hxxps://docsend[.]com/view/mx5gjkemrx5qw78i

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2023 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docsend.com/view/mx5gjkemrx5qw78i

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
1124	msedge.exe
1124	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3592	1124	msedge.exe	66
PID 1124 wrote to memory of 3592	1124	msedge.exe	66
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 5012	1124	msedge.exe	84
PID 1124 wrote to memory of 4916	1124	msedge.exe	85
PID 1124 wrote to memory of 4916	1124	msedge.exe	85
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86
PID 1124 wrote to memory of 224	1124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docsend.com/view/mx5gjkemrx5qw78i
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff36eb46f8,0x7fff36eb4708,0x7fff36eb4718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14468159538993481484,350066468135474840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
26KB

MD5
f1b2f2e6909794a69878f472e9b950d4

SHA1
1979b23cada5c4e9517fffbf03d8b4fc547c6a28

SHA256
c0752e6398a3b14b213c836f593e90bb2f3c2ee01bffbcae134bb908033424c5

SHA512
36f327b9e02d51a0b40f06b2a46888263323d4ed9f915468756b622219418fb739cf1033b108251e893ab70f159ce58f5d25661772a84450ba6f41fe3faa55b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
102KB

MD5
2ee1de9dff9de9b8b761b8e88753e6e0

SHA1
eb7f2d3ee5fda765441cc602ea29dc2c1c44d2ce

SHA256
8194888ea05481fe3906d2584299168fa8d622461515ae13b2314b94001b92e0

SHA512
ac5f9cd255c7692174678ff1a82576c0f042dd133b9908c818a5aa230c29385fa4b1b332d14ee57973970d1930f384d7f478cf10aa08dd8345ab5520d8963177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
68KB

MD5
38fc2d50e15dbdb743df00ed8dddf4ff

SHA1
c82eeda5c4716f20c1f5ae279950ec6cba78259c

SHA256
abf6f6c34c924fb599d8398ba88c47f472cf4017be4850b41f441baa9e35fdf9

SHA512
90f39fe0d18329c73b75057bcbe5bfe93b1c4b1c12705d879ebff423b15041f6c799d721c7a137962f8cea341656577d657ab2596a8fce01988ebc7ddcb6f700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
135KB

MD5
b73eab641de5cb260398e68de594e736

SHA1
1794235a7df411532dcf7f2feee0f6c8908dc9c3

SHA256
0ecf22cb3a5ccac348f694a957554664d0a682cfa11e4a687d0e9d746f437d52

SHA512
ab333dd7237e8b5c9d4c00516cdfd6850c97e0be5653f9505ce193c9a318a01b55749e54b8db121b5c5ff27bdb3295243ef2dde46d90ae76e79f6cf87b5839d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
76KB

MD5
f49ed353526bfc5698d3a500a88c6dba

SHA1
8ebfac91f0735e64b76ee43a2c3cca30f170b5cf

SHA256
535f530aff4059cebfefacade0563b578711efa7fcb82ce11e40d1f7e6944283

SHA512
c22d501aae05f6d72f4ad10c6ed4f858da3224d2ff955345d33ee1040ef817c3465cf1c5eb708cccf1e328c540bf353ca03e2f060f11d727f6fa9bf122f77b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
33KB

MD5
06a40c3e4ecdeb9939bbf8e0c6da7deb

SHA1
3da7078d907860d7069516e3baa0ef878863a0e8

SHA256
eed7885f0d666792018b3d37ed7e8cab149c042c902b34499d634742eaa2d8f1

SHA512
912776a924634b43a94a32072f315945b5daaad21290713ab4c15357145ebc204b9440818ba2411db7c608d363b535b75d46f1d29d5daa61c3f1a1d6358a5836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
45KB

MD5
dfc5e24cbc1b134e0c00c61e84ec999a

SHA1
d3b1a8ef1d0f6f9162986479252570525719f203

SHA256
b5db3e633ec765fc01a19c06b0955d56c2503285e59d8d348d08ec34abbfeaf3

SHA512
48726cb83bdd0eb6822a73734ae272286483e8aeb6e18f57e635ed9269ca3c6c62e2d900224138dafe32a79a94c3c7694307ff413505d695a77fe602681df27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
42KB

MD5
93b6f18ec99bcb7c3fa7ea570a75e240

SHA1
60b9e3062fe532cbc18b897fac542c56a03544c7

SHA256
43693f7bdd6146e783fab3f75ba0a51aa3cf9530adbf790dbd686fc8a17aa3db

SHA512
ac1a9398b74eb75ac4d52b9a9054a1add5a836f2572b99307851a0bb6d93288a13199e06e5df4f1391209403bf775c9235a679bd081ca7f62b7752ed0fa691c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
40KB

MD5
d51382d81d441043d94ee30506fcb448

SHA1
335055e2b33fd0d700d0a6c676dea622b214f812

SHA256
48ad0cfa4706b5922e71274a5771561731444ea272a897487c7d6d4521771b44

SHA512
c81ebb472f4233c4b335dc8d7472465b5517e178b21dbe7326923ab15f120b1e880e71e0bc1882119da34d4abc9fa23464ccf973beebea676072727c67d67491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
25KB

MD5
912a6c58d40e01ca84b5cfc880791482

SHA1
2b6481be06ff2328fee6aaf692132d2e63978dc3

SHA256
13358f10bc34c96201740781c991eb84f59cfb2901a5394351c2c8a9e1cf5092

SHA512
f56a67e1cedcacd86818b5091723fcb17aedc8d63d0ecaa7822fcf07bc287fe276c05a356f441e62e1944e44fb10d9602d5ddfccbc0cf732dc8d1c8e0f5c9c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
117KB

MD5
0c1be9b3ee404911ff911f5174ed839f

SHA1
c2a64164b72bb2f31c5f9c1f07fc3eac57012be2

SHA256
a5ea01acebcd64b62bc7fdaf9bbe9e944942491eb65bfcb9ce10f1c812deb0ae

SHA512
09acee87622be231fd294783ebc0cd64a9d2797229b7a9f5a2596fc20c2f434991a323b377762e43a3a0b2ddf09124018ab2d5e740e885a7184e69857c1b53ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
16KB

MD5
e91f4f5a94c1b1df605276335ca1b22b

SHA1
92ff4617c8647fad82dd0d9a396a80089966bdbc

SHA256
a48ac133bb1f22eed7a22936f2eb52081a81df527997f017573896f72088cf4e

SHA512
17fdbf32760a7c19bc3678a9c5033c277a61c8c74d38054fdfea42ae73da2db41298456db065858b79a8bf02b96b61d10ed339e7d0512a787a5c5bf21eb88dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
cfd3324514708748c25015264192ebe6

SHA1
6cb7203863e7613bc91b9eb908de7daddb8a3f20

SHA256
40510eb2a2f8bc8a00dcb7e3d8a25653f6db641e925644abe788574fd86fcc19

SHA512
59807b60587913a0b5813e321621bd70cac74e5cc91442be457dc39a893e1049bbdd132c7dd7b17769188e037e266244c8530a54870c4340356d17e7d593dfd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
18KB

MD5
582295b77f0de9d85bc5da460df1b0cf

SHA1
514769e15ea7138f970fb6379c7fff3919413429

SHA256
b50346113c22711ec110d1c0dde76886d3e1ea73c6791c2eaf91932090719831

SHA512
d8b627d37dff823487a704977a9471f985b7611ee039e9b5d66aba21b8633948540f2747c05fd07ca49853642e2fda529d087ae849f6c8ff42a938151d10898d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
31KB

MD5
c048cab5a4ca295029b285820879bfbc

SHA1
75ccd903641dd0051750467a76395c5f7135efd9

SHA256
340a21c18cc41f6717466b2e68a2247d0d13bbcce3eb4d7fdbe71701a9430adc

SHA512
b9a7c948e86ba5d7305071073fa7b7cd0505b7f98096c8bbcd774202e3defd10d17117935e6c6d3b3a84d240ff0fbca88d118af164b65416811b5afc50c0468c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7377736e0b770b1d50211d48e8b3f65a

SHA1
68c07c495f63fcf5b7fb437644a7e73621114cc9

SHA256
9bfb29e1102e61f4e6ac7e49085b354c4c763e950bd11dede818e0a325a027b4

SHA512
c823e2f8d0f8b2dd7707b75b6a20e390ae16e86efee46fcc6a8a95cada6d19e7881d002a37d819b355baccbdeb5be71a83ba8f33d238034a46403e2fed5b54dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
69220a4d5a6429455441691ca5bb7d27

SHA1
3b4677add0dad41fbc41f69beadb35447f1f6b9f

SHA256
3051cf13067cfe2f08f238a3ba38c1f443c74d68d2f4415c852f211f01c7ccf7

SHA512
98f0bacf099d5b8a2367650eb3e5f0e45e4708fb62df8920c426ff8539afa1173a913e39cf2630efb16cbd8645188adb7b51f637d0bc7d1314f70d8ce4037ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90399b33ba3c0988193bee8924270460

SHA1
22602fd756b1d33ef21ebde718c80e3081067c82

SHA256
39e4e92e9501a143c4f457121f704dbe712401f9939f496cb25aab859d9dd034

SHA512
a0d5211e150f0fc8ddf5286e5fc129af583e45efd2f0f5b6c73e7abbe81d3567b5113ea4b8830cbc4f470f6c6ab3a05519c39487191458719f3a81b32d2cc5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e541c36aba109a05e9ce9c2d1cb791c

SHA1
020e583c29b5c30dcfdb4c4237ba0851a6da8e2a

SHA256
2e2ddbbd897137c02d979050cb1428a5300fa4acaca4e46c416515e68608f89d

SHA512
ebb7c298d8054d0b5f9da9533bc18ae4f42f874dfc48085ecaefd7b4daa44624aca51ce20c236289ac95d81efe72ce574e889d4ee161958226f719227515e52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0918a964d03c753ec3aa305386984da0

SHA1
ae3cbfe43a13267b34761555615b83ff61bbab9f

SHA256
5303ee08003255d535e8be0df3430387d5c9f4af43d8164262c0e57d3e492319

SHA512
f9833726f510c60e2bf7321d552f94fa74586f6a3bcf960d87a8d8c0299e4389021ea7e5c0d8c0587edc1ba92fe1d7f6aceef4b13a00efa8c455aa61007666f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9c2be219970d6a2ab07c00ae85f29b5

SHA1
309a82b5c1f7bfd3ea1d14671cd3338488c3fa64

SHA256
67e2f4f659dbc88c76f9121ba5b3229e1fea8ed59f8edabdaf82f518972efd4d

SHA512
12bc7734a1ce9cc01bb15e05ff7b28638844e602d7b7c817ad834e759c7ab3e3bdc95586fef780d4c68d1c5a42c11dc9ce411cb0b3df255d1ac4cd8a2544dbcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
518a0d268c55820e81b7c56de503e84e

SHA1
7b396e17a5f03f3b3ca3225f590da42b074dbee7

SHA256
735a8bf3fd55894163adfba7628567c20abd7ab69876303b5eb20961862aaaee

SHA512
2155c99cb7b9a34f94bf9e6886647ce7e5af11cba26bc311122e866e0359135ce5427684bb7b6e6dada0934e13892f999c8ad58f9949199008b2195d9c49d629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e567ee184b8f596c96e9e3ad143a7947

SHA1
5e431c1c1b33f7188ffe088f2916a6d2a736853f

SHA256
b5338dfea25ccfc7dfad7a7c83c3fa3a56c7a9eef5f25c684236d57516cba490

SHA512
ba4576201947124ec02ca10579c0c27f37225e21222294bd58eabf515749c30dd8f41db60f63786fc7ad17abcf3621faad1dbad6abe5475b9897a66e5f082cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b8b8faed2603d8613f966de7e7e1eb22

SHA1
a8700c564408bc1a3023d4a167329ad3462d78c1

SHA256
3cfa9276c48086f8910ef04c045108ee3cdece0a37d9273d8bffb55985a82797

SHA512
df28a2506abe5266e2ae3f3d130573e6b5a590e4a8e73ef568000e262e9d4fdfc2b04d7d1de45a9dee167867342f7e5b16e0a7f574fe301bc4cd9401442f8b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f70bf98c43e08dd060fcd7b6990a151d

SHA1
e2f34264b2e1e3d5b88241222e05c8810a750fb9

SHA256
f163d215120cd33f4008bc72d5c0d5b051971c5d137018faf9031c4c8d92ba64

SHA512
9051f7c66f472f2a28828e2427e9b04887458dc83a06ecc8781e96dcbea6d75bd9d14ad54b1d2b7c7dc92743622ec0c7ea65402cfbb392d7419643f9806ece6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
41c2f809164e4124ebfe1948e40017e6

SHA1
d9eebe7ab4ff9e03fc377b1c267968db2be12349

SHA256
03929286c3790b338af9addab850b72d0787feed0596ae7019d4a2cd983a9c9d

SHA512
3df202088f764a1814ef6d228445d3dfd3acb6afcac46c035b4d789ac3747e5b2e853119ded90a597fa1824f180da6b4f155679de0c535694a7c6fe16864f1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4d013b500c3b7ffe1b22f6b36d21bef

SHA1
615b8c766feec52db99155bc1cfbfb50224c7436

SHA256
0bea1c8bf62219917332adc67135516bcea59bc97111ccc95c6681604fce712c

SHA512
c01fa69646a2caf948e6368182dc19a48e4728fd3b1b0ef2d0140d41728e631f46a7d142d49bb1cd4023899c3b57bc31e9c5faa4f9c925de9633f58a1eb1a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b8cdbc193d8b8e4078f29eb016aac028

SHA1
b4ed0d9fbf3105293d05c86437f66b0fb6163b42

SHA256
535dfdc93ff7e223931ebb1ac7ff1bb2e3af45781949c0cf0c8c5d2c5404055d

SHA512
8a5329aec3f426d400ce11664fa2ed51df72946683193b61265fe82df218619ef3155933b34699c0dfe3df290db72b7b032c9f89e9d639ce1fec957616ff4ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f745fb3edf2961c46c2735d881e8c24f

SHA1
89f14a49d2795830d34b598be78b991696a9a387

SHA256
ba7b64c9c80bde1386bfb6accf959b1dc9fbbce88c50ea30e60665c86966e4e7

SHA512
4a022f7acc501fd708ce2369f88f64246c68582e356742f71a0897a9f19fcfe1b879cb109fe029dac4089948d767455aea0ed15c1753a7cf50988a74df8de50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8ad.TMP

Filesize
1KB

MD5
a452de796c61ca5b59b3b2ff79caeee5

SHA1
7f64619a9ac51f0f96d8a4f7d8170a6b1ee9fcb2

SHA256
5011dff88c60607d89e07766d67133a5cd9c01c8afdc450c7bd10fd20a588c92

SHA512
d591a800dda94e0c593bd11660d695d1ebf64bbb5a790bb1cc3f6f8ac823961eacd8d0a29674a4518eec40afff6594e1588080db529003f9a5e93b47ef5ddb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1310ec1293cca9596119a406d79665c5

SHA1
5795544dec6b4fd18a9e45a31ed14d7060327299

SHA256
943287d5203b406ae7c88f4c1731c19fa73a5a5299362e6de529d6d05fe5e814

SHA512
5cc41db99c3aa8a6bd7c318f9ff4aaba79578c6d1af802596dbd70d22a1e248788365a8326b49d2444138982530bde40ffcd45e06cd374c020083ed85cc3d555

Download Submit