hxxps://www[.]dejodber[.]eu

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.dejodber.eu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
2176	msedge.exe
2176	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3940	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1492	2176	msedge.exe	85
PID 2176 wrote to memory of 1492	2176	msedge.exe	85
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 2224	2176	msedge.exe	86
PID 2176 wrote to memory of 1620	2176	msedge.exe	87
PID 2176 wrote to memory of 1620	2176	msedge.exe	87
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88
PID 2176 wrote to memory of 2104	2176	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dejodber.eu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae0a46f8,0x7fffae0a4708,0x7fffae0a4718
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,9779357637005301449,5938737881385406278,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
503cb09995d6e987723386b755e1ccdf

SHA1
c333ae05a2aa894c5d99613b04b96e5271e4e8c0

SHA256
093936856f500f4756e1dab43390e390f507646d130da3bc1929604780ac6949

SHA512
9ddc844ec3b8b71ee7f580786cc89fa03266227c43a7f3054c8598a2a7b128cc2a18d38309dcb6a3764653a8b9cf50b9aa5549a5957d3b46b062d8d4f988613e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
51ef554afd6e96c2e223e073683ce7e9

SHA1
19a210867872564d0ff01590974aa53f44e91278

SHA256
eaf8f4980415bf41ffad5e6f7511d471f09c85e36b8572e397af2295d7666cf0

SHA512
439e4016b62c27e9e441f0ffc64f526a86d8e733391775a7d8a06f9b5ae69b0712be4556d897ee3bf37fa651e2a5f180f907e4c4fb8b379e1ef588e432f73acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
58fc1572e77156d347a7e50471f9dd8e

SHA1
4d25c2d9427800affecf610379c619a664af4f52

SHA256
8c0ac4dfda50d3c21d9496ce775020956d5c10713e7a2e9ace95ae2d459ebe47

SHA512
578894926dbe5ac33968317f2b4e46b0359a06a7d43ea552505bd7aa15500e24c516f8bead3126b5ab3805eb315570ac2d93d04e8289867f6aee9327fbe8dc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
849B

MD5
6599263584933547ed94e748d2a003fc

SHA1
1cfdc679bf3317d6915acdeecda05b7729aa9709

SHA256
573dde6f7e63aa8d2555800374ff3f69c21cc766df302447c740fc0326d014f9

SHA512
099dbe5a2f3508eeb6179523771455a9fe979c2d40df73b0c1d01b3d89e25ddf9023b9a3f47cd62b88e49da415360bc4e40e101dec5439062f66d3095821acd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
909e68660f26d820e3a7547e414ba6bb

SHA1
b6f142c854effac641252d0e2c78e8a03e7f1324

SHA256
e8038d8c98a8b519d34febe7eea989e65972c6ddaaba62de57a726613e9044eb

SHA512
4f1766a08891a51f3c667ea9f991eecdf449a88788c2d15b44d6a5d747bb9af12e721ac1df0aec1c2043be59858da5b267dc683b60d9320c69bf8f9df7480cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14d8ab6b9f8264c4ccc05d822172ea35

SHA1
7969a303dd94b2175be9ef3f9d5bcc4ba4746622

SHA256
f9cfacdcc2ebfedea01f60f89931c984e661fa0de708e1a7eb9836499cab6ef2

SHA512
2164453c5ce7a2689c01c9b71f3ad8fb9d98c2a26d4ae80efe5a5518d2a0dac937884c3392d537b4599adbaaba94d16906cc64cefd8a3b4297fa04c7bf4f2864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f72f861f3ffd190c3a863f74de62a2d9

SHA1
1b3cf51b5069dc8a6abbddffe4e5193368b88f57

SHA256
ad7a4b48762a16a7de349afaa726fbd444c33ee5e692feacdfc46e2aefb3684b

SHA512
fad12dc3a4add8974154e0ead64b6f5eb0155431d0e6e860ab765f735c6f010d0c595a55c570d1a18507d39836c2fa2ece67287a1b22e755d34c2ee48b6b6783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
cefeaa481af835f86f6748edb1e80ce9

SHA1
8b40b76669c7307af16526087f2ced437619627c

SHA256
5515e01a8914f8ce0c87851b3739cfecc68f6eb7f3fc7dbc8b61201af52ae32a

SHA512
1b29b0acb0e5c14f2ffadc502e751c41cd6a3e1a90766fe571fb1d293acf2e04af78c5f2f30f9a9c426beb8d29ed7973a8015a60b24eb1d42a53ef19d728b97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829ab.TMP

Filesize
704B

MD5
bb0c55c7d8bd98a0d37666e6c10df8ea

SHA1
a16fc91409b1fafb29da4a7dad2bf191070db340

SHA256
79f929e0ff5a5cee8a35de8cb60408ed976ea982f0de50f889b096f0e71b745c

SHA512
a6d2d4f06a13df9fe62cdb6162deff3cc5935aa2ccebd7a1e544dea714724b4b2e489bb5e723ffcf09eaa54aae3e846f44fa5eac86ce0189b8f0bac9fd1bd2bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ece84d9ab4e2ab576a28cdf69a25a7a

SHA1
ae04ac5c7e3ed933feea8e4aa77b2004a6af0c08

SHA256
6148b1e49953996f23c52311c7ab1c56aa917b40c37957f590d85c4fe2e4c71e

SHA512
8a0c02df7bbf2e184fd2fa41981332b2cb020379fcc56c5f67083a909f67c3f984f7ecda67f092e205a99b80fe9a687b347b775cf690a52bc0b48adb6a938d98

Download Submit