60890554405015432d0b2403d6e6e0ae90296671b44582e0b50853b3e3d0043457bf974d3d91b4354c58a93e16f0800e1d416de12f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2844b3be0bd14da1555bb3243c317d9

SHA1
7d052209d939b06a5726fa47e5ffd7f152257767

SHA256
6152ca16ed7a55ac4f2c8fc847c2469b1916145adb4d2e1703522e7c0114c30d

SHA512
ff060ebd218821fd80d3002e93f344490f130bce71cd7b52fa51cc1d55883ceb5467b414cf7f6b8b87dacbcf620fe42f23e4cce9fcf4e9bc58591e215fb7684e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit