hxxp://docussignsnow[.]info

Resubmissions

22/11/2023, 03:10

231122-dn2hgahh44 1

22/11/2023, 03:05

231122-dlalzahg99 7

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://docussignsnow.info

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
1904	msedge.exe
1904	msedge.exe
1860	identity_helper.exe
1860	identity_helper.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3820	532	msedge.exe	36
PID 532 wrote to memory of 3820	532	msedge.exe	36
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 3844	532	msedge.exe	91
PID 532 wrote to memory of 1904	532	msedge.exe	90
PID 532 wrote to memory of 1904	532	msedge.exe	90
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89
PID 532 wrote to memory of 1036	532	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://docussignsnow.info
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff918ed46f8,0x7ff918ed4708,0x7ff918ed4718
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2987054581606118134,15094170992524518901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
47693b1257f95f83407c384b2340b8f5

SHA1
aecaea99357cdc10d5c18a84767a5b37906d9e44

SHA256
727e0ed3fad393254881d6b59cfc2d1cacbe9ffd699fd31bfc266d41318a756d

SHA512
dbaf977f1a619d300b8bbf8f8326ffcb5d19f8f63ad5cf0fe8009f906f967379ae3cea06c3c996f5d17e62ae3694054d4308ceeb8ce3f3785c484433fa42bbd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
208eea36c07c578c05ae7fd63aecd806

SHA1
0f713ca1cc7255eb742abb84e466070ed7ce192f

SHA256
29aa22587bca70f5aefb3a124b881d8873252b0b35c7196497d9e71699646da8

SHA512
802feeca7d21fa54a0bba2568650cfefcd554a8a80e6d5a6f5f2b0c96cdce0a142e42dfc5f8d6101cfc52a01f9fe12512c9f60bbaffd0ca0585b33645fc8c0ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93d31597d2261915aadf8b656be99e63

SHA1
3d8430c88b19a74a88a01a8d032ed8b38aa75017

SHA256
0a7299234b4364fcc80aebea686c3384d3b6c36b08cc87b1011ae4d864e95775

SHA512
0806adfd9c8d52461e794ea082cc5743db96c5b6e9ca674c831ebcee253d5e877e47d49a95b5503ee574032076ebbab1f59b317c2e6cdd14bb363cb8baee7b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4d600031d197a5bc9995a516001386b

SHA1
6ccebf9f35fcaec507bd74048f4f9e3d12d3625b

SHA256
e1e7630b165600a84fcd7b9369c11c60ce46f5089b253d2644260181e27e889f

SHA512
66dd16384650a3b34d18cddf0fb2445e9b5e0ef61ce32863a8690dfc2d7f09cb2be3140253c958c7a31d46b0b48c84b8ce6f52a3a1f481cc21cafccd21184504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf1364bc59e2c57c989df4032ae0abb9

SHA1
807a5576116c44f76810d231dbbb759daaae84a2

SHA256
7127f7e3b7e47a044e4660d2f4dd2d28cbe23f7913fe71eb2a564e41bcbe9a13

SHA512
5bff857848f9aed8b0afbea36cdae1c70e01e8eefa7c8aac314169b3ed85c0ead1984ea13da7bd5f61f950f8ebe3e04de8a3182ccc2b2a0fc6288a6c2534b46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a145ba890e4782d4321a25c7a20b1d61

SHA1
18af758523fcdf42902b77cecdd323afd269fd23

SHA256
fce0b4398b66470b01027e5e9e80a16e098f6d456ecc8723544a5070973ab6ab

SHA512
687f56f1d1ea25d11c4508b35082db676cf3b4f2bfa3c916ff90dfa03be28c5b4470818aa73af707f2c5d04903ccfd1005e10e7583b4bd9612a16d6ab7aeb2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b7f247f0f671d21d6907eb4165bbe55

SHA1
9d28f38ed9abd18adc09b1f91918628b02cfeefa

SHA256
ab98483d86da6b674c0c417478dc3445a5ab43e64b4053d70d066737e29c3785

SHA512
4e2412eeea2d9a0ea9b4a51cf264f6b1b1458712af2e2da0b1f2260cb73b3e5fd8a014f6fb050cb3fec326d9f1ababa53a21e68750757381a329986aec6e730d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d10680718abfb4861f980b4f9d0e2f56

SHA1
d82d4ec0af3244f3a3e92e20654c2f9576b960a8

SHA256
e18615a00d1893424c2666ce017e1405943cdf58eb06124287e7440b82e9bbdd

SHA512
208f3071a2045706cfd52a28ba2fded3b64fe5992abe95a7d1f6cd94b13e17651fb978dac6f27a6b5003c6d6af903f0f044e8ea9492171a74303651e392d3662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a3b15747df903942afbd279931d2344f

SHA1
b46170ab9e5a537160d1c3582f25f22bbe0cca38

SHA256
da3bb2105016cdc036540aa49f127e5be8fc3005ad074fe17d9cc32c6f2a6c5e

SHA512
5f75889e1cb125f00c5d409408cd0e8d3e114ac1b4ab0026d59a96d69137b042f6f80e5aa183fa4b6481729e693e642075ff2f70d6e2d3df7bfcd25356e8af76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
365d1c6ae2448e9a848397aea594b9d0

SHA1
1027937d58ee3ff9010e6e57120824a67fa38596

SHA256
1b7cfa3ea10e280a96c95bede0b5eb133097a076777d3728176a9ec69f4dbf06

SHA512
e6ac18c06b45755333fce476dcba12bc913367f073cd86440907e3bf86e6ae19a9dcfb5166b18bfa60f86139733660693ff2ecadd5ab40d10223fbf0d68c9799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c152.TMP

Filesize
202B

MD5
1226d0f845dac29a2c755c1e3c84fd78

SHA1
c31ceea1f35646d5a98e898be27dfa7c936453f5

SHA256
9a7aba2791ab21af43413c819d751abd4bec9a87d4c5c8a36ab68e5013d093c9

SHA512
983fd903aaa8e12559d356ba0ee4e5521de32d4b3fbc54b859b6c516b100ce98b6052f1f38616a198b937ac88932c79c9ef3623e914bd035381e43d58515b439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7892cf2a90db785348e4e64809c41a12

SHA1
05f95a1476454cf09187ee785c91722d5db6206c

SHA256
eb57087191a26ea1c12206f7b48bc9e93c9bc99b5a0b63a80228783484923199

SHA512
124f5ea8ee7d47a58c413d65cca26988cd343b525b333b7303e9931f920d04ebab861df9b2d236ed3fb12e949e6572802fe135c864ac0da463762a4941ed2827

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit