hxxps://docsend[.]com/view/a98i63hbrr974gwt

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docsend.com/view/a98i63hbrr974gwt

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3192	msedge.exe
3192	msedge.exe
4252	identity_helper.exe
4252	identity_helper.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4120	3192	msedge.exe	80
PID 3192 wrote to memory of 4120	3192	msedge.exe	80
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 2388	3192	msedge.exe	82
PID 3192 wrote to memory of 3100	3192	msedge.exe	81
PID 3192 wrote to memory of 3100	3192	msedge.exe	81
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83
PID 3192 wrote to memory of 4784	3192	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docsend.com/view/a98i63hbrr974gwt
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe381646f8,0x7ffe38164708,0x7ffe38164718
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,12248835480868185521,11604424586714104717,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
de47b9ab193700bcdf794850a63ef8ca

SHA1
cb3f61399cc9c5c76b9e9b85e09092256735663f

SHA256
e6e41ce0e387530e016e39ebcff71a4c92b619dd0b512b84d8b5199a8b1bb5ad

SHA512
683b08c1eae6b92d3118227eff7bde08772f128a7524254937765b8262815212f30bf8220c7662c8a517e422ec89c4018cd87eb0c0406db21f023f6079d64c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8daa7e2373d83782b56b70913d7f0df4

SHA1
5056e1977238783218938b66c31ceffb5af09c2d

SHA256
3429a24dbf4cf66b3d3cc5e87dfb7892a32b4b8b8a8243d881c2972fd80a88bb

SHA512
978c51e09769daedb85d770bfdff9da6fba6a58fd1819970b02dd77fbb86ac0f5c3d378188e2e2417356b3bc8fce8f9448a3f8200d2768dc88148913b4efff51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc94b1a0e1842147f793f7cc781cd28f

SHA1
d249f05aa7aebb4c4ba2dbc2edfc30e8b698d23e

SHA256
8e9bc8d2083bb530a799e591da2c62e1b5395299ffea77343d1634cf83bf7ab7

SHA512
3c420d69073272f210bddb3e0b4a2d3aea2ab38d15494f2a274d07a4521200ee372c795583304ed91b89f80d8254b3adc02b71928efb5a4268277f1bd4970a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78d67cb9ce18cac0c6c308eccf672316

SHA1
ef51f32049ffc320c134975b4f527df1d7972319

SHA256
61185ca4b2c53e486d464f03295efb694333d16a68911ffab729104356760a96

SHA512
538d30393e4fb763707328da70b15dd7457dda4cd231c4266521fcc59009bb8dede221eaa1e6dcd585df9fbf8b62cc43a97a8fa80b4ef05226bfe06395d22d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cda164baccc24b8b54934c9decd73180

SHA1
502717ae0c27c8aa4e9438717b1be48b92270373

SHA256
b44d07e82ded3b7682b90fe3e449603c6e03b391d43a7640189b634308657fe3

SHA512
305168614a72edd18623b833c2632f307caf3f2c93aa504e0f78a2c3fa9f0b85f914765aa6e1e78c4e815e9e26f1e93766b62e4a4fc0b576004b5eaa2dc31a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
752ed49361937979d56867f4c68d8f67

SHA1
a0e28e89db2a2b4880a8ae1eb45b212fb5b21cfa

SHA256
282ad815c2ea477b601d59171fe6f8d7d1950eb3c7ef39c487bf172f7b9c9f4a

SHA512
7602e3246dd790e32ca6eea41c9c4f65803903ae13dffecc849e1ddb02f1cac90ac3b45f55afcbfc6729ed4c4a8ede49e4511900a838dc5a501dbc964bfff870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
115cf2ef79d1b1bc2b69248f9a9e404b

SHA1
c448a107772f12cd4fe4ae329f79550391358fe3

SHA256
16aed4c8707bcabd87a1ebc17c0551b4600dd0d21704f0f36d024305c4808df9

SHA512
d241272e78c8057a45fcbe13a8f08597627778638b79a220a21aa265889deb5bb0ddfeb8e2855470fca8677b81ad77f69047960458c7819146e961e98bc0e325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f1032eae19dbee26a562f5b14072809d

SHA1
f1953879266fd4e18a7b2fdd7565aef3e3252c97

SHA256
6591c662ad2525b122ea918f32d1a8c253de03267f59d0c1c71b19d518460e91

SHA512
953c81a2519a63c74419f1f46e3fc7328b6ec68ae692a03c9ece9275de6021c30e805d337f6ec3c414d07fe5c184962918e3c9e28dfe7ad90bf7e863d20dd011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
76b67e182ed0d0130844539033c7d415

SHA1
c8841e78416a664553c4a913ee26bf0cfd0316f8

SHA256
306e29418a938dbd33a88b81d451a94fb412a1913561f3d5953dcf112a681a3a

SHA512
f511d3cf60f0d4c933f34beca99d65b27f75833d932091816aa5937ad275abc3aa31de11adfae52d7076e3cd1cfde7ddb9d48172798e8c01362540533e1f042b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed27e0619da4d2aa21469e6cc59bc19e

SHA1
afdc10a7f3ad24355214e61c3e16b7952369c019

SHA256
1214825ed88c640d32a566a07cb3f0187262151b8ca0763ca8d2c2b7543da6ec

SHA512
eaa5030224296562b8132f80d2e90898b45be63c2802ef8bb7e977613b436f90b8f4467786925db3733280c385ceea927b31cb10bc7e07f179a419ad0f0b6ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810e3.TMP

Filesize
1KB

MD5
b232d00937f9b74092ff387d26152ee1

SHA1
70c9b0ffa54b2a3784c5a83e58f636b111ba185d

SHA256
f7755af1ec30463c46cbe2c4f8a1a0cb68f0d77baa7628c1cbd9875aa756288c

SHA512
8a661fe660f739cef0f766c8ef7feb1a7183965d8049ff5d4e2070c62df246d10e4cc9a24c46ba868fed674f14a09c5b80c1c2153363d863190b9a23a928c828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
59523bb1cc39bdce907f038a3f0bf519

SHA1
63a18b2a4ac3c50f80f34476804ee198a8340ba6

SHA256
b533f80ae755a5bd7a38d49140008b36058deb64fcc7e206655276f316c1e7b4

SHA512
a0890ef8823bd0889ad26685ebfc6f660b471d7f6626e69914b99be3afdeb56a8c1196618970dc5582ceba8ce34241b8471724f7974217bd4d0516b60087d54e

Download Submit