hxxps://www[.]complianceiq[.]com/trainings/livewebinar/8045/project-management---tracking-actual-project-progress-in-ms-project

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.complianceiq.com/trainings/livewebinar/8045/project-management---tracking-actual-project-progress-in-ms-project

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
4724	msedge.exe
4724	msedge.exe
3436	identity_helper.exe
3436	identity_helper.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5988	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3828	4724	msedge.exe	88
PID 4724 wrote to memory of 3828	4724	msedge.exe	88
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3456	4724	msedge.exe	90
PID 4724 wrote to memory of 3336	4724	msedge.exe	91
PID 4724 wrote to memory of 3336	4724	msedge.exe	91
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92
PID 4724 wrote to memory of 1196	4724	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.complianceiq.com/trainings/livewebinar/8045/project-management---tracking-actual-project-progress-in-ms-project
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffef88f46f8,0x7ffef88f4708,0x7ffef88f4718
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,6682725825044898751,2389474627489255166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
cafa145c0e1739bb68c9794b01db2749

SHA1
99ab89f20c7a699bb550ce1411567615a3550365

SHA256
b06c7cfe399639d44b40f65e9bfef2d22b196bc857d9063e7813aafe9b6c4222

SHA512
28d6e70557796582ddac04ed317aa2da89291b9ccf6dc3efc190784bff7b5be86fddf1733ac3e24238ab224191546401bc42c7511202e9b9bd90e1f9b086fae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bee30f3963ebcdcf6d41b95e2bbbd395

SHA1
5cadccda446d23b3ee98f9c3cc702da47bbba94e

SHA256
2ea24e45feb0bcd8cc8ebf23bdce9d29ee33ef09ceac85c167d2b90abeb2be2a

SHA512
b398dbe9cf26dbe353c405d0a10d86786769d5e5f1e3579784a80b94f6d7939fa64e51a04cbdd64077d3ac39aed881c3182c8a81337d891238866d377f2c717a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37ba19b1230b05a056c12bcb04f8a8dc

SHA1
787ce8d676797f3ce0bc0a87be54aa183406850c

SHA256
353d2ced140ee76042e11d9a2d2cc4d58d7d1b29e0329f49a8161196119a7fad

SHA512
1c3e0eac22c614a96d5f7ac93b3f8582ad46fad6ea9d84c66abe13a8d452805013922536d1808790103d7212ee1bc0629edc68c0362fdf1b7d39e4a10386324c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a202dd3842a2d5178c681bfaae9fd5de

SHA1
557d0b4371ecf2a182afaedbd201f3072a19129c

SHA256
76d65342f4737c999d82a554fbd040c0ec791aa224a0890f97d85cbfbaeb4960

SHA512
89bd24bccceeacf27360dd2a9767432b044bb642fb6a6287fc45e6bace215f55c76bf6c3cfcf25da3aa0915f592d711a9d7f5246ff0dcd60cb38e4db99e40bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4e69b2c83c3c6dcc879fd52d2c28668e

SHA1
e164ce0f5ae7dec01407e5638dfcbb81a8d1da33

SHA256
28cba221132b275b54ac48c9e7913253dfe2796bc5508987ead6fcd5198b1336

SHA512
9006d85d373d45bddc3ca7980b20559cedf10c4e4b858b4d3715eff37aef566ccf2d473a8d1a2ebb041351377ea8b9c168b0b5879a69451093fe563743b730db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f232591b776a6c98ed1d2ee5a248090

SHA1
3975c174bb0aa216fedc3902093f3009ce463331

SHA256
23e2b426d01882e768079dee3246750aa9ba0c4995b219fe194e5c3f02f7dadf

SHA512
78352daef33c621de9dcb92d743889eb284ffef15d6c3c2b86f4ebe63f1f4ca136c377d01e227dd58646c364378348d6caab98a762c3ea3750b378b618b7d338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d2c8ef5a42a8ba8ee55fcee332fd9f7

SHA1
852e161a0cfd16d8b8518192fefda02d1004b22e

SHA256
ac77a486952eb3d398c416773945cb701c0e3eab33afd806b9ae490fb553bb3f

SHA512
ddcb60b5a57a8ceb1e37c1504da2911c017c9deb92512c848549d19f98e4b63966843ad1f36c2f4b7b0a23b4344ea3a12997b57106d7324216b5085ef5c77055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e14.TMP

Filesize
1KB

MD5
853aca11e6fbe1cb7b794b41d1b7f2c5

SHA1
5f221e900528e5715d59cf3c3b5abb4bf55cb1a3

SHA256
4ed0d7acb4a63942c024fe337251967cbc0bb2e784e6a48b0e67dd9b7508a900

SHA512
6a47f864ecd9415d73f81074a27fdc6dea4b48e6388af6f5030df11f362eeb76f336cb7efa33d3329267bf5624ba1580754f9f9e64c3688c29ac18815b21d066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c66da5ed2d60dc764bd9a1c23ddd1374

SHA1
7d7b47fc8f38973a739ab2e4aa24389e32eeed19

SHA256
851f8bbb49cdcd5bf8c964e44667ddf459db4549e2552a3831c18f260164b15d

SHA512
92df8da5f7375f345c4824e20f58bedea9535b325e2b6697dd75c9d47bb2bfe2388088f138d5f54ab2ab50a1f69d11517f19220c1b0b83808ab6083c3d84194f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37f3a62c379ce26c815f57de026ee08b

SHA1
a528ae46b4b1d083d4adcb0c40c340a4d83a9b6f

SHA256
692e4847d43b9ba4f8d37c9f9e269652eecb94184c075114315fb2adb9d47d83

SHA512
cc0c887b432f1b894ede8e6a43da05830381dc54ffec122775b1bb341f15273c4cd5e064c67c024fca177669ed1198f509219925f844be8ae1257958021df2ad

Download Submit