hxxps://eu[.]docusign[.]net/Signing/EmailStart[.]aspx?a=fc2e6ed8-19c5-4a2e-b15b-b130345794be&acct=1bae4dca-d1dc-4f03-8fff-91b6b4c9ec71&er=a052fa95-5caf-4d03-bc2b-a0fc47574e08

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eu.docusign.net/Signing/EmailStart.aspx?a=fc2e6ed8-19c5-4a2e-b15b-b130345794be&acct=1bae4dca-d1dc-4f03-8fff-91b6b4c9ec71&er=a052fa95-5caf-4d03-bc2b-a0fc47574e08

Score

5^/10

docusign phishing

Malware Config

Signatures

Detected potential entity reuse from brand docusign.
phishing docusign

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4652 msedge.exe
4652 msedge.exe
952 msedge.exe
952 msedge.exe
4872 identity_helper.exe
4872 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

952 msedge.exe
952 msedge.exe
952 msedge.exe
952 msedge.exe
952 msedge.exe
952 msedge.exe

pid	process
4652	msedge.exe
4652	msedge.exe
952	msedge.exe
952	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 952 wrote to memory of 4800	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4800	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3132	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4652	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4652	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4948	952	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eu.docusign.net/Signing/EmailStart.aspx?a=fc2e6ed8-19c5-4a2e-b15b-b130345794be&acct=1bae4dca-d1dc-4f03-8fff-91b6b4c9ec71&er=a052fa95-5caf-4d03-bc2b-a0fc47574e08
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9994446f8,0x7ff999444708,0x7ff999444718
2⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
2⤵
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7c89e9212e22e92acc3d335fe9a44fe6

SHA1
c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f

SHA256
18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44

SHA512
c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
db7067b02c36fcf51e9b275ee12b1c98

SHA1
163852c60ea687b4a7350b929fc69d06cf85974e

SHA256
33e24bfe021122fa91818c1cc1381496ff744a8c085209b975cdc8ff044b0d83

SHA512
73ca142f4e87c5c94efc793e810f5cae40a9aa7467636ef3fdd36f465ad20699bc78e8a1c1aae8affa8f9d68275c3209b84d77b48def5afe352c34e903f36bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
336B

MD5
b43a2ae65422d84ffb1b593e21c06005

SHA1
077e791236744c05469b823ea36164ed8a2f7819

SHA256
6c01b84fdea6a75b4fcce3fa09959e55dfebbdc5120bc064e4862aa4f5f3cdb5

SHA512
145665addd010919cf9aa275e03bda3d12deaec53ed9b5a5367e93e421f51b3c60f7ef7b0c517a4c4d2c18610e4d32678930aa8cbae4d4c9d5d398b452b4812c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
18f8f2269c3cbe35e2a6879551214f4f

SHA1
fc9a3a0c2eb85d0e24d57d00b862822bc4ec3fc8

SHA256
97fce03f207f05dd245873df0d1516f30ebc91dee6882c3f2f2f0678a153b37a

SHA512
970c611de24c7416a852db9acc0f5f477fa8128d97df6712b7cc0afc1165d6d674fd94a2dba71bae5a64a7a3d8766c74494afb4b83b209555ff53731aa7396a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c8c699cec10ecffa9c8108e26740a15c

SHA1
e3db55e5b5382707a1e8284faec0b6e8f3158e59

SHA256
b9fc2c49ce8ebb457897e694f3129530449122a5b178641a0120eefa583c1bff

SHA512
132845c27e551df69e5f75a903c549ee25f11ad646f608338e4f4224ab81bfcf5aa48018fca896d77362595f48cf057b870135942f42ee86885dbc6afa62bd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
70c2b09157c7452d38aedf20f3447bda

SHA1
63bc3cfaf2049958ddb335f59eec633b76b76afe

SHA256
adcfbf4c085e3046acf53579a18faa20711e5dae8c3af42e3d0b1f5bda68b285

SHA512
f7766773ac916f0924e7023e0df32590f56a508bf17778a412c3a3d6076ef7e93621f67be4bd17674d7253fad32508369e4e69ce5d2036201b3810ea4daa1213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
d7b2b29ef1d9a33e61e1167984c8ca3e

SHA1
9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34

SHA256
7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2

SHA512
3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
370B

MD5
2ebf7606e8dd3ae79080cfc0ba8a929f

SHA1
6d2a7a65785ded76e17f266333d4c3ff943be321

SHA256
d307542e5168ef50fdef5c3db6b4abb9faf95a4918baab003f8f0b4f00ba5f74

SHA512
e1658bd87eac994e10f49213de365253317c21b5448be05ce4e6f99b072375076feb1682fabfaccbd3d191898061afa96a4c9101d79cab993fc0d6cf2ad81c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
370B

MD5
03befd323299a11cb183e7082b001b1e

SHA1
53babd762b3f6a7cdfb9f7f2468a90ba2e706e43

SHA256
463885025f6572a8fe11764286d0b4741ddebbb8ad04f7dfa702c966c1bf16da

SHA512
5b9de13b227f49e43f10755bd06137968a064d55510ed98d5ec35e515cca81287e00105716c4f76f8423ffa78f74ac667598935c7055bcd2fcb6ba43a80d628a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
5fef7ecd998df9c926fec7d490c9764d

SHA1
586820baaa831e8c335e666f33a35e4de115ebd1

SHA256
a90d6ff7befd3c6115727f7bc0c61d69b3c23846f939b4461a46b9011f69d1ab

SHA512
a3b67663d1d8d2fa33f3d69d3f55252fbed2df6c2e51ca1857c8f028e8b96dc176ae15aee435c29d7aef369a8ea32db907b3ff027ab8331846beb6f550df3455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fd0e3446add6e789e7b1c1c40a623f77

SHA1
3d4be12799776ecca80164e236eb3a5e538f3589

SHA256
7d9826b6ae29852ae137de811089e9a720f3d584f59650b12bed44f9c030f1d5

SHA512
48fdfd449ced1fd89c508f44ff7d609bdfe78c00c27e63ac556d739f23dd1e15d9eaa080a69a7985228f01cd8888332616be648557a4e03bdc56570481442676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
d0d5a9dc92f7d5502f017b8759139155

SHA1
a437cb1712cae19e8c2aef4e97bd474f2dd90d89

SHA256
68cabd22c3a4c4ae201980a5126390c6bbea38f2b342d1a1ad84eadeacbae583

SHA512
e5d7ee41cc8c87b7fca632aeb13f183e946ff8f40b36c950e4758a2b06152cced8490ca3d77bd24ef4e69ae8d5e8a56e32cbd933b874d086e0e97e012e22be2c

Download Submit
\??\pipe\LOCAL\crashpad_952_TSKENFYJGJLXFQJT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit