hxxps://www[.]sharestion[.]com/eur/10338048-193a-4298-abea-3596ae88b05e/e03e753d-a968-43ec-968e-bf7aa55e608b/8da7a36d-517d-4070-9d0e-9e1969d73c4e/login?id=dXhYSUM5U1c0MkxaZGVCY1ZKZlVqNzFrSU8wZzJ6cEkvOVV0Z2JHNnBXYmNvSWdROThMSzcybTROTmo0TDBVR0pOUXpMNjJhNEdtdUV3VTdGZmt2NkNqbDdsUnJVYkl2ZEdvNnNPQ1l4cnFyNmxhU2ZPV25oVnBnUER5UVYrWVVPV29EeDhIaFBPZlRQWTVOSG5FMmp5TlFiMm1wMlB1WURrbGNTa0JRZDgxSXpiN1NiM0hQVTFOOFYvNTk4ZmU5TkI0MlhmcGtVRmhYdllsZXR4bDdTNW1MMTl5ZXUvZktPb2x5OWcyVTVKVW9xNStaNVErRk02cHYveDdQVHJMUng5SmVwL2s0THF5Vk5tQUtacFZzSTByOWI2eXFjbU1zb0g0ZnNRcGR0LzFnS1IvTytINTdEYncrZmNoTlcyRFRuWDlneHU0dTIwY0Q1eGNVMEpaenZEWDBkcDJROTRQQmNHZ2c5dEJFYUpRSlZPZEdURnM1RTNISkVsNXhWMzB1SS82dnBQa0hKR3prQzVvaXhXY3R0dk1DUFdpME0vckxBUnp2SElmTWpuST0

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.sharestion.com/eur/10338048-193a-4298-abea-3596ae88b05e/e03e753d-a968-43ec-968e-bf7aa55e608b/8da7a36d-517d-4070-9d0e-9e1969d73c4e/login?id=dXhYSUM5U1c0MkxaZGVCY1ZKZlVqNzFrSU8wZzJ6cEkvOVV0Z2JHNnBXYmNvSWdROThMSzcybTROTmo0TDBVR0pOUXpMNjJhNEdtdUV3VTdGZmt2NkNqbDdsUnJVYkl2ZEdvNnNPQ1l4cnFyNmxhU2ZPV25oVnBnUER5UVYrWVVPV29EeDhIaFBPZlRQWTVOSG5FMmp5TlFiMm1wMlB1WURrbGNTa0JRZDgxSXpiN1NiM0hQVTFOOFYvNTk4ZmU5TkI0MlhmcGtVRmhYdllsZXR4bDdTNW1MMTl5ZXUvZktPb2x5OWcyVTVKVW9xNStaNVErRk02cHYveDdQVHJMUng5SmVwL2s0THF5Vk5tQUtacFZzSTByOWI2eXFjbU1zb0g0ZnNRcGR0LzFnS1IvTytINTdEYncrZmNoTlcyRFRuWDlneHU0dTIwY0Q1eGNVMEpaenZEWDBkcDJROTRQQmNHZ2c5dEJFYUpRSlZPZEdURnM1RTNISkVsNXhWMzB1SS82dnBQa0hKR3prQzVvaXhXY3R0dk1DUFdpME0vckxBUnp2SElmTWpuST0

Score

10^/10

microsoft phishing product:outlook

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

696 msedge.exe
696 msedge.exe
1200 msedge.exe
1200 msedge.exe
2456 identity_helper.exe
2456 identity_helper.exe
2908 msedge.exe
2908 msedge.exe
2908 msedge.exe
2908 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe

pid	process
696	msedge.exe
696	msedge.exe
1200	msedge.exe
1200	msedge.exe
2456	identity_helper.exe
2456	identity_helper.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1200 wrote to memory of 4984	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4984	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 820	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 696	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 696	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4604	1200	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.sharestion.com/eur/10338048-193a-4298-abea-3596ae88b05e/e03e753d-a968-43ec-968e-bf7aa55e608b/8da7a36d-517d-4070-9d0e-9e1969d73c4e/login?id=dXhYSUM5U1c0MkxaZGVCY1ZKZlVqNzFrSU8wZzJ6cEkvOVV0Z2JHNnBXYmNvSWdROThMSzcybTROTmo0TDBVR0pOUXpMNjJhNEdtdUV3VTdGZmt2NkNqbDdsUnJVYkl2ZEdvNnNPQ1l4cnFyNmxhU2ZPV25oVnBnUER5UVYrWVVPV29EeDhIaFBPZlRQWTVOSG5FMmp5TlFiMm1wMlB1WURrbGNTa0JRZDgxSXpiN1NiM0hQVTFOOFYvNTk4ZmU5TkI0MlhmcGtVRmhYdllsZXR4bDdTNW1MMTl5ZXUvZktPb2x5OWcyVTVKVW9xNStaNVErRk02cHYveDdQVHJMUng5SmVwL2s0THF5Vk5tQUtacFZzSTByOWI2eXFjbU1zb0g0ZnNRcGR0LzFnS1IvTytINTdEYncrZmNoTlcyRFRuWDlneHU0dTIwY0Q1eGNVMEpaenZEWDBkcDJROTRQQmNHZ2c5dEJFYUpRSlZPZEdURnM1RTNISkVsNXhWMzB1SS82dnBQa0hKR3prQzVvaXhXY3R0dk1DUFdpME0vckxBUnp2SElmTWpuST0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e8c46f8,0x7ffa7e8c4708,0x7ffa7e8c4718
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15903165277200635765,16006909401290483969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
48b4602256daf995b9418d155c0ee8bc

SHA1
b560f45a75f7af8a6a0b743c979242165ac8ae15

SHA256
5a6591226069fe4bedefa9005cffded39f27049a9ec140a2153cf9e58a9fb6d0

SHA512
1b767bca5a8393716a3129135f9d805b2af28364f1f9d436963f85c133450e5bdaaf82a31c7b3446d05da0ebd987223f1da9f0d6b71fd5332274bece4fa8d29f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
261B

MD5
eca567a3f6b95af2a33fba9aec92534d

SHA1
e89ed11274fd59f1e109cae703f0f121b3c02e4f

SHA256
719c1e2f1cbd0865a819d78a1764cfea01321da9f802405e737c72f9a0bd44ba

SHA512
c87a39f6db42ff17eb3aff55fe4e15a4c3b4f9978cf892ac1260efa35c3409d1acb9fa15f2613ae8720d01b5c3b778e0d333fb379e9c4df0d9e1adb936de0423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
45a4b187cab9e80ca50f378b602b8237

SHA1
de8830e340f1690a551640574a32f990fff77d66

SHA256
408a3759698641a620d149b60498c739ab673d3da11251dd1299fdd5eba36946

SHA512
8b7afac1c68f39a7b8fa3433998b52853221f0af0fd597a21f0931ece515643fc11ba67b00f695cab1c96501ad90d995112e04b56d78fe67256e3fa26e16060f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
552037b92a7f94d4324e9732c17bd4c8

SHA1
d752e29bee34e3e6ed48a15d738da02d363031ff

SHA256
eb766f3f91814c6e762aaeefb481268b98ba939830e62e8c1ddbe7e30e4540f4

SHA512
9b0c9cfd4d7dca895de70c56338feb53d7c24fe650246d460bd5dac9ec4673e50e092a5aeccf5c470e2d73a969cdc88ee969afb1d6c2fe609368133883a05546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
469bc242a58013b2086a722f56b3489e

SHA1
77e4463310953335e1f4c2060258d9aecd19e8b3

SHA256
e7391c378b2f563e03737cccf2add799718c92721304745872adde85e8f80a6c

SHA512
7d804c45fb34040d6f1c3c86ca10c6f1a8d3300bfcc9755ec635481484e72a18997af55f33365f9c1dfe1becf7f25e4610b0131c2d10fce9f6da6e8c76bdb5ac

Download Submit
\??\pipe\LOCAL\crashpad_1200_GXDMPERPBUKPGEZT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit