hxxps://www[.]jaxfishhouse[.]com/location/jax-fish-house-oyster-bar-boulder/

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.jaxfishhouse.com/location/jax-fish-house-oyster-bar-boulder/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
4444	msedge.exe
4444	msedge.exe
3900	identity_helper.exe
3900	identity_helper.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3216	4444	msedge.exe	82
PID 4444 wrote to memory of 3216	4444	msedge.exe	82
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3988	4444	msedge.exe	83
PID 4444 wrote to memory of 3560	4444	msedge.exe	84
PID 4444 wrote to memory of 3560	4444	msedge.exe	84
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85
PID 4444 wrote to memory of 3776	4444	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.jaxfishhouse.com/location/jax-fish-house-oyster-bar-boulder/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c4718
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,831523702356396384,18198734139303627488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
37KB

MD5
e813344152b4ad0b94fa3d7960a2a777

SHA1
03f14a190a4d8181314dcf97137655e303c2191c

SHA256
6b60deb4edff4b2eba6391237ac85b9626c88ead8757a6baedbfd7838fef51b7

SHA512
752f9bb4a374b909ee961327d1925a0b8fe35f206a1e4d56f8653f9e4c6fd192eb47c260c3c981e5fe630d8b5dc0c4f4163437bb4eacb6563df985c78876772d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
9b35bc84bce9280e4e7df51c0dfd4920

SHA1
60a9fbce23872f88dea2b63e035a1335189930da

SHA256
fe9ed03e004dfe92adcfae46b53b89be0cc7f5d682773cd87305d70f87e3db41

SHA512
b1702da00021cd0eb13d931c62c556b55179d6c5c1a347b62a08a7317db92c11cca47564509c304d936f7ff16e537cc12683bbc364f27d7ecb1be8924659747a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
153451c371693ab0853d496742b09b5c

SHA1
21cd418792e6372806378c182706c04d060e4a79

SHA256
ea5f904b7b9bdfd5ad6b3f9f49686733b3357f0e5ab93728e69c8dbd25a8a875

SHA512
92d00e5f85b322cb67391752b46e7d5ea9578b989cc472cecc0346c8d7e5f00616168cf1ef0409b497bc136d66662c874ffd4ab6dcc9d45185b9a650688f7f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eaf09df6b57ed716401b1008b8aea8b9

SHA1
519cbb8f0e8c5c9a835528403ca61b3629900ec6

SHA256
c3d6cefa6292d885d250ccb01064e149483c712d8c4df8b4a08fbe7ddb5f4a4b

SHA512
9d457f30f99b2184c244c47a38e818a78af729972cb21093a2d1b11740f9f5c7e3bda673aab55907e7f6674a75fdd3002a7d986d7175e123b3e99cee037215df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
367d7c6d6fa4f91cc382e38ecc649acc

SHA1
176f5888e39d5abe4a1e079f25f772d6e4d4a785

SHA256
7073207240e3dc9ebe9fb20fb06e60636cf600988e900759f1354a64ff81a0e0

SHA512
98172ab45e0f88558756dd15ca18bc337144076b342305e6424e3e9b6f7b721147dfad396965af27be3bd1a9bfdcb42f2d0b705cc4f2c211e01a6ab4f7cff2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b68aa152b8f8e5e384f8b4d9a2082337

SHA1
b11c783f3938c6ab796aff50388a393b6dbe9bae

SHA256
9c16ef19933706bac92ff02bd1837b4d346f6f8fe1b3d6635f821a533a82c73b

SHA512
4048bbb5dfc5280539e17ddf557d278d145384213fce1b84ff6778a5a46165c238db7ad55c25b2b1829041412db2cd9ff5497e989d3d20ef125650c02fe70e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c6d7b479090f5f9bfc2497c781498d9

SHA1
75bff46cc45f4cbdaa4f90cce481cef3797bc610

SHA256
c11ecde25662899e8b2b07657d9d7f076b6de80ed291bd90ef6a3d703b1dbdbe

SHA512
9febcd7bd61c73be59a199703284fa099013f6ce854ef7325b198a1cd95834f9e1c7ee596043a4762841b56b2c0864d9642eff1778ef65c118e82c43d8056e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b35d3b51d16cf5ff35da1f1f42d659e1

SHA1
38b6981b69cafa6db1970853cf71ae0af22bdb84

SHA256
1e9e202929480744fd06068ab80400a6bba33a5a21f0911211042769efb0c2e7

SHA512
6c1b3e6e37f8ce024b6b03bfef75470fdb5297eb2e2b93e4823507294c14a4bc60edc0d1cfc6e40938bc278467a802c80827ad01431859f23323f6b246d0448a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5908d0.TMP

Filesize
1KB

MD5
621be61ea94bc257d179ff954ee934ba

SHA1
f33045deefeea2f6432b6a3db19928b029d2a635

SHA256
86eeceec7bd1031513c6b3c465e1125803efa5c78893781317326f23a818026f

SHA512
6ff4d9703d7b502d83230cc94fd3418fcf5eb9fe0b225f9deb88007de5d1fcc450ded625e1ffd6053f6c05389864f08d47e5b082af4cdf2aa743f627bffdcf81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba3c49e07fcc5bf33a636944eb6f6fa7

SHA1
66de79c930741c9bcd6a4e9958240c479d4a5886

SHA256
c6be8df31feeb9880a9e91d57fb65109b95b5a5cdbd85b7ec3480ab6a99a7fb6

SHA512
94c7236240b050761050d22aafb7bd02202cd8eebb3349567309951d26d531929614ae6422a2c86c03a1cacaa2cacdb3be60bcf3104eb392bbda5355974163e4

Download Submit