hxxps://johntannersbbqblog[.]wordpress[.]com/2024/05/21/the-pastrami-at-wagshals-wesley-heights-washingtondc/

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://johntannersbbqblog.wordpress.com/2024/05/21/the-pastrami-at-wagshals-wesley-heights-washingtondc/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
2192	msedge.exe
2192	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 752	2192	msedge.exe	86
PID 2192 wrote to memory of 752	2192	msedge.exe	86
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 2480	2192	msedge.exe	88
PID 2192 wrote to memory of 4080	2192	msedge.exe	89
PID 2192 wrote to memory of 4080	2192	msedge.exe	89
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90
PID 2192 wrote to memory of 540	2192	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://johntannersbbqblog.wordpress.com/2024/05/21/the-pastrami-at-wagshals-wesley-heights-washingtondc/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3922404712601084688,7506004635779745198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
552B

MD5
c83550d72295bddc00c4526ee1f1e1e3

SHA1
79f0f11ed1722a93d355b13643df5a89af84846d

SHA256
0080317986649ab93683a855b54bc063c8a653517e099ec311fd0fd99f6fc2ef

SHA512
1577219f36d80fc57fdd94656a6469a64005a102ddc814fa25dbd364d01a7884339b58947c4753131af9b8830df26996e1f3f31af8c4ca7c4fcf38a2760a214a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
8878a585b8ecf37d3fde830aa6bff445

SHA1
ee4f4d41aa46b81b07fa7bd7d2637ef2f8046230

SHA256
34420231223d6f81f4c7cd186821918b7604d64eb22fb49c6cc3926242aaf44c

SHA512
426eb860cca90918838779eee4d6d8f643cfaa23896b812924e9822c22fb008e2d6b92abf87a16c9b118f956f649bc2219832f795a5f850d421d2bd43641be6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dcebc30729306d12457174028eb89882

SHA1
6404ec1dedbb5b08aaafb8e32d04048a4ce01e64

SHA256
32b2e3d3a5cfdd332fff0888933531ece2b9cf4c306a83c113cb6f0e29b82f38

SHA512
e9d9ec029f646222e61d6e2c1c3d72773872f040993f3a9d4bf57d21b42820e83561d059db9236ed3333d16426fb0a4eedcf01d7b59a8a691e3a64b2b1598a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0d2f51a10ad737a6d3b8305d37bab0d

SHA1
be761dc09eb253fccb2c8a14f8f83eaa811edfd9

SHA256
9d3e704e116c2d9e7b910f2f03a2927ef648b1e6f39b88a8e8dedb17bc7bc3bd

SHA512
71cddd085dd55dac195122599d65378ea45da5318c1b7df1a408301782bec296533f8a251ee1bc782799e455ab53e6227583063672227a0ba4b11495ec8788c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
402b81e1131e69c6a6af8b75c1e566bb

SHA1
75f1c500c552e731aa6a49354a7e34fdfacd534d

SHA256
6bf09a6f30e439b21b4b73dcdbdf07a60ec897b16832d8cb4c5bde7fe93c060b

SHA512
6ba6d044a4a7f5c735fa06c371aefb941d0fcd807b614c5ca93db01f5698f67a589243492ffa0e72332e73adea7c89c7b0f754be35648e06720839a6f745dbfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d4c560344b439b50b3082e9dac74d8e

SHA1
e73cabee705b2b0e01a12c0a97bd7ae75bde5c0f

SHA256
a09713b37a9c706f4db1b02712c2210538e79bb401da540e2294f676c2baf6dc

SHA512
1e049b4e114bb0b414ab54bbb10bbdb377ef4a81579b935c8c90b02d5c8a68e11b254f090623993f15ad96379a7dde75ad18d1a6ad4a635ea78bc4f91e3eae91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
b10e0e26555d23f1d49343babe7bd1a8

SHA1
bf4cca2da065731cc95adc632d719aa06385fe75

SHA256
62c08c73c29bde5f25c36038c6fd43483a3c0bc18282dca93e8e0a1daae9e9ef

SHA512
1f085f2b56cbe20d3036b04f62c5db1e7bc83e44164b308cb0b540614e31f8cacf1585b43311b5d85c52b0e521d3f00295319057147e060414090acddbd7bcaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
530b985a969acb6c06828e01b513a7c8

SHA1
c31d2baa0d0f3228ce5212fcc20f07cfa4023c94

SHA256
b464907f1be5a8654279eec0586e5895309db42d7f0b3056efe518c534c4f1c1

SHA512
48765fcc29c8aa62713ae552933fd097939aaed52e2cb514f2c817bbe4d674e137a773f24edc6e9aa0ee7011f1f336ac24e0695f434ca7b41ab34459a0f9b426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57924d.TMP

Filesize
875B

MD5
069dee3d7bc5d157212a61ff2bae35f7

SHA1
62b65cb4ca7ea0dd4d67c746f2a74fbcdec1f7aa

SHA256
4cff8d541e4ffc3755a3efc42957e4670b290026043d7bde580f23d5dc0e3611

SHA512
2492d5efd52a19330da0c26a8792681f3db336c605e2c37f1173a12549f56aa546a64063787f9c4cf95468ee3d910dcbeee3eccbca0f0cda49b254cbc047e5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e05c180f5176fa43d22d6ae3fd0561e7

SHA1
a4ad92b3b4b9e35938549739101662d5840668b0

SHA256
975eda6399f94371199a2117954fa4fdbdbc130aa36f81775a6f0c5795db73ea

SHA512
e853589d4a2c533fc3e6b066d4be8a37fe98f9d20c290d72c2240642904c2c14918b9b893a0de084776623f15f712e32249a4728f32651474378b24e1f755d11

Download Submit