hxxps://rcnw190[.]sharefile[.]com/public/share/web-sb6b13673b8ef4d58bee29087dbc44d6a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rcnw190.sharefile.com/public/share/web-sb6b13673b8ef4d58bee29087dbc44d6a

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 14 IoCs

phishing

Phishing

T1566

Processes:

flow	ioc
1	rcnw190.sharefile.com
15	sf-renderx-us-east-1.sharefile.com
30	piletfeed-cdn.sharefile.io
47	sf-renderx-us-east-1.sharefile.com
3	rcnw190.sharefile.com
14	piletfeed-cdn.sharefile.io
25	piletfeed-cdn.sharefile.io
27	piletfeed-cdn.sharefile.io
29	piletfeed-cdn.sharefile.io
31	piletfeed-cdn.sharefile.io
39	rcnw190.sharefile.com
13	sf-cv.sharefile.com
26	piletfeed-cdn.sharefile.io
28	piletfeed-cdn.sharefile.io

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 api.ipify.org
16 api.ipify.org
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
48	api.ipify.org
16	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3580	msedge.exe
3580	msedge.exe
792	msedge.exe
792	msedge.exe
3928	msedge.exe
3928	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

4568 MiniSearchHost.exe

pid	process
4568	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 792 wrote to memory of 4892	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 4892	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 1124	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3580	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3580	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe
PID 792 wrote to memory of 3496	792	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rcnw190.sharefile.com/public/share/web-sb6b13673b8ef4d58bee29087dbc44d6a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd2c33cb8,0x7ffcd2c33cc8,0x7ffcd2c33cd8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,11318320325186977186,8368642413682075943,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
67cb087d11f3a624d717e2eefdc37533

SHA1
3a2e184cdc4f657fd49e49093036ec2b0e66640d

SHA256
3c6740214755f7ba38729cbffcaf8fddf17e15a8fea5256b81bece6886c8196d

SHA512
6af5ed35c6150a46ed4294dd4c2253e36ed7387adae308b42cf5f1ad7f30d1c428c5014f21d8fa4f20b1abe432d07ec177c669a4747a09b432acf3ce9f8fb3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6e64c6c86a33574a397ffe61d2ec3ad5

SHA1
6b435bf5ca50823b482a12557ba4363f298d6e14

SHA256
195f6220c2984062762741ff7a0a0d4f69138461d8c01f8df76406c78128fafe

SHA512
869238030cd52fcca7b7cac0ea566b41e1e4a9a19cb5f836414abdeb947130468b9df4ed7b2eb2210c9fddaec1e6c7f87a295b85f3ca7cac909eb90ad742eb30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b32306d46e8dc5f884376e0647cef42

SHA1
94a71a601e9b4b74e39c11c4f99391780b501f24

SHA256
1bfbb3d1f8778c477d58087e2f89cc5f3be90bf7e4bd81c6655fd1529249a378

SHA512
a7431e1e237ce7c2e1b301054b82059a562410593e294f089d1da21586d06e2cb6ca8c6e9985e172e1c6499e4113baa16b394f65e6fe4d8756ca155942192a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
940cce5ffa7803d773004e323c1dd11c

SHA1
a06093a89c764fda739cbca6b46af55ba4603f42

SHA256
31e5606c8687b90f12156bceaf4ef7fee63329d609ad6dde02141669d95f16e2

SHA512
36fa3e02ff9e97e6d6cc54188059ce8467e7ca91442752a07c5d77f60d50ea5d1c713e52193fd3b19cff8e59de542105d29f0f50084a6c65872b15a1bb59fddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6d02e522d3a05d959b8d36847503f1b

SHA1
e38b051580e531edc350c063621709815aa223f3

SHA256
6546a09fb0e9769190f0b931e81a90f0d984988a9d095fd2f59ea6cbff105579

SHA512
a56d0173e6ed4a92ef337c807f338bd3bc799e77c16f4321fc29514f2c80f0443aba584a47c2eda8acd5eb816565c5e7ffbd6dc869cc62a11d035bb727cf79d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ec854b85da22685b3c1d88a3b1121ef

SHA1
00a46b886775ee84737cb793f003cb46bbbd04e9

SHA256
80f22659cf05e752474da46a0b8a1a9de0d53e2043b20bae13eabd299df81986

SHA512
d68464db21664577d037ae6a60d968b78d8dff36b46f6f7b27f819426633fa150834679316367c74a10eb2cac25f9560fb82339dfc614f370fe12f8f06ce9c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
701b8d46f125c83cd2d1b2b4aa48b1b5

SHA1
4f9aa96c75fb6f7247a6d382ee6fb10a61e98ddc

SHA256
3fd58f4420479f5863a5ab6aef5d7c09b9fde8e8e1956d7493fcfc227d13389c

SHA512
00c6db3cc1cbc420f809243414a429a2639b740d04fec8e1d4cf5f7827235042d0d401376200fa5c8087d6846f972303b9ab20339e091510119138dfb0c9f9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2ea10c2c0c3bbab31b4d448d4927de10

SHA1
684289717741918da230dfc775d404e8df66ff7c

SHA256
a61b03f3fc1f94070c6f7dc15d78d946ad7e5cebe97d5343c9d366f0107b1978

SHA512
1b922aca6ccc21ecf6eb26ba5695aa41ed85f9a62054ab5e273ee229fc9fabb5c10e9cebdc73c5162cc9f84c9e0e47fac61b5a5590e816f0196fe52a80a40b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f15dc803003745708966f5b4999a80b3

SHA1
2ab321392514f91e1a593645c0cffafede914310

SHA256
61f621afc5b8d99c33139ef5386ab3982ae51bdd9a6673187e8428246269e459

SHA512
370403b4926d6f28f9859d11c4c14ca2f052024117d720cb3d0ec340156219b7f928d319c0818eb313585cedb6a146807ed49a768df730d7c72dda8100ea30f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c68c.TMP

Filesize
1KB

MD5
a98a8b8f0de248283ed237faeb1e3035

SHA1
e3a14d0402eaf670e6cf46d3a9fcb76749b00a61

SHA256
bab536020f4112df2289d09ab9429684f498b6eaf75226e680545ec2545ce775

SHA512
824b2d4cbff4934783dc4198e87fba7254d0934eca5727be06cc57351e0aa011416e074b9c3cddc2ba6af5bd7c9a2f1c4df3453afbb2804aedead1654dc2c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a7ad0b6499f89f3632f21ed7aad3eac

SHA1
deda7f2b110eabbfeb761f09f8848d33840be770

SHA256
973047629702d1d8a2ecc051288a2fb34dacab3b1f447d366fbc895c40ecf61e

SHA512
bf7ae9aaa0d13de3e3c97c5e92bd01089644ee850bbb10f3135efb8baa4012d7a1f93b63a517813aff0dd235ec5bce58c47aa400e1109cd7fcef7c9f4cd29cf9

Download Submit
\??\pipe\LOCAL\crashpad_792_YYXPJLIGPGMIBWNI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit