hxxps://nam[.]safelink[.]emails[.]azure[.]net/redirect/?destination=https%3A%2F%2Fadmin[.]microsoft[.]com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1mYzYzNDY0OC1kOWY0LTRkM2QtYmZmZi1lYzAzZWEyZjIwNWQmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Analysis

max time kernel
80s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1mYzYzNDY0OC1kOWY0LTRkM2QtYmZmZi1lYzAzZWEyZjIwNWQmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe
2332	msedge.exe
2332	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4876	2332	msedge.exe	82
PID 2332 wrote to memory of 4876	2332	msedge.exe	82
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 1580	2332	msedge.exe	84
PID 2332 wrote to memory of 3292	2332	msedge.exe	85
PID 2332 wrote to memory of 3292	2332	msedge.exe	85
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86
PID 2332 wrote to memory of 3404	2332	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1mYzYzNDY0OC1kOWY0LTRkM2QtYmZmZi1lYzAzZWEyZjIwNWQmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2100 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2944234438186324266,7776694591334552455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c2727d0-af55-4c73-b4a2-893a67026bcd.tmp

Filesize
7KB

MD5
4270f5288a6b25c8874536a550d6870a

SHA1
dc01b040c7dbd84cc1420b4fa3220906c51612c7

SHA256
e4650054590f369e9855e132070d5e1a043ab053ca3497f00766f989b7435c36

SHA512
3313bef1b7acc82a27567a47bcb5a8879c279266b7726b694e1a90fd2cd80e8a5b63a8099f28c8fe6809270605b4f61a13c44fc0e99d9fe0a94847b100a0df4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
31210ade36b57c78ac934fccb092848f

SHA1
aa5d0fb007c12255acaefc6a1059094a9828f037

SHA256
781ed3d8a64879aec866289ee9d4968553d52c4708a2679f07efe4a5cb66cfc3

SHA512
b1e6c683507c51afd294b13c3af56650bb91b837e1825637cec5e9c956997397d79be84ae5c991f14921c2369cde9089ebe54ab66a813993bece39a36eef256a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
cafad13194f8d0a87e4054128fef6c7d

SHA1
9072c740b8311395d933550e5740a94e049b8814

SHA256
4bf9501735f9f4a43c4872fb0847fec33824abf8d82ffdfe219d9b1b4176aefd

SHA512
6f3e0ce4b1dbac1d6e8d20ec12c437b18fc79ec5cd11b205285bc402a45dbe0b66189dc511960419fc68789f9d1c9e308f33f6390d57fc1243b99728c0f07357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c81ee56228e5627fbfbd8c671dfd878

SHA1
5f55a3ef2945c6c94575ea434da5ecf5ec1c0d31

SHA256
ca73b355802448d692f23a9abf836efe12f0221947062c9338418e03330d44d3

SHA512
6d285858d0faa900008d46eed56002d066f3338f5b1c6d9a276450c1c62a99e80c29e5fd65338644b408296a01a2d558c0a4e444ab7e5313fcc261a0bc6a1889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f180bfb9649ac588bbfa950c992492b

SHA1
54be99a1d024d873c957dc5d220ef91cf95cdf6a

SHA256
2372a402094c90efe3b70819b235d229e76d17ab1121495e9b85273198b66922

SHA512
65df1147f025b89582f54c95603fac62f14ff1cd67863cafaf93d2d4e37194aef32546cc44fcaeed9e6e1e85fe4179484f7335868a6ed408a368cc4bae8b3508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab40295bd5fd0852c3b5af036d42ecdb

SHA1
641e3e17f879395e50d32293057088cd0fbc6905

SHA256
5a831a0f311f2a5ab2f18cab1401542952565a124a33c27b7695587d13c19feb

SHA512
840b24487f592952d9381bd491e9cdde6953d1f4b108e8a595cc0fb4ce7c91f6ac57df85a68eb00e41803ca99d1249db447c5370a2092954694d82890b2097df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f531edd58162de6eeb4cee366ca0bbc9

SHA1
a811a7bdfd3a8e6abfbaac79e1050337eccd0679

SHA256
0dec694cbf7e8edac201a2646f4f119b1ea9595a3756cd81e98994b0c6f5751a

SHA512
c9f528f4b81553413cba465cb1980cae63307215c5033d76c46507ff3124a8bd851b911718599cd4fd81674e6ee333349c2568c2ca104fd9c243f34bef8b147b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c7467fdf62bd7aa1bcea2ba949b22542

SHA1
abd53e14d91b417c89ad1250a7d5d7bb7d31a35d

SHA256
dc013a9914a6ffaaa7a0f07cab55601877757d89cecf38533fa0fdcfe79cf554

SHA512
68d8a272b5b6195ed68e5a74dec0baa1789859b8e3e539edd36a24bb08d3a9773466d8092f24b02bb191ff52f0542b5004080a246e0a42c2387aa8ea3a7dce72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
881d9bb5ab4f42fd1fcb866e0658c518

SHA1
57b4e4cbf5a5e6c797dc4e38a7bdb8b14d9831e0

SHA256
c9dbb37aa49b5a203d9c5c1ac810f29d47771bb68c559d969e86dee98ab32d6b

SHA512
cecdceed87ef7c36d7230b177b6f3d43c6839847a4b516c16e1599068dddd0f79393018d85775363fa976c21c4d7f6cdd2bd4f1d789e81d27d0c50cc279bcc72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d3ea.TMP

Filesize
873B

MD5
d931199ec9b1a8bb97895a8b828505b2

SHA1
85c3b3ce7e62b781a617c908802f6c74f89a0247

SHA256
45e0f2904a2028601748ca50b651aba28f0219d3950e52cc76e61cbd8cb6c739

SHA512
0354ee98f6eb01fff6e199890e198cd9f37abdd8c4807314ca6a539418cdae2622e52571bddbd1d5ce3c8c2426256e5ee2d97f53850b39d5995b1f6033b12c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a69288c982e3ff61b84a8cb5cdfc0b69

SHA1
226ed61254b73973052a42e3b929decd756ebb63

SHA256
f64884ad5e4cbc52fb9975b3357ed49fae474df1fb501b9a6191aff3c720c572

SHA512
d6bb6b9e742ae2c1231b3c45eaec98237f04ce8e948ddd34828440ae7e574dba9961d0ad4f91e0ff01c1a01974d0f179a8683486a247188ce172fee352c84303

Download Submit