hxxps://github[.]com/Smug246/Luna-Grabber

Analysis

max time kernel
1796s
max time network
1689s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Smug246/Luna-Grabber

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
628	msedge.exe
628	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3464	628	msedge.exe	86
PID 628 wrote to memory of 3464	628	msedge.exe	86
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3576	628	msedge.exe	87
PID 628 wrote to memory of 3912	628	msedge.exe	88
PID 628 wrote to memory of 3912	628	msedge.exe	88
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89
PID 628 wrote to memory of 5084	628	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Smug246/Luna-Grabber
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacf6d46f8,0x7ffacf6d4708,0x7ffacf6d4718
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8695058722529099284,10087162252932480134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b8c33ff73949cccde3e1494ea517ac87

SHA1
d09c53407c11d6bbe0ef6ad2c742c1e86ba5c2cc

SHA256
fd10bb971f26fef50fb5dbf5f61864667b69cd715d26afa20db52215bb72cbf4

SHA512
43c684c5293b9963234c7577efc6c301981d50f2061988f7c896f39b163744f7dbb4e4b9e2d32912b3ab76760f1fc351032bc546fd7cf78bf81254e3d5a7813c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
d22266ba3d8db30279b96944f0cec985

SHA1
44e288cdfe75a5e8299ce32e75dd9e0705cdbac9

SHA256
77873629fa695e434160c86ae9116906ff65a97666d7d35a3ed63221b627c0bf

SHA512
d463aecbdac835dace5544b4267c86c2ed7d3165ba95095db6dfc3a25655f2391fa202a81d37b4a76a36f04456ed86df137302ad0e456fd59ecdfee3c69c6c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
397c8fbe5dc8d969c19a8f555cd3c04d

SHA1
4e5dc6c2f3a8f8dd04291aa51e0973cdd6d76d4f

SHA256
5151542ff100e6f60fad016a84ad9149c5da124433599d70c7b704f1492517d5

SHA512
367c79a94c253df56dd2164d06e071b841307cc890832ee95fbf406fdae99a44c03936d51614b98c56b7ebe302320997961641563e590b5769fd87b6492c70a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85e0f991d04f27ae525d45d7646ac897

SHA1
33aede9064a30102153a0238d02b9ab04f842572

SHA256
161d8294d9a7f12eec7cc69b20d5f5431e0b4b582094efa3decff9a7a9488242

SHA512
d19a23673b2747fded95416b621e69072d13ec9d781fed0b68e6790bbd96f587a33d81a4f2f396900eefd648d022a8311d749471afc6e8db2cdd140d6247c951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a74dedcdd9baca3a70a3b1916722a387

SHA1
f87e4caba668171d4aa2fb11d45aaf3e4b2d873a

SHA256
68c04a1de6cd336cae2f4dea21897a0462144193a2edbbc4677306b2a13cf57b

SHA512
5eee7c4ea39f58bc38de5115346c22f029780d09fefb9d86ba89681091f0a7158567aaf5d8e0459a198e0f5e424627847c82a4dcfddb7ff5ae07dc4a4b068ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0166af2113993f1561e0011f87d5ad6c

SHA1
0607f3b4c00e0677f58b9e3e4915370c803f3d37

SHA256
660aa99d0a02177d151d835889e6fa9c1b628d3dcb299f760aa9b98a2e6a830b

SHA512
d77a31d06b39c344c82333fbb725d39422a65d673fb9e03ff37fcc235bdd927ffc7b5a83ba3a97b5571f39492c8480069f9a14a125e830b7b687d42095a329d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e2565e589c9c038c551766400aefc665

SHA1
77893bb0d295c2737e31a3f539572367c946ab27

SHA256
172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80

SHA512
5a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da5e4906ad1302b48dde235182ab4d55

SHA1
7fc5533695bc4a4c8bd308387467ae9c98b6629c

SHA256
576fa1898acfb1724e69248a4649a660d30db0062eb0dde7c5e28ecbdd417f73

SHA512
38e32b7f6e832bacb3addd6bd4d63af7395c5a61d872c8fd1436fa2e8823e823c1153bc2ceeff136f0997d83ef79ffcc33adde2549a864088474371449da7a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1d550a6148bdb8111ebffaefa10cd3b

SHA1
b665df2ec646efb082e02834a2d7d9d7b563716f

SHA256
4a8cbb1b7908fb48eb73ab677de325781bce8211be552c955615c8a0d7a31b20

SHA512
7be8cbc582804eefac8dc3b139e0082f45f62ac23a0d334a64eae00776ee39df1168c38166aea00b68606d69e4735c638be79f5167f59dcee16e712dcf3070e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6b9.TMP

Filesize
863B

MD5
a877edc859592dd66c86220a6343c67a

SHA1
74cfa9ce5e9e6eba889eaebae6102c6a07fb16f4

SHA256
b6c84c36e5f334cba8d4d16271e867a66bd72aab816a9aeb1f0473a014e877d9

SHA512
e61bb47fcc138d7ef577c5af723fa89aaf87a23776ad290f9953d0fd4cba823cc0a6816fd8558fc2cf4822a3326d297430d0c6fc3f10cd4a9fbe64e1bcb928ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8075576d2942ba03f830fe3e4838458

SHA1
1debcf40d97e4d319f0d2c5abd7144954ff6ef64

SHA256
7bb5222846d7b5e6ce14d48e5248142bf00704b978b2dc1ebf150ffacbeffeea

SHA512
23bdd8a154d87614bd74658cbeb4821ce8a5cf3dd1b6cc2b5257b953a49b08b92b7949a229fa6e3a6e6d86ce6cd01f01ce0e675ce38493ee8d6e8c547dc6f9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c0edd89bae28f2a301f0925f22a3eddf

SHA1
63c65fa98af34192cb596be4d280032cfca146bc

SHA256
faa59d8b780308f622e2dad3eb2707f06fbeba7db2d8bf03569bf90838d38bcb

SHA512
3cc8ffebd91c94f78272fb83b6609b030fc54c26257ac6ac67f636e42fc30ca4b729783d40b28faf0fec2cef1d3f5aee88d9fc70d512bb2aaf776dfbed563e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f13283ff986695e1de785cf5f152cb26

SHA1
f660a90350660345c5b1164cd5da4ec90388701b

SHA256
3b31420cf0ccae3a90a9167aed176d04d5409e98484ad69bf759477c4cefab95

SHA512
12ebc2bffe1d8122393f09de61c9fdd3564da176f62dfb67afd7b44805f9c6287f780fb060d7a71eb746635cc3194f26e33dab75d44e04cce09dd4d222c3e475

Download Submit