hxxps://dsucustomers[.]docusign[.]com/path/get-started-with-docusign-esignature-essentials

Analysis

max time kernel
51s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dsucustomers.docusign.com/path/get-started-with-docusign-esignature-essentials

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3080 msedge.exe
3080 msedge.exe
2776 msedge.exe
2776 msedge.exe
5404 identity_helper.exe
5404 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
2776 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4324 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4324 AUDIODG.EXE

pid	process
3080	msedge.exe
3080	msedge.exe
2776	msedge.exe
2776	msedge.exe
5404	identity_helper.exe
5404	identity_helper.exe

description	pid	process
Token: 33	4324	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4324	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2776 wrote to memory of 3824	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3824	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3264	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3080	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 3080	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1152	2776	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dsucustomers.docusign.com/path/get-started-with-docusign-esignature-essentials
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd170e46f8,0x7ffd170e4708,0x7ffd170e4718
2⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4892 /prefetch:8
2⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
2⤵
PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
2⤵
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
2⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12052637854594669454,8391732862070415383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
2⤵
PID:6028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c4 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize
230B

MD5
cb727922148d681c62a9e373b7b6b199

SHA1
50a3e6ae40601ea151ceb878ec5072541d20ecf3

SHA256
931c9f9cd61b978f0eb71bdaedab6a7efee10faf908b353056c637ccf2f9a86e

SHA512
1bd2d11cab1aefe3fc11d272861c262e36c87199a0f11d7ac0137ecc11112586f9e888a8fc7801d8aaf6b48648af09ed6bdd5620a826d9acfaf87233cf2135ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ef2ab50a3d368243b8203ac219278a5d

SHA1
2d154d63c4371354ff607656a4d94bc3734658a9

SHA256
2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

SHA512
4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
696B

MD5
2f12eb0f4dafba125bff29afaba7831b

SHA1
bb53db10ba91a96b014546ea80b3f67e0e88cfbb

SHA256
9fe609230a88c5848453dd49be7c040d1e450d8a47a7bcf1b193266806e74215

SHA512
4d8d250865ed22139a227fa65f8aea803bca8e0cd822895bcf64294a38789a3680191f5e801a40255c7e8c5abdb37a19e24ae61c953f16e242b111ce0280ee5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
30abbfd3925102f911a24f5a8fe152ae

SHA1
086daae18ae9a3e65435ac0e65ae5f15d81fa234

SHA256
cdceaa77a18f91316301fcb01c7ef801690858d3da13a5a9be7789da68f777c8

SHA512
ce317ef7ab4197269e2e22d6ef4a5d2edf4102c28b314e9551773e3dc267806e4710114056b93cf675b7e1018dbf2c5df37e3eea3bdf86a14c104342bdf4cbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ed73e49b7cb404373fdf0c20b96cefed

SHA1
0efd5ff9ea949914841b60ef3f0321f4b5edfd11

SHA256
9682e516aac6fe1625a09887ce7aa63ef851d052b0da667e059d4aa4e1aa7b49

SHA512
57f6c390a8631b719f9cd0ea179ad4d1c5b2f4acf70a4ee12e151c2cc1eee57539b13907b0fc8500a8f09742ff78b5f7890daf9f63971266ac776103901e2047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
74f1510152359f0a84e48f3a21f6738c

SHA1
0636fbd08466ec79755ec300c341d42eed18c28a

SHA256
799387ba4f9c75ffc35d290d028833e423e490cba739e49056977c1d9bc50977

SHA512
3a3e7287deb22f2919766fedb716b395329c9b5f56d277d1e589106d280b69baa462e7cebed8d97bea332915b79f2dc72d5743d5e49535d8a4ee3252e74cca3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
be02f4e1c8c4abeecc46d885796e90b5

SHA1
b4ceb72e7bd55e35fa1cffdca98d950203c0f8b7

SHA256
37e42fd94a26f3c6342fc1ded71901f7b2321939ce22fdccc632e96481f90663

SHA512
5d0e3bbc2c06aa961b0de68451f398d1051010076268a8eeef87082c8aa4989953299b52e38d2ad2f41b9bd211036678db678eef4ade02e8b4725c7addde5bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
bf38e67347aea6d520cda5fde321a1e5

SHA1
0e7a8def4c923201d76b41dfa9918bb1052827ea

SHA256
0f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025

SHA512
f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
edf60fa40b74b29106929a0eecf894b8

SHA1
0fd679e3a616c0c94adbaa5b858790c0b20fc885

SHA256
fb1eee58128ca5afeb5695acc9cc90cc0e03c40e4c91618b4f766aec2a737687

SHA512
9d0fcbf261777e381a8c6c711d29309655467403f6a28240a67e91ab4c3ed3d4d9eee1d3ff2c0eec1fca1b5971738c71626f403e4a388cdf07993a123de64a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d031.TMP
Filesize
1KB

MD5
1dfc8bfb1291e8165e3924fc032d3928

SHA1
f6507b6697a383839b840e6b5a04eddaa1d5996a

SHA256
5c2d570d32e91af626af4db2b9bc1fed907a72d83ac623c786f6aa35439b7fde

SHA512
288d372540abdcaeedee7c4523349b8ee04c9290ff131ef389787f16862f059ded6436a4771c9240b147e0664a0eaae8665e1acc53818f74c53137100419ee28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ff81722adf9e7e0bc0e0f7233af0b5ac

SHA1
c2f8ed80fc6c8a49b5560ddc29d6877a3c1d2c9a

SHA256
cafc9488ce98cd331f08e02cbe7a5cac9c7bb6fedf321c2417cf41d13603017c

SHA512
0ccac2255eabebc6ad11a49593233c3a3e4185cab0486730dd3fa95399edd9b24e51f15c9ec0e725a3d6b2cfd4270df5414be739b7b0c8ac4844bd1818cb91b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5706a7235a8eec918d71a3c7414e3542

SHA1
e3038b95318f110f47b6a3321221b201e0119eec

SHA256
6a9843091260753940db53e611d74fc6dc1a1b768af76b1e10d31f2c2f1f3b5b

SHA512
d00da0a24f4e13051a26a82a591acdf59b0f9b28d5a3308fe8f9467882d5bb4efe3fed5c41ea0c21b91637499d28dc6ab683edf86a82d35f95eb546b0bfed6dc

Download Submit
\??\pipe\LOCAL\crashpad_2776_UUGUOUXKLVEGABHA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit