hxxps://homework[.]study[.]com/explanation/two-particles-are-fixed-on-an-x-axis-particle-1-of-charge-40-micro-c-is-located-at-x-2-0-cm-particle-2-of-charge-q-is-located-at-x-3-0-cm-particle-3-of-charge-magnitude-20-micro-c-is-released[.]html

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://homework.study.com/explanation/two-particles-are-fixed-on-an-x-axis-particle-1-of-charge-40-micro-c-is-located-at-x-2-0-cm-particle-2-of-charge-q-is-located-at-x-3-0-cm-particle-3-of-charge-magnitude-20-micro-c-is-released.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
404	msedge.exe
404	msedge.exe
4828	identity_helper.exe
4828	identity_helper.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3692	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5084	404	msedge.exe	85
PID 404 wrote to memory of 5084	404	msedge.exe	85
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4676	404	msedge.exe	86
PID 404 wrote to memory of 4708	404	msedge.exe	87
PID 404 wrote to memory of 4708	404	msedge.exe	87
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88
PID 404 wrote to memory of 2612	404	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://homework.study.com/explanation/two-particles-are-fixed-on-an-x-axis-particle-1-of-charge-40-micro-c-is-located-at-x-2-0-cm-particle-2-of-charge-q-is-located-at-x-3-0-cm-particle-3-of-charge-magnitude-20-micro-c-is-released.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac73846f8,0x7ffac7384708,0x7ffac7384718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17941951826571464753,18373516547587583635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x384
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
549ecbe96c6a222191212f07bab86e05

SHA1
25a4d47014237b5245c6e2adcd76f18fb11551e0

SHA256
a9f6303e0dcd7f71091cc1668e8c5ccb7ea976ad59e5d512d1ce8dbdef0d3411

SHA512
a1151bfabc6e1058a5b743fbbf2b10b95a5163b518dfd12aab1ff64467804ad4d2d45413d78c298ac1fcec75cfe5969c984b6c90e0944a533267b692e125ccf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cc831b594618f1373a05e1e2aa4bef8d

SHA1
35c929926dd235a2579f2e1c583d6761b254f8be

SHA256
9fbb46c0d01039a6e9dfe80618d84e5848b80e43b26ac87096a727426e61fb2b

SHA512
a59463c1b4630835bd4b9959ca8f3acfd8155431a5f67b0a36ba2718e8bb83d4c370cc11a95d0bcec744ece9b6df4e47f36af6633aab7da6e7bb6ca2550b79d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93d682a97d85660b3332e843ac8625f9

SHA1
5ba01297a777904dbf9b2bee2a080a37925d6a9a

SHA256
1a9f9cf7bf7ce7f0b5cf38867ef889a30201922ba10f9d8f420e914a6e9e21f2

SHA512
1e82b67b2eb1e893550fde8e86564b1ccd62d0fd2bb0259fc3bdee3bc9ea65fa2c66f8cea02f7f3e92d9512178350044162b601a44335bac979505e13cd5f045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e7aedc14c31f2511ff75f4781604d87

SHA1
c00f8c86a98312b62f2bc0ca7494c5ff8b63739c

SHA256
a2600e1f8baed3ad3b7e43d2e41b8f92669e86ed3affa194d6e998377edb1d78

SHA512
387c4e0f993ff95b9d0e6abee7cae5961b01dea279d2757d5f29e979b72481be49c834312201d2d2f5bb6c5d386a79cc8dfd6e32bd5f4a3c3e3788d4b0c57945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68238428175118a687fb4adfa9524d59

SHA1
e1400865b9c158765ecb917d56613d2d59c3b1c5

SHA256
e5a552e9c9303695131aa219b4d0088b8c62c00e834faf32d22192d23389920c

SHA512
5276f9b7fe53bec683160145ab6ebbe2176f6539b4889e8b60370e858a09afda751da1db1bdade6aee66bf847ab9d847c1d5660ed7d4381553498736552fbc8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1694f128280bf3405c4d7a70f58e4960

SHA1
8383e9c1e3ddf4aee6cdf361079d7dc0fc3b9e99

SHA256
205fde645af58e475eef33d8dc06f1255c5dc23cc62d54c97358436a3567a091

SHA512
d97e534e7088236cf1b47db1ae17fcba8c70368dfd5361b1ea3a1f4ff823a7434bd2758db18a47fa77cbd9afe34837ecd2acec83fa5b68cfef016ea30c79a8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a3f3f658f285614d9d949a134d1d772d

SHA1
a9d7f49fb8914fc084af3e7e3d00e25bf4ec74bd

SHA256
ec34452a174984378cc0f5b01d994a84e6c8405353f32f0912aff8377c6df366

SHA512
9b67587bfafac0d67b76d61db062378de8bf19927e44ce6a141e5ed29ec29093765a041c4c28cb48af71de18c99ef23a068483ebb7c685fc15f86df296d92011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ea689708f798b558cd5b55da247d503

SHA1
2ed12e27164c8e1ca8869e9a20a5f3e0f243e1bb

SHA256
a2ab9b2993111ee0a4146fea9a2834e36ba0bde135aa2a394ef812dee45e110a

SHA512
4f2caa789517b34d97e5f087aa6cd1a62548c2b108569662bd0f9571ca12b9ca2080661e993e80b4dcd3e5f1b02cb8386bd26e5fe570fc5640e296981035923c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
17404737a2ed25f92538baeefe8ec0b1

SHA1
fb2ea30038f2011b06990b5b6662e2fcc14cc744

SHA256
cee920c7a45d468b460e8d5e6350c670195e2052b16292328c7f3ef015d57fa4

SHA512
56ac2dcb30ec5d3255fd40f6ad7c7d856472342f91fb878744cc6ca4ccbd81de9bafff0a6e824c25b00c18f8a162bf60579859f985f11c6c313a7ea27a038f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578741.TMP

Filesize
1KB

MD5
bf1c97e982c4bef41ef50f0c89f5912d

SHA1
9b9a70bae988591d0ce4ea6dc4ce737d1a23e03b

SHA256
35b8470252e415c63b850c09d0aed5dfdf4e1540650160a782008f58d638f9ba

SHA512
62aaff4535e31b5e086af2a908197c13487c41399e9ac160b380b761fea1fe5fd7feb27bfa18d3547d8016160cb4ffcca1560b1b73b60cb15cd3ca145b2b4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
191f5738e95171cba3b36a1c0078217c

SHA1
e8e9662dfbdc1890d471e6f15c65ce58b70dfcaf

SHA256
dc5590443e7db4f307270669d619d5fad93ab08faba82b3c701a2bd3d27248d2

SHA512
c8570bbb8b0fd80f10ff8e6d58562e289e580ab0b8a8c625d975ed391820f9086020a0240c3e831e0d085787075fb2422f2e942b5ab6f4a6c3010ec9c54c0465

Download Submit