hxxp://oauth[.]docusign-docs[.]net

Analysis

max time kernel
66s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://oauth.docusign-docs.net

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4564	msedge.exe
4564	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3736	4564	msedge.exe	81
PID 4564 wrote to memory of 3736	4564	msedge.exe	81
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 2648	4564	msedge.exe	83
PID 4564 wrote to memory of 4992	4564	msedge.exe	82
PID 4564 wrote to memory of 4992	4564	msedge.exe	82
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84
PID 4564 wrote to memory of 4028	4564	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://oauth.docusign-docs.net
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a4b246f8,0x7ff8a4b24708,0x7ff8a4b24718
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5410823317167832315,6884140575478311572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3423d7e71b832850019e032730997f69

SHA1
bbc91ba3960fb8f7f2d5a190e6585010675d9061

SHA256
53770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649

SHA512
03d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
99cf53a0fe78f916bf6b68fdc22c9d6c

SHA1
625813fe8132d17a99a99430c2cb65b89e4474c3

SHA256
2e6f6864626009aeb9ea8ccda1b4c92f1b0b5d372d033416e7af932f3985b833

SHA512
1f25c0c20a9dd3651fffc6c796814b1c3d9ffda378dcb2e795928877be1cf7d1427ab8456d11db0c50283652d1641ccf2e1fd3e85d2b678210de99ab17dcbe1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old

Filesize
349B

MD5
f6af3179da1021b8defc8093e6f558b1

SHA1
e823e8b10a27db8245199eb0e5fae53e0785e67f

SHA256
16cb87abc31578807b2138cb38c00a3a252483c38f87c53759e6494e88153086

SHA512
77b03fe57ac843fc60323c8cf45101ab644bf0104cfd0399231a5b68fcef1168e730b1118e6645ab47cff2e84954dc4789d81898a6e02d60268cb2adffd5d594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a85ff0c84823522ea9760a447fbbbe3c

SHA1
f7e002c284b14937a4f3840011e04d3a3a1f2c23

SHA256
a70e76ad0727be82d304e0082a00ffffa2a1321f69c1e86430c7497967bafb55

SHA512
e418e62e025b7cb2f360df67c645dc38b218bb47f53b447b4ccb6332d8c2f4b20e6ab4ec99a122f0c0c6ec831a2361fca1c77dc35c6b48018ef2ac08b1dcd22d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1de0769cd0dca1f7186150806e740d5

SHA1
b588f49e9f4f1bd06654aa47a056aa1e1be38cf1

SHA256
7fa53d1f179d87f24fd7cce0bb57eb267f83188749510256c2dd2fd63af4b79e

SHA512
f782d4fc36863db757bd07c3d57fc0a05f13b2a8ad865f95ee8ed9315f912f6a54088929127ab523586f89b60e766532af39483c335be97e59ed2e00e6bf2b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e78f9a3ece93ae9434c64ea2bff51dc

SHA1
a0e4c75fe32417fe2df705987df5817326e1b3b9

SHA256
5c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68

SHA512
9d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
ce0922c258f785fe0f6ab6141e8ac63c

SHA1
09b16471adbd59a0c9d3ad0af077c86faf44d253

SHA256
16c816dc4c549afd92caabe81a36ad476b595fbc52b70bdae2c106c0457eb050

SHA512
1040bee1f5a7693ae6e43896554f40f0ff04944600f6b42394aa413761c602c051cf1bf5c69f3369c681fa3dcf424e986b05d39daa0678399f09a3081a02bb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d2c1.TMP

Filesize
48B

MD5
c87e07bf997847e68b1e334b303f3ae8

SHA1
ea14ce587bf4d413846299b789ad143a7fd43f06

SHA256
d482fd5670ea6c0fd8a17cf5e696fb96a3fcc5271a147f86d30800f3ccebafa5

SHA512
42888f6608893310bf6e9ecfb9bd423b349f0101e45099ad3b17ad91d6509ab86ccd3e641457fd74eac617425fa42455c983ca3b0fcdb2b5df472a89392160ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1114c45bc25d59329006e26b1576f4b

SHA1
1519d833153f1b0e5b785c7437d9a0c887cb6fd1

SHA256
9476779cbb8ac842ecdaad8f7a9bb6b52b8d75fb2659c61d7a747f067d3566fc

SHA512
124583ef919eb23c0e09592cd989c640b1dea89860023d19a117cd027074a3dea044407d9ef1d7b794f254ed15e73072cf0681ec8df655a05d2c2d89d3e09639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
88ba1b4682cd7769da57f05e634560f8

SHA1
1aad65e9bb5ec5ef258986125e4ceff6c9c3dd25

SHA256
459207d938c37de2a3d5bc708946546396489c623119a0dc81afdee46586d5e9

SHA512
67c2e016bf446be82690ae769f1962aa0b34859ac097d166dc89642e53a2ca27608e095ced6812b278e22596060db034c2ec4a216c8f366873b5ab057052c7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc0c.TMP

Filesize
1KB

MD5
2d9443f1ae171c0a5b378336bb6b11d5

SHA1
72cc582eecd6dcc627e466bbaeec51528fc997cc

SHA256
c9431b4235d8353ce7a5a0d9ce50551e14d8998bf2229a74a736bc5c1c2024a9

SHA512
3b90e20417b6cd003d851bd429db146d9e4ff6ffe2440c0ddb52258c00d6cc78cc38d725c9bbbe0393955b3cd4a72cb11509e9551151610493eb9b04d7142d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
19581c0059b9e62033e27eeb15251861

SHA1
02414a43fb22bffdb3a5f2fe9a32a391fde04d06

SHA256
a48e19a10ce43a1bb74d6f467f7b669c370780a2d9d974b1045bbb6425355421

SHA512
1e6e064ba980ca64ee1beed226d0dc1dd1d2351a7d9c40f8c48e5b969c7340adc090ee0d9948bcd439687fe36cbfeb95b5b3aa1b29879a4a2c02af028efcd413

Download Submit