hxxps://padlet[.]com/

Analysis

max time kernel
72s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://padlet.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
2800	msedge.exe
2800	msedge.exe
4768	identity_helper.exe
4768	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2076	2800	msedge.exe	87
PID 2800 wrote to memory of 2076	2800	msedge.exe	87
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4812	2800	msedge.exe	90
PID 2800 wrote to memory of 4680	2800	msedge.exe	89
PID 2800 wrote to memory of 4680	2800	msedge.exe	89
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91
PID 2800 wrote to memory of 4800	2800	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://padlet.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff99e3146f8,0x7ff99e314708,0x7ff99e314718
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3254039885630661487,10760886000168875854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d48ea3fb992712387d23af369b856ffc

SHA1
8b89c92d3e4f323a0f3beca663e26157fc981577

SHA256
da3734ea3a5eb3a49a32c921474f796075aefa726c71ec5e4ac4e22d7a7b9f1e

SHA512
f0f5d54abc06be5cd6409493e753ceb4d53c8cddd121d379a2865e3ec3f7f930e926a84c99cd353bd9a1918647c9832daef0652d50c035a4cbba76fd3b3ca681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab07b3e60110e3ede17d1ae63392feb0

SHA1
1c03b1d5e7ec111538a178dd73af6180432cfb93

SHA256
60095b678dbdca30d871504d2a7b1ba51a459c72c54b034be0e7dfc3d3abcab3

SHA512
836b83ecbfb119b58a6ac5fe129e0cf4cd9e7261e99459b58ad4eb5b8c243772be6736303dc4fde92cc2c21204ae90016dfea19c6a95ce1c8b000d2d4bf512db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1076026a448cc28bc1c597f00deaec97

SHA1
b3d691bc979a573fbdbd6178544f64b2a02ba061

SHA256
72e00c7a881b3850fd9e0d12cd120cffa169ae54eb9cb59c316fa90056e72730

SHA512
1b834850e569c79c3801479eb6f84d5d645f4feda97aa73a0b6794d49a1faa1623808094d5333b02ff55e368b39e9ef8c69aea70b3dfad57c21351f74d02e5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19301eec6fc31f73f26658ced7db0924

SHA1
0fab8fddc47b9fbf753dea71f92e12eda6f7352b

SHA256
4a8144dcb7fca67b013128dcaea06655805eb87c0b4048de1f8ccc93843d27de

SHA512
b1f8e570bd157d5d00fe3c049b950ce3c07af854b33fe8470721613319bf5c3cdc2aa142893e24612fe4b6e693e482a93fb9fa5abd1dd3fae3069fec72d138dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7e252204d55bb0c328fd66f650916fde

SHA1
7d2e2503c58975d45c10e08a92b62628dc83cac4

SHA256
8683ba6f80196d40b4577828d1ce5ccbf6646b03f0e715df99ce263bb8c25525

SHA512
7d9079f3e811108d97c39ee020104547d2d5b9a56b988dc540223d01cac1896d334e101351aa10f0ac4cceb1461abab49011565aa4f4e77292dd4e7cc0477ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\11cf67ed8a99b1f7c507807344374751b409497d\efaff2a3-b6fe-4b47-9a4b-fb2d4d8528c7\index-dir\the-real-index

Filesize
144B

MD5
6797a4b4176a61b56c20b3800116d1c7

SHA1
11b343183772d32baf059430373a82f5d6ab95b9

SHA256
99549cc762b87c57866e1fc5090b2f27d1f6535eebccd9a2ff90180f92ba041f

SHA512
772037a07515b37be2f7d79eff6f205e20274d1e5658d0b250162777a98b11c09e002195e997749e6e73eb99d4136e2bd6d533989a8325e4f6df7bb43bee8052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\11cf67ed8a99b1f7c507807344374751b409497d\efaff2a3-b6fe-4b47-9a4b-fb2d4d8528c7\index-dir\the-real-index~RFe5873d3.TMP

Filesize
48B

MD5
1eaf16e5705cad86cfcfca8105888a2e

SHA1
db5543f9007d507cf86f9b2cb8d8a5fd0bb7eda4

SHA256
8012e11f9834125f5039f8e29670a30a54f9b7655ce9b862db06e52e9b3afb7f

SHA512
e397216ce895c7ce3e039bcf77f5486647f3c31457a9234f40c43d4978f721cb612cc03a9e3d897fa33929d1a2e4e379f43ccd4f83b5dee41e883ecac143ba35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\11cf67ed8a99b1f7c507807344374751b409497d\index.txt

Filesize
95B

MD5
5a2e7070bdb257366970fe42be82aa8a

SHA1
04febc699c322b86c157419c09fce42ae353ca64

SHA256
76c3af96e0f8ce39a200ab67519417a7f856679cc7f027ad7283d20e61f6aaa0

SHA512
12e8c3efb6690ca38b5d880cfde9af528b8ed88be1c5c57030862f50a1ad231e1532cce540cd0a96261539d3475fbb540bbdf324e8825639819ad1f595d5d209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\11cf67ed8a99b1f7c507807344374751b409497d\index.txt

Filesize
90B

MD5
0cf6a6db55a4e07077323d9f5aec02a8

SHA1
2e5144ce27944a395dd46121ea1e6851aee794c8

SHA256
1bfbd109c6a4ead1f748b863d4b7df6d910a0629d03cf723881a320e6d0aa375

SHA512
7a1053806f60580a0209ea0cb4e91f7302ac1f73e029bb9df402f3020a10fb25f44885f1ab86ca8952dd2f29b02f9b55c49212377837c287dc01f3f49e5f3a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
168B

MD5
16bd75c8c8d719b2ed86470a7f583b6a

SHA1
45c3fd64be5bb0e75f262dda968efbdf8072265e

SHA256
851bc3fb3a72871407f71a27ff246f026b5a3f4b7832c24bf2de06f24071789f

SHA512
88f50d2d731e854b4695b5fe14352b775e546c32219432cba87c52e1d103619698a6e95b62891e9443df5e0d31e6f20c2f860e97479984451a762d40e8262dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58313c.TMP

Filesize
48B

MD5
37a44a0382d7ff8e4a2224b1ecfe4f06

SHA1
94611d80ef933fc7996cd92787d135860868eaf1

SHA256
8c76927fb2977866e2e1ed372b08ec983ba54f23d6e0d3a8c4fce5b1f1846cdb

SHA512
3312d76499bf63c177c9ef3d7c98a72bba13f7987caa1751de1a316f68c870a444167a96372a28cf4204f8ee5fccf52d3a1dc53e44567d4cf0ed9363f27bed86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
b1d27bafaa4e1fef3538f19c5121b24b

SHA1
b9e8e600c7a7577774d1280668fd1506c4f83cd5

SHA256
a492ef3124efb44a3f6b91c162757e3497e197ab28f9e073e170339a8411f517

SHA512
7fea67deca977d10bddc943a7e82d11d0bd2ddaaaac462209c944d643687851d9b920b5ae02a7643bb7055bc88d8b86c848753d63d835c1735a257a2427bcd46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5831e8.TMP

Filesize
871B

MD5
281ed5521adc67aca369caad62849fd7

SHA1
fd8e729af1a2c86ccda30a1f964d395a137f202a

SHA256
fb23b5ddae8ec7f3788a994c17e19d5f621c26e9e8229d468326921068f464e5

SHA512
fb60e1129a2454768550c5331cb17e6afb0c2a1580a33b16b5f0692e537dfb7944fe9cabddb549dc34bd74384729325ba7b5955f3a003ca3cba4e7d78b5ccc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e81cdf8e249215c38538cdfe88654e33

SHA1
60a08ef2a638413768f9a3909f92849cfe7d3211

SHA256
14b90ea84e3a931b394d59d11a8f6001659b04c28d92822b28e2dc36aeec4205

SHA512
cccde4cb135c0eb1f4660349b3a4a20e4206ce8c3903fc8ffb23d6fbab43ef9641a33df6f8004a610a73cc60ee4cb2b55fd2c3ce011e4fe095d107d8e23343a1

Download Submit