hxxps://nam[.]safelink[.]emails[.]azure[.]net/redirect/?destination=https%3A%2F%2Fadmin[.]microsoft[.]com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1hMDJkMzY2MS0xZmFiLTQ4ZGEtODdkZi1hZDE5YmVkZDUyZTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1hMDJkMzY2MS0xZmFiLTQ4ZGEtODdkZi1hZDE5YmVkZDUyZTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1956	2724	msedge.exe	83
PID 2724 wrote to memory of 1956	2724	msedge.exe	83
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1276	2724	msedge.exe	84
PID 2724 wrote to memory of 1048	2724	msedge.exe	85
PID 2724 wrote to memory of 1048	2724	msedge.exe	85
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86
PID 2724 wrote to memory of 1796	2724	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1hMDJkMzY2MS0xZmFiLTQ4ZGEtODdkZi1hZDE5YmVkZDUyZTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1d5946f8,0x7ffc1d594708,0x7ffc1d594718
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15946998814783192307,1230562819516883867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
6393544aee74081695ce907b4b8be48b

SHA1
25f1cc14a575ec6fdb12f61f570e7c3d2c684526

SHA256
d3fb0b04070d36e9d428834d2de21fc89972d2ae3df72e8e00b71c005fd28385

SHA512
1480db4d444070d98afcb940c736b8227907998ef835d0cf43367275ecf246e3c13ce4a51941280e1fcb8a99a8eb6db06f7b03b7e37d54e5a6dde78ac5998e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
fcf192243ce1297a61e5ed2a082254ac

SHA1
57b1e69580eb0ec0c6e5751d109263395ed958b7

SHA256
a0623a819f91fda3ba40f95a8b3276b8ed819a94db12d454dc298278cf16a4a2

SHA512
d9a904196914a6d9b2381a1002a9927fd8d3009c5b4180aecf685f793aac9a3527a2b3bbbfc3e995c01d0fa28380d1a4e129ffd689202c140c9586db607bd9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1930eb7ec5ad73df7264387ed15759c0

SHA1
eb96bb0771ee452af63684edd264c44c51781f8c

SHA256
23d64113766142c55a937e6bfc024251aca790c53686de873ce8653ab7313b91

SHA512
d24c145607f4a07d8d36b775a2ebaea97b6c80a01695d117b446efe5bcda355ba36351b3e9961179ec565c392b4f809961d66814b3afe8c93c5f8078a4099fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a1ea4ce9bce657a00cb011c845a484cd

SHA1
c0109f88a5b327abdde5504d238ab9bd6978453f

SHA256
a8608e149c26ba777d23f2501dd258999dc3c747c7c2777bd394a35d32d3f151

SHA512
44a2d473e497c62ef684a83c8f033d369159793b854791fd9a60dd0fac7cc394802a8a676579304a42cc7fcc484f5293264de10a702d9fe328fc1c9287d93b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d5bb3f694c066dc6ba9c64e04d788bbb

SHA1
d90a7a5fcc809683e1bf755b58c1d22062250946

SHA256
c23d0d817da31ffbfa14aeeba88b98d71338f5582eb2b050ea008b8e4d74522e

SHA512
92b2936eb191375042b5e21574f35c98c4a0a905abb78b8c839e37cd79b926552f61a801e15d000314e6b7abbabd3d34c3c3be073599892952daefce216825b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46a8066dc771f3a70835e76bf6408298

SHA1
425100182e777d1774d47d9cbdd313d6b6941132

SHA256
dada43979744d0ab51c2b8ab11555da87d790c9795cdd359adfdd4ad4bd9fb50

SHA512
f1e506d432fe9b5fabc97aca05c485487a419a9f0a4fa8fff3bb5de324d3a61603dd291ea3cd06320df7110e473f3bc70c0df33ee964ba178c9439cb75d47d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa1b116036627f520a2c696edc92ab07

SHA1
d9b79943639c967ec7f3e98373803d315a03aff1

SHA256
c3f250c32e61e1468a834b59623f69cbfcd539a3e2ca018a65a27a771ab175ce

SHA512
baa292e7ef2dfa8f4e207ea92bac5b7aa0926f185ce31bce885a457e8587dbc36666c925df10b7adf33699803179bb2dc6e2ae5b51ecd72d466755bef001ef10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
94f2c5005895ca4ec53cbab010c14f30

SHA1
378fef51131631af72801886a9e70885b3cf38eb

SHA256
db142575c2b5eff05a3f1ac5af0e06939033d81b963ff6d8c43cc352095c949b

SHA512
2dab1c5a7e650fac6786344a281d67ee1238dfcfb86acf44416104107748a28789dfcc38c1b526534b7953e0ffc23168dfa4f5592e6232c233377a7873a96d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b2a91fa9ed3b1ac763ea3e534ad3ecd

SHA1
695c1c5f60474b7531b8667553e6df647aa70252

SHA256
a6ceffdc7755d3ec239fa711640bf5c0adf7591c3f893ff43b310ad48243350c

SHA512
d80517718e6103e557658be4dcad9c02d7b037d05f0625763b33b13f4041df189b0224bf21eae29d068d4624a162c8d79de6ab92064f6485db69abd385442406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e60bf6f1b40faa9c510009801230eb03

SHA1
5b2b5f3e399a1dd62fbb9a82eeeb38cce673e16b

SHA256
7a53853dcd6e0e9edc9c0c2596563cb5802d2fdf58d3b5ffbd344266cc8e55e1

SHA512
8348176afc50bddb7b8c699e5a6c4de64b6f5061b02674577187d31b41934d16d403bca3cd42d3aad30f835e1438d77e2b2e0f476df8162432e046276f343ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dc8c8d3126944f6ffadeded952d9179d

SHA1
db519b3b4f63037c2dfff13db3ed1914cbe6914a

SHA256
0eec1612d95520137da459210e44f52a03b6d2ac7eff9fbfba0ee2838d7172e0

SHA512
62d25f70bd4e8932f86ddd4e917d866e1ea287def14b53ccad5075ad32333a8245db617151e160bf8944c57e575eb0222a95a3bc1a60160528db563ecbeaf51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3cf4161069a0880b11cb88ab720074e7

SHA1
40eac7934f981dc27f7f20dd607cfcd17f8f298c

SHA256
d86d01ea9435d22ee504a366ea3b808d2594331c9b76bf98acb05359996c4788

SHA512
f37bea6e7397f8d5652dd6a850997b91fb59dbf9e62e4e92cda0b2b856332f7a1ae9ff39af76d60e4346410d7e87849419e7671205f14fe19b1350c5c43d9a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bafa75a02c25d057d9f2ea9047a24184

SHA1
fdd427ef5859d038aae288e20025cd19ca8626ef

SHA256
e9263c5d8ba89b85e3c51e8a93bb1b08340a2d3f33efe48ca054f8e800e85e2d

SHA512
342105eede05aa3230368b2e181f4bc5bb09a3f9f783915867a723d07fc78388e67170c47c52df5f3c6768aa402e6151905889f2182ee71c2b06527d644f2cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
f557fa27a45d7ef4c5900de93ab9e394

SHA1
4dd1bcf46dc778fd90574e5865a574a8d51df1c5

SHA256
5436bb4a1fe8d6b4ebae9ff3587cb1560dfb0a084a51cd60ba28753b690b2554

SHA512
0f0542084ff6a9ffdd66a4ee66e70aa6b204d9ba1dfd5cfabc5cf2a41f444be12513339fa64088155579d59e530ab8411c6020e1e3c152658d40187cbabcea8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
343f956530b52181414b63257d1a6f9a

SHA1
bf18b3a8cf43312a2aaee7e026d0600ff51ae7de

SHA256
1556a048998dee549984f7220ef532a626a6cc2dbc2c7f1f8a844c540e8be531

SHA512
4bc4801321b0b3406fb439ad4a0aa6cf1d0ccccd9a0994c04d43951ddcbc6e6e707e13732a0c011a0e43cf02621f1298972ec8e80d6664498c9713986e099910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ffad.TMP

Filesize
873B

MD5
180e9fbff05c6c7efab878b7778ec076

SHA1
01ddb5bbf468319fa7687744f861baf055350c74

SHA256
92a19619f0ae8a2c180f06d838d2fa1c8373d3e53d6badc0acc4ce3c0448e584

SHA512
64017958fecd33aab57469a9bf6c267147fc098e8fc2a64f7c5059b9530eae34a4be5123cf6417b5b8f3ca6fddcffa6a3d26a18add1dca5a334f2aae63eb7b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
05b9c2938d27410b20c1bdb9f122a8e4

SHA1
6e31d6680a88837e1a7be976f319cd45f5b9c5aa

SHA256
fc5681a1cb4e634ff318d154eae9f603ce130e975a6ca350fd76fc4adeb0efa0

SHA512
06afa4a91265cf2af3b1bb3a63dbe5f60eec64905035b43c364cf95c7e2566dbb62747c5a87c9c92988992b620451f542ca288aa335055153890acc669df4cc0

Download Submit