hxxps://www[.]toastmasters[.]org/

Resubmissions

14/05/2024, 17:58

240514-wkllysgh5y 1

14/05/2024, 17:17

240514-vtx6nsgb49 1

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.toastmasters.org/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
4472	msedge.exe
4472	msedge.exe
2916	identity_helper.exe
2916	identity_helper.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4524	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4524	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3592	4472	msedge.exe	83
PID 4472 wrote to memory of 3592	4472	msedge.exe	83
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	84
PID 4472 wrote to memory of 856	4472	msedge.exe	85
PID 4472 wrote to memory of 856	4472	msedge.exe	85
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86
PID 4472 wrote to memory of 2028	4472	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.toastmasters.org/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2e0646f8,0x7ffb2e064708,0x7ffb2e064718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16932792374891699756,9706708095867000320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
06fcdd045072a2ed13c600c96c542f0e

SHA1
c08b670507abf4d36996cae70cef1cb2ea279654

SHA256
1a43ae1e550734cae48f8f4f383dd27c856fab5e29d3723a8fe6ec51c8ce93dc

SHA512
82b2222d9b5fd807f118ed535cf23ddd7fb197cdf273ae56db22229a6e04b7060993d0040c7f68c4eef4f3e2bceb6b02001151a94f97e39148eb4bcff569c430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fe0455f49a92722373be44c5b8ea1bb0

SHA1
106c8a1c8b271c37fe86d8bd1cdf5af8c0e8addd

SHA256
a697fe0dcac13d1c6e5e446e1eaa88ae4555da097d45497090bf9805533c5306

SHA512
7ec6d98895280d46062d3175b4e276a40f28cf17b09dadf63d241de8d89eb85a771aee95127ead011b8c2a7a914841510ef8d4f1b1b497639f39374adc2845e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66634aa73bd0d6d85928acd51b19f27a

SHA1
6399ef347263555e0ad5f21d84b0cfe475eedf17

SHA256
dd89e94a76ed1b5496b749034f00b9dddfe03ba58de1fc5b25b2a18e369b3ef8

SHA512
d4485c3a428f28b0d3833fa3993c8d720ab363772599fb3c35736bd58c0e0bad9b608e8c6a889f94d519193eb7bab4a027d414444e4999e1849ca0c658ff3044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
878781d894a01ee93db76561fa1cf051

SHA1
d880ed577b56c962b29c17f9f94cafb2b3d5ef4b

SHA256
9c532292c13eb35556d4f554629c157aa4707050768044eca7b6c8ec2c91e21f

SHA512
385e6fde35207ac4561a2ff557f785990c672dd35e47f4d8eaa93abeccd92d3b92ecdc91fab79ed369b612302092a8daa688b7486681525aa7f784eb994df023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
223f675bf6534f7001218b375ee55239

SHA1
736dae8e24886d25bd948251b7c7833bb945bf9c

SHA256
3cbc213c5f348f3cecc1dae1826be718fbd53f660a68c027dba7dbb92cfbba18

SHA512
4017f164ab63f8c7fb0d484d03e266caf0b09919a63063d1bb39d13bc52df20aee2b883a03c408741e68e7dbe6285500a9e4aa45ad06ed63ba925bc7aad5d081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1593b69b75c14b52e68908f4bf074a77

SHA1
57eb5743f193bf43b5c97b05fb77630e4663e2ac

SHA256
cdbafc46df4a5d0106c8536e5454cc33aba3478dc8fe5d4e4e1410a11953bed1

SHA512
dd42f1a571efc1558d82d3cd51ba1c5ef0c96d8e8c3f714688b85123920d31a981cd79d8de0cf444795ae07a522af5a98065ef5c9ffc27c5667a7c3bf05d81c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
15453f97d45db77e09c3849aad5a5a39

SHA1
1891893c438fb72260d1b6903022fdbd8b2e63c9

SHA256
297d6352a9c225201704dd8c37c2097bd407258e439afdc03eefece2ba9f21a8

SHA512
3e50ff70901bd34496b55fe4968b21b0bd28c57c247da1f9d1fab461e012854232c9b47abaea61b2bcbe383cb1940b6681fb520508f9ac109f51ed0d20fbade7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f87e4b010669038d414f6b7a7c6aae56

SHA1
a58f92c0cf259cdc1095d8e2fffc51f535dbb7ea

SHA256
322861c301e5c8f9db0b05aa438db5a2cf73f49b12f27e09d854e8727af14310

SHA512
246cb774de4a287f63722ab4c903fc678bb36ce0ae99dbf73f8ef65165b8f7cf3b427401df7ac016da4a51ba5b85f66ec9180278db63c6dbe50b00f9f657374a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57950c.TMP

Filesize
1KB

MD5
f9d732b2be07f5c826dee4b6104f99e8

SHA1
cde26e7f0dea02ab90cbb9b97f33aca3118e9330

SHA256
0e9d7322fea12c110916336e97f31d8db28f7ef8d5ff98f730a74253b58f7a1f

SHA512
059526e2a17d7d23d9f57737cd2f66e1ef5a6e5de6ed9f240c7d5ea632dfcf4ba2d682b89458e17dab0e7bb9df49baeb3e0c5aaf3ec50905ba63ef4d977f3c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87e24a9199f51b72a152cb7946aede86

SHA1
5ba57e7bd66dfea8cf606e10f371771af4387872

SHA256
73ba16d00b9281153e2ce08b046c379fe90e57f7894e0fea6c99d3b417c5ddd7

SHA512
09ee0a790c2cb855d3386419b4c5bd51c952dcb9e33b6541464f68b55e25ff877cce5e82ecd8d1f83eeb09b5a144f850effc4136cf6993170f3544299ad9674b

Download Submit