hxxp://fresnochaffeezoo146[.]sharefile[.]com/public/share/web-s6ae181f3523c40be85d3d19d2b4bbc7a

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fresnochaffeezoo146.sharefile.com/public/share/web-s6ae181f3523c40be85d3d19d2b4bbc7a

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 14 IoCs

phishing

Phishing

T1566

flow	ioc
46	piletfeed-cdn.sharefile.io
48	piletfeed-cdn.sharefile.io
94	sf-renderx-us-east-1.sharefile.com
50	piletfeed-cdn.sharefile.io
51	piletfeed-cdn.sharefile.io
52	piletfeed-cdn.sharefile.io
14	fresnochaffeezoo146.sharefile.com
71	fresnochaffeezoo146.sharefile.com
86	sf-cv.sharefile.com
5	fresnochaffeezoo146.sharefile.com
47	piletfeed-cdn.sharefile.io
49	piletfeed-cdn.sharefile.io
53	piletfeed-cdn.sharefile.io
92	sf-renderx-us-east-1.sharefile.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	api.ipify.org
95	api.ipify.org

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
4760	msedge.exe
4760	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2108	4760	msedge.exe	83
PID 4760 wrote to memory of 2108	4760	msedge.exe	83
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 3576	4760	msedge.exe	84
PID 4760 wrote to memory of 60	4760	msedge.exe	85
PID 4760 wrote to memory of 60	4760	msedge.exe	85
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86
PID 4760 wrote to memory of 1916	4760	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://fresnochaffeezoo146.sharefile.com/public/share/web-s6ae181f3523c40be85d3d19d2b4bbc7a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4cd146f8,0x7fff4cd14708,0x7fff4cd14718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1516619661784134357,10905919160813879074,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
352280c9da8cf95bc772d84e41c9030e

SHA1
511da42c607dbbadc3e05ddb8ce2645ac5744df4

SHA256
ffd22ba0852bb27b90c460b7489e829ddae29a3b27fc2e0ad6bf42ab5d71fb33

SHA512
b768fa4032d2bf1f8a78b0c6c1b0e40780823841077cb7619f84fa8cbb7ff6183d1534fdf45403731623313ab4ffd91c8e625bbded7a873d250b83c3f6aec53d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a276492c221af04690ee50f43248fc5a

SHA1
f1fc739a2859a1ced63e5ba27d7d397ff355db68

SHA256
ad939b3a7ad4b951facbf258137392e55c2b9b5c2e727d747a18e0295d539fb6

SHA512
1f77981e2e7c322f5f61820850c9d55bced79fa6f9dda2e876f1ce41af2526e5e20464358ebef22452417faaea6b6082b2e9edc856f203e6c17dfa90db1cb1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecacd850d6484cbad3a2ea421b944daa

SHA1
1bdc8ab6aab1e2f9ac8beaaa334923af5eda47e2

SHA256
5bbbedc6037a7c4da5f986ac83580628584111a172a4488bc107a8a255ea18a7

SHA512
f487fd6416080a07fc01acf7b3068fe2f32294564bb40222e941dd9a6313831877ae36ef6070d241fcb22630c5e5153dda12e2f788404b6931b4da58e6b71347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcb52526f925442d83a78867fcd7c66c

SHA1
f164de3d033841f4556a625d768f18d106375840

SHA256
26c1e1484e73a63880f0bf212a8cf82232c2c379d8b5ea02bfc29dc7c23e6951

SHA512
f0e0afdf85c37674a62f1a5c702334b33b48847eb5f1f2611da72d170ab2a834d8c36b26c954dcec0af37176d2030b3f62bb2587e8427f8bf60e6a7736f6b7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d17d106c5bd11123aaea4dcf92ddae9

SHA1
8ec23e7f150096e8799711815baeb84495963660

SHA256
f9571ca9ac63e851c0e9f6511a930521b4d274045c64cddf3c0bb889c5aa5601

SHA512
51ed1ca161fd2cc98f9179cf1f0409719f5927fdbb73cef9dc30b5b76059e6642d2f3d9ff74b2c67ae18170b7ccfb1bc3a62aeff361ff97cbf971f1e38c96748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6e1d47df5a0171d75f3929634662ebf

SHA1
fe5f8bca5446280a7a15f230287f32e9768f0d61

SHA256
44a56d1facfca4ff02c04d8bf65b0a0bbff664a2b1746a2000c2ea2a299ca5fc

SHA512
091088478b72f38ca9d6c8fe37ffd6df7489147952ca567200bdac220fee7cd996f50ea4b0ad90608abdb81d609239d7654b171aa6a13c53cad87e3ef5130829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8aa345192c3f9a851237a1d9aedbea7a

SHA1
a8508e15918c56b3bd0f8097b6db587beabd7c32

SHA256
e283c5f7e2c0e7f97e83afb476a95b7a894b2292db6f42fa35002ae400e348ba

SHA512
e98e661ad5bc35ff1892200aaed5d309736170ec6e9b14a35729cc49acf372a608551284d994473bdff405d8b7271a08349705373b5ce704b1a17baea05f8299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dea5e152c4eec4e4a84ec445e335a19d

SHA1
803f5b220276571248f69f137b849f6ab9bd6233

SHA256
ee413774650754f39ce38aaa04991eaed1f42443d02c689354b922c367db9b4e

SHA512
c053eb61e8725cbe95434f32bf0fd777be85f89b2035e79d39b72343810bc9bc452bfc3c2a5c27c4f8d61ea18fc0525a58b2e9cc04ac56536da7268f82c1e244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48482b41f8db8d12afae276a0bba4328

SHA1
246de27cf65420b44410aaaa604da52b31463a30

SHA256
355f56d1b6ab0e1b25cad0acde823f5291c6caa4e2b45165571c626b6dd4ce53

SHA512
9689cf9dde4a30f0b16505fcb7f94a8f93d5587e793f82f930a93113442cc86772249b3d3bd3463e097d665b50fe4b153185cd0a2df0f01381d70c5df0654bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c237.TMP

Filesize
1KB

MD5
24df9c9e9a7bea0560fec0338a405062

SHA1
1d7d0fa003832d2ccfcc9cf540929ae8e366114d

SHA256
854430fd093f56d32b883443825dd55710c6a05b956e6aa58c8edfda1290b413

SHA512
7292eb50f43c0db1b547727167dc38e1af12bfba8437ba9284b45bf820700ad189271b07eef0edd8d008d6a0d280c6ef65b01955244c38a2796949c7bfeec4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b89a2f490191fb27c3b5a4f3a624f90

SHA1
2135f8f6017b674207cb045dc1edce4612df4876

SHA256
78e13d23c292aba5a9cba931bb3dac312e28aee10518d64dee57490ac0549646

SHA512
ffa90a320f15c0856cc90c76b2f4fd76fa07cd2b2d2a28b985080e1b0f99c1b55849570e9b7b2500f322d1deffcfcf805dfa5cdd33b5090d410afdf86034fe9e

Download Submit