hxxps://outlook[.]office365[.]com/owa/Finance@macro-group[.]com/groupsubscription[.]ashx?realm=macro-group[.]com&source=WelcomeEmail&action=conversations&subaction=gotogroup

Analysis

max time kernel
145s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-12-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://outlook.office365.com/owa/[email protected]/groupsubscription.ashx?realm=macro-group.com&source=WelcomeEmail&action=conversations&subaction=gotogroup

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
2556	msedge.exe
2556	msedge.exe
4772	msedge.exe
4772	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3444	2556	msedge.exe	78
PID 2556 wrote to memory of 3444	2556	msedge.exe	78
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 3304	2556	msedge.exe	79
PID 2556 wrote to memory of 5092	2556	msedge.exe	80
PID 2556 wrote to memory of 5092	2556	msedge.exe	80
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81
PID 2556 wrote to memory of 1864	2556	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://outlook.office365.com/owa/[email protected]/groupsubscription.ashx?realm=macro-group.com&source=WelcomeEmail&action=conversations&subaction=gotogroup
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa51353cb8,0x7ffa51353cc8,0x7ffa51353cd8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15800856425121289671,10031697458862392985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8eb89ef147fe8137aaf22ee5d98a319e

SHA1
0a29eb67aa3450c8b89b7662839f326d6dc15ec0

SHA256
59d83bce99063db3554f540d17e05de55c46daab32ad8f383009076882d3a39a

SHA512
3479974cb3727e6c1f7dd43c241a6cb5605ad05594df4a897c1fb393f0c1579e6c9ca17431a298a833020288e7872a947c52a94220f160a5c92156cf2b47bf48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4075e1202de88211478a2fe4fc8032da

SHA1
781710d31c3c067ecd58cb92972b0a5d85595163

SHA256
ef8df691ec14df5ced3ebe880fc096e7953f2c15d32bb20fc234a451273fecec

SHA512
e05946f6ab34ecb0cb2c25c59f8ad0b28d343654c9ccacea10a32a8001c6c794826f9fc181a9e81ce732e05b9c75abee4101661549a80093044065852d4c57ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52ab939eaf0a2e57b214d57d95d56852

SHA1
a612b89fa7465fe5bb2ffce8158aab52b392f1f6

SHA256
5cb9c013bf47c66e9121d26344b946e9114fc2d939d34e7055016b0d2566936a

SHA512
bdee1178dfb0fb4b2cb922cf16e4d18c6d9212a8cefe29a2cdf883f41799b7dba6a39217eb9204c51bf894116b93c85a502771be22410bc970ae3477a3a3b859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86376cd76b3714362d5eb22af0f6bb5e

SHA1
ed6b49a77a89e5af43552a495a8ab65fc1cb9bf6

SHA256
4f1a75f0e71da8f39865f4cfaa72247ae8adc789b3c91d679347c3f1df7e3615

SHA512
c3fbeb6d816884e7f9872dd09c35c43e348c4c220f1afc691721ede4016d5d17cde50b4a6334da3c14acd6bf1e6d88f8ef57fb96c7afeb2a1c776ea7b3310917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1ce0bd5799fc5f162898c0bb536b76f

SHA1
784fba3382da54023283536718c595bb002663ae

SHA256
6dfa94d743df4b4ca0f121a1d4cedb6ed6acccc00ed9aafae60c1b8e7e78b48d

SHA512
54312a77ece8f02066bd30136c798a22d51ffe4fccf72edfaf9dc8a0522c93aa0db41b1c1aace5e019a2f855b306fbf9367a586880d2c2e7c215c7f953309ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98944a64c52d65ec8d38a2bd77ecb1bc

SHA1
2c0ba982a3ff42e08afa14fea26d06cbdb8a4a0e

SHA256
16ec60b082718b339ce10bf19ce59806540af1f4a4e724a8c7ec0eeab42cc937

SHA512
b51e108f8d7e4ec492af03296b830c4d6f8bc73d2861de02bc669f3c0f5ea14ce886a551b95c7dd42d55403815d775341c3d9361220c8de5c24307b90c3d259a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd4736493066aeb7db2c61f4adbf3e9c

SHA1
1e9cc1ceca4444f721433174e9f1e13e26042516

SHA256
4b6ce109ee037cae00cad6d2fd237f4c008ce745da7b7b355fe7674bc7e58ed4

SHA512
0eb31a8f38f2be4be5436b168daae6025f4f7e31bc2153d5b8b1d704df89f473bf4ee271d4369c03bfb8eb84d5906dec98ce91f813d4375996cbe3a332d0d104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9fe730f9fea23d8e372d60a1299b22dc

SHA1
7db9a232073ceae846682884ca0c2bd7487c7865

SHA256
e98669903b922676244226947a8052a4ac27856ca5167957e8423fa7535f2799

SHA512
f06e32a7a50e603ea52da2817a01dc5416616e3a5bf7ed4bb5086250167ea75811d2a8e367466b513d4f5f90ed57d7ce403c42716b6ec36ce86dcde7327c555b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
55a9b1a18d10c71dff7fd1cf0dde1076

SHA1
c9ff51a4a39b5f30af5f0c6e6c67b3a0555d7701

SHA256
443421a7f885bd19fb401265dabf717e328de7110f092d3b1accaac79e3fdb85

SHA512
82566ff981c89b4ab30dbdf8fb743a8a99204ff878edfc3d1deb5399e518bc4763ea60257dfcb79fe78b1820533f9c99c8c41a2fff18e8e7b912bba5bfd27387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9213f523b090728d44e7e7f9efe4bfc

SHA1
40206757cf55e4b055c89eda0bf5b6034a1c85e6

SHA256
0fe6f2f297486be74e64c9ffca6d6701d40ea103cf012472130277317470d382

SHA512
c49f3643f891c08e8ff451408bbb4979f5eea854c9ad66fcceb6a5f3b4a16dfec44a3c99e753cd0125b3a2c8540c71ac5ca13ed5d0a0b4c91da47675eca0dcf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5878f4.TMP

Filesize
703B

MD5
790d34b2cd3df1fa79906e43f9992d1a

SHA1
88d79b47d0dcc8dc213ba657d6dfd03eb31d9bee

SHA256
ae47831df54a4073b4d3bb7e9c8d7d5de262c255b12d2594309de2993ed349e7

SHA512
bcac68217c8048a969add54c9caacd89d0447aa1030102c3d2efd455520560b3341492b8e38b5d7afc7dbde70e5b626d02bad1635312981018acea729fa8b569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
851eae4409ab759c48358783ee41d6df

SHA1
05927293d8c3c18d48678bd63bbc7af96307ac17

SHA256
4b93797baa7b73417db3cd0d39f6bad94daea249a57e0e37b0fd658a7cf0ee0d

SHA512
1d9cc73676648e1ac201347e2fea2b92fda4087b651f4ecee3218f82b3b4e26c6ace4a9f7f2831fb628a7daaf22c9d30c7c2175a7070de1360ea4e7ff98033d2

Download Submit