hxxps://www[.]reddit[.]com/r/sociology/comments/17nowa7/is_there_a_paedophiliapanic_going_on_in_the_us/

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.reddit.com/r/sociology/comments/17nowa7/is_there_a_paedophiliapanic_going_on_in_the_us/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
2352	msedge.exe
2352	msedge.exe
4868	identity_helper.exe
4868	identity_helper.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2620	2352	msedge.exe	83
PID 2352 wrote to memory of 2620	2352	msedge.exe	83
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 2724	2352	msedge.exe	84
PID 2352 wrote to memory of 820	2352	msedge.exe	85
PID 2352 wrote to memory of 820	2352	msedge.exe	85
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86
PID 2352 wrote to memory of 3636	2352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.reddit.com/r/sociology/comments/17nowa7/is_there_a_paedophiliapanic_going_on_in_the_us/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15689021821782921458,12920882844370190146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d47cde300701ff4062a894ac5da2bdf9

SHA1
768aca2035252388b705ef54403e6a0cc28c1de5

SHA256
9583d7a0ed998db8ba6f9b3b3d82d3bcd4838dd8db5caf199bcb8411ec33ad6b

SHA512
3b6e481512befa601df063ac993965a90b3485456b3105e96fe4a0abeb4ce058ef3ad394082092af7d20dc0916e33e27f83a528f1d0878f7c4af45ae5fded982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.reddit.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a518373155ad529ec9edc40909d362c1

SHA1
abd0d6980319866c1241081bf1a5b2a1319d4b23

SHA256
7d6ecd2dd717d2844fd1c7471555f3c20ce1d26c8a183bf239af6a0ac250cb72

SHA512
d1988eafe93d502033e3db436f878139119a07ce3e2e96a4a8171d1592d9bca71621a3ffc712b58acc5c48c7ee49c80d0ca93a68e42477b18241d0e2e6b14bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33883968c00894ead82ec9e27e0aa218

SHA1
ca0b48ea31973ecedbc251a2e15a2b2147ac7cbd

SHA256
e8dde0ae4bf2d385a810af2a7a97a777c11b539d0575db213d71fac1f99be60c

SHA512
60d9dd5e21607b7b345359b9368031869ed833c77901d4596d2b93d75cddaff684a557108622ff90b3302dad7614203e098d62e57409204f5af1a5d3dfbe6272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da4ef1d976903c9fcd77c5c3bdd7b286

SHA1
0a19c019ce6bc704c0a3143dc7a87ff547b2f5e1

SHA256
18ca733c5764f26f47defcdfd5efcb52064381634d3776b246fb95d4172fe022

SHA512
b54eb59bfbc2d78a30b99bd65dd5f37278c0fd62bad42f12e682eefb2e65bb0f081888b15f1aed16c66041e3059332c18f5086b3bb990c9e105386fc282ee090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
96779c9f5d6bb2977e80a614a256945c

SHA1
b3073aca92490293bca85fff39bd4002d5562e6e

SHA256
b9f4090ba2f8b9add7dbc3ea63f23c9b89fe1783996fad727bab330897962910

SHA512
8e9cd163b2f90c66550a22731738efac8ff0d885c3217f3bd01479e0f777d98e2c4890ad59454595615c691e389af07fe2ed35268dfeb6ca84bf16c1cc4d30a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57daef.TMP

Filesize
48B

MD5
25175d3bbdee797dc2e31ed24ff10c00

SHA1
5a56a0a60c99d239a49edd95ff40e76399f8209e

SHA256
c7b4a8485250fe9b2e1e65cc4992ad11ebbab223fe2c4ffc8c236a60f368d8ce

SHA512
eb3d1d9ed29e31432a9d2d5129b485ed79a3ad3e0151bc5fb062e75a9c1d3be2b0dadd8c9042d793fa675b3e2121e41f536f056f8ce9e5da6355ab8170939378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
74c5c253459d9913450ac942481f9abd

SHA1
b5b07d40d5cc9fc1e29b4a1e87a869167acd1b71

SHA256
3bd82671cb37d4d614526c9a363b7b25aae4dc028767de2b53f989ff61b2f167

SHA512
3aaa0a88e2445594fe4db19894e2f51e9b5ba4bff76907cfc5cd72952d07de9975aeecefafa798895c0e39eb7e86e23d8bd6f97d54a2f296713fc483980da6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589843.TMP

Filesize
537B

MD5
61977f39c29c681f897d0cf13c014c9e

SHA1
31ef7801f0cd3ae97183319f77399ca169a3fa3f

SHA256
d36e98578382f06228d84950e72b98d35e0cd3a5f69d220abbf20a7689391339

SHA512
4bc07267c626878dda6f4df1cb250e3c905d37f6a0265a67e5ae29450da9bed8778115bed5c518400805dfdcc932828a56bf524aaca7ea8ec7f4330898e160dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58f49e894e41fc3ed2acd0037f33a4ac

SHA1
794ee90b45c91cc98fe94fbe2a69890ff39ac622

SHA256
bfc931515cccc9e2d4f49963485cf8813ed957873e64d12e62720092223635fd

SHA512
aec86a014bb8c83a96b645788282768ba5067342f121f0e1d4c006446cc53cf837b4e1020cfd4aff12b62dccd555a1a90befa06fff763f0ade8889dc43e8d531

Download Submit