hxxps://buxloot[.]com/

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://buxloot.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
4492	msedge.exe
4492	msedge.exe
1340	identity_helper.exe
1340	identity_helper.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1564	4492	msedge.exe	89
PID 4492 wrote to memory of 1564	4492	msedge.exe	89
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 3912	4492	msedge.exe	90
PID 4492 wrote to memory of 1820	4492	msedge.exe	91
PID 4492 wrote to memory of 1820	4492	msedge.exe	91
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92
PID 4492 wrote to memory of 4952	4492	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://buxloot.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b2e46f8,0x7ffc6b2e4708,0x7ffc6b2e4718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3107317964797756871,5552726342254867929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
df4f4c55259cb321868a5ed59c8ee7e8

SHA1
ff08909dc517edb228c50984480d95b13b88b73a

SHA256
b71adcc4e7a2aab951cc4a54d8648ed08b7771d6fc8d904cafd780bb6d7c9b81

SHA512
57eb385ed07185fb74caf5d9d0984abb8bbc117e32474bc04c0a0c9c204a13071af0a94d82c850675c332ef65c2d63dc53e5e74d615b0cde6ddda3e20364b7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
cbed921d411aba05a3808b5433476f26

SHA1
b6055d5de18eb1d18493ed941900b25d63f3e476

SHA256
0d5c7743edaa951677711682e5f34dd3822d4aa22df4cd6b572daf681e0971b3

SHA512
3220c96b963393734c01c726934f80873afaf33c36630a35e99f16a7fad347949b28a4fbab781f94a7f148a9915a94d7cc9ed66e4cd82de63e86958c47c9adc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7d08dfaf249c51be334d94654df20d12

SHA1
fc90c7e6731212808f97dd7bacdf4eefd4c30bb5

SHA256
896f0ef505787306b07f385acea8c9b0d362711b957e44d609dfe6b6df7d23c3

SHA512
ca20d88e4f6a0fd83ea18c91c0cf04636a205c8141747e24f71a492b0bd13e43503a0cafeb2e258f46fbd600cb733a22230159d8d5f8e514c9834770ff2511df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
83ace06864a7037fc953a0f2278d1683

SHA1
71fb2a7c848a51d017828cdf7a698bd9ec81fe17

SHA256
c4686038401cf705120b5eddcd57ba620c1671bf9ebd5cb325ac375bdf021314

SHA512
e6f6172e4f588cf0529dbf32b14fed969107c0d95baef144cda5f34861b11e62add53c6c0b57a3a9053bcb915830384d4514a0f677be1238b7bfc8a7149b2041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7dc1867ebba619622590913c445d620

SHA1
8a0c7480c529657f6910486de5912bffbb89ca64

SHA256
371074c34a642b93160f03c15c398af5fb2e30b58256af222d56459ddf170d5a

SHA512
4e53a3c6651fcb5b2b25e0cd4442946ff53476c93de1c1807c4d227c1e97961dc45e9c0f8a285b614b95fc1635fb48ac36a5ee73d65260a697c7e10abbc3ed4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b6f2478099fc6019b5195aaceea6bf3

SHA1
461c6bd0a7c1aefc1a42bfcd1415a0f12bd858d6

SHA256
7c348dc78b8bd8b0d0c55c5afb19c434d8308beb372c48382176cb4e1fbda6b2

SHA512
b3c0cede3db8673bbca9b4936c0a1c9982ecb9db390653b301d2d724f7004fa175ad67186a2432f5ddb097ed63de5392ed19dfb96a8eac09662093e4f9f2ea4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9dc0e57f2ad9af0ab42699b262a724a

SHA1
43107532aaa2e0b9b05189affcf2cbdf5564fe59

SHA256
6bf93c70d9a363b66af3c7a714fdd3ae39fca9fc11cc0cfcf889c55b7ccaed1f

SHA512
f19206b14b2eda4a5be53112ff0a86c90db091b16491d509e79ee1dff43fe8c9513d019cde86d16927ebcd521c902b64a372eab83433f95999fc2f35486a7e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f2d383422778b7a04e93cdba581f2fc

SHA1
d42f0fa3ad2d9d0aa204ba186dbf8cab5f737e32

SHA256
cb2f9f6d2443eaa6b5cc6581637e3f62040af34b117ca0190215327ffc2b74e5

SHA512
1b050d34a38de01a84c8acc88fd9c5a43abe3e0bd05157a958c2483df540b0c3021522e08670da581e4257f27fc52ef319dfc4670a83cb0580e019390e6fc7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
610690e56efc7a9b0b019c0f5a823248

SHA1
291fb01462eb1b10ed8b1146fac19b762bdcdb26

SHA256
e7591c7809c567d27e7ae079d953385590e74d64d89a9ace282c44bcfc2e3cc1

SHA512
12fd1503a76ee1ef9e3a6a70db59da3990c108960a59e40a6bc2655b2e22bee659789552acd512c3fb261f9cd3be383beb5832c6e06bc21d3649f08246e74565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
bb7702513ce3f839c9ec28f0834ac939

SHA1
573995575a05b9c934b7a97017b18ca8b61d2e62

SHA256
036678f5012c525c5fdac671bb792ac0d2bba3837eb151fd7feaa0e84bea957d

SHA512
07f80468f34fbd8bf11a8030c3b223d392366180a28241caefcb19677d0c231181194d2b6d8a769bea82138d3813e6cb741c5506f47a6ba47f1e58a29330db3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13ba227c54144ed24251ce10a27a114b

SHA1
4437d9e3ea2546dd6339920f97af2edb77ec4a94

SHA256
5b939b49cdbd9fc64e136d7f894222da1c0486bded69f37c3af39b8f190b6e0a

SHA512
5be9414c23051d0c7a92a63ddb9394ad1375936ad9b3a4b292964711cc429c24bd448157c227561b484ff7f520228fd7f37005a3c932a1ad245f0ff54d1b4632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
99b0eafa6ed41ba3c85738b6e4512dd5

SHA1
15b601e6e671304a17f83fed9427502eb9792be0

SHA256
8cb1795d7342ba7f2d0c786b3dc856c0c3c296d96ec684a3bd680a996bfdfa6b

SHA512
79375d44cff268ca443c85893c0df03f2b4570b649786fa3cb426df1a1c60dd3cefab8b7ac60d0feefad86662969d0b3fc9174b79a17f9cdfae51aeba9433343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
10bc7653be4382c7dfbcdf9355fe6b7c

SHA1
9b5fc042e797b1b8d73b46c38d7518ee7dba1f93

SHA256
42f90eaf64184360f2fe764730dca79afa4308a455f90e31a5a3d5fe7efdd4b4

SHA512
6819bf908997c16cec18af52692b9fd429352e5caa289dbce7ed8c23ab1575790451cbf3e22ed2236d9920b6f3237f5e9acf37eb32576f5699f789ce057e7817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a7ce62a15204a6f0e8a57a29dd8746b

SHA1
befd26ed5d2dc7252d47721db3eb160f7d6f8177

SHA256
be6f4a034fef1fa2fef7b36adc8adf7b056e0d75197a23405fbeaba303ed3100

SHA512
b4ef75219a5c34a2498be1e13e984c557b9460aa9b2b1522b34057614450e82dd5e86b7a8cfece71947052d7d6d35903a281c2a0db0eb1191f07e10f515b4c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5795b8.TMP

Filesize
539B

MD5
4494717a0baa8a778bbcf47b90b584f4

SHA1
c2bcf8813ef89f121ccbd13292b12ae11671ef66

SHA256
098edb6d11d41a00cf52087f1632767de8ad0582d4e646537dde89217e440d94

SHA512
c498fb52b54f7a2535436dd15869da9ab83d546c10144f9c1c080331a54574a8f373158dcf1882716546adf32a5c155ed6cc7d067da09af744ed6c7a843258c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
daf11938fb3c9d728eadc5448c546dc1

SHA1
7fb796d546a5f5c1df0ceb462a84e32dce12eb9f

SHA256
2bf804816dc734ece1010c49c27dc76beca6134d35b80ab66088dac2ea043df7

SHA512
bb70e11a9ddf1513661ebb38647ed7749c2adb9c79267b64b33fd9f0a62339c539f68c5f009ea9b1ef8638a2605e4dc4ab9b38f197ff21bd434025fe2b482fee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit