hxxps://go[.]microsoft[.]com/fwlink/?LinkId=550986

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.microsoft.com/fwlink/?LinkId=550986

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
32	3436	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
4432	msedge.exe
4432	msedge.exe
3108	identity_helper.exe
3108	identity_helper.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3096	4432	msedge.exe	85
PID 4432 wrote to memory of 3096	4432	msedge.exe	85
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 4180	4432	msedge.exe	86
PID 4432 wrote to memory of 3436	4432	msedge.exe	87
PID 4432 wrote to memory of 3436	4432	msedge.exe	87
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88
PID 4432 wrote to memory of 1696	4432	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=550986
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cde346f8,0x7ff8cde34708,0x7ff8cde34718
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10252380547798947371,668589004638664777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07ef7cb3-dbe6-43f2-9daf-d941bd077c9d.tmp

Filesize
5KB

MD5
b6369e0c7af9d2e22a1f93ddef9222bd

SHA1
3195a7b52f30f70f2afd586ec94c40b043bb74a7

SHA256
6fa565c14790445fdd7d1de8781f9ca34e8704221ef3bc665827e1e9c6f40085

SHA512
5a1153543efea2ac688f82a16a7777665caaa9921952958760bd7cd51935aa68836ec197aa7778b97c1b4b9bf57491a8479845a9fcad0e8bc59228d32c6b6bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
e7f426949f9bf200dc041209f4506d0a

SHA1
5b2e4172736ce5c1ba756b5b9241d3b5b1be65e1

SHA256
1f9790f2f8f186993ea36089ea1582d7bb697bc9e10c361c92ca1a0fa1e76c28

SHA512
c7ba3975fceabe342c0ec28417000625fa0ed059d369917085da9f30f55205f288c8ec5425b1fb73941f7c3042f418c320c89bc4a3bd6fa25f0d4eb95c57fd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
43425e81634e924fc04e88fed42a0733

SHA1
e9d605a7df7636ed26133a86ae5a10b6b2f523ee

SHA256
d81c26db00a4165e9a88c3d2b15fa198ce31aeebb75fa19aab7d89e7cd247171

SHA512
74b41ba07965ed5f0a57eaf892846c81594212eef79506999a4d1874a9c61decbf86a9a477dec762d59b10b0b8b3a33dcb2f657a5ed0e6db76a77b725fa11a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5ec7ee8c2beac03e047bd1ec5d646944

SHA1
133a1a446d7264ad04dd1330ded7b36151d15b0b

SHA256
068c5735607320db1e86b76ec02ccbc90624f4acea50a17252b5843f80fcae9b

SHA512
08006738d2e0caf461df1f7ca43f1b524e440df9c1c680b384ef99a4fc2419f886e2e93472210e1eb6e262f1c651ff87f5cbd7a62bf49538bfbccc1581e8a946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
007e7a4b564e41536d38a4f5f7dd07f8

SHA1
45166291d4930b7edfbaf0ecf181febab0d5f27e

SHA256
a4c992603daae57f32e767fa1fc9021ffa70ff01549139bf0ee8f67aa8a39f90

SHA512
10d02795a2bb6423d479b6fb8229d2f7c7f8a2d3c9e027f19c2dc0cb4dd35bfb22be34362b8727a4a3a3203a90572b437a951ba445621c21191bb7813900fef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c71e6c1478f7e8e89a912277f1715d9d

SHA1
73824bdeab109b7707e9e749c6134714f062c872

SHA256
7a4b9a504425e0741af3d0a5a396b76c192eb6e588a30d86d7058615d12f4284

SHA512
af1bf4b0ec028126908b53f5eb3c537c9d5127f03c9e87004d973f88e3d7e2fafa0f270beccc8fea879593fe7f3cf94c8cdf6da4143d9623e7f247107ed992b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a4309ace6d81e60daa19c1ba303d24ed

SHA1
3b332f1d4502a3068c65d678527e1d212d20a09d

SHA256
0b72ecdafd14ac0016d9c33fad6faaef851033d6b545c33952d4cb35d051202d

SHA512
fbf33f3ca192e0f31adcb9811e2197179704b1c28af75a34dc25f306677d6aeb90c009b279daecd99588aaf5eb8da41a893e7acc3be3fa60767053cef3bd1605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58247b.TMP

Filesize
48B

MD5
de1938c1887af380d798992034116325

SHA1
211b88d2a1102de49c11ff80d3e1f359df9a0dbe

SHA256
d8c23e5b93de879e67625c66a7e7c9a06d016f712f2caecba36cc2ed3e3a02ee

SHA512
636ed6cb1e27fc125b56f9420dbc3bf796dfd2389831aad80f4ad4d63a9dda603b5dfb1bc379ecd0da5bd61a289bb370b21c85fabe9394182d6afba147301392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92b0d35ce5aa95d543c49408bd723575

SHA1
3302f202e47dff43c2aae6d87a018ffcb35bd8e1

SHA256
0ea8081f21784748e02bc351b753a156aef8a09336bf8d3f565e61bef40837ef

SHA512
de9afb1fd23eda0e988bcbb9ccae7b14315bcd07552ee3d0e73948318121d04231131349119a27c0e934e69ab8031b4ba6feab32a7510504063d1960abef73f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
88acecf9539b8610042b1e947eea334d

SHA1
cdf0806b7b79bd8c45b47192f0fd7c6b4af11ca1

SHA256
18fae0b224607c6d5b1984835ddd9608b0eeb00561e64a397758d9a7b5ac7cbc

SHA512
14dec9fe85be15aa05b663b8c49d1655cafc5c8da0ec108e2af7b111126aaad157c4d493ef14ea0d687d7915f1608146e298cb97ad4eda6a3d449bdb769de8cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f1c2.TMP

Filesize
706B

MD5
588784c4b1b64aaa875f290a1ba71f91

SHA1
54db4df89aa759504b6398d1cd35e7e3ee024d02

SHA256
491be2301d03a6056f652a8bfaad2db87d95c391835574abd7d70249d471bb69

SHA512
dd7fb126417de1b154f44381b203204e72995518a47aabc6dc5689a73c40389fff6d6269acdb6bd70d0a3a021d92ed3cf62b0cd5ff402cd4993e9e6eefb84aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21065929a142fe5b1d335d10d2c37a34

SHA1
802ef2ddf7edb0cd66eb3defee42e83b94bfbf2b

SHA256
fc49f33be5bc7b164b6fd366dfbe8358e6b04b72f7349faa7cd47021b44b851f

SHA512
68527dcb214c8764e82020a5418859ab9c37dda6e03a197c2a78724ced20a6dc01c5399b5bd527f5b6c1c446c3b29c4d679e9483a4d1164e9985ad2128db59c1

Download Submit