hxxps://luxsci-email[.]com/0wfPaxU_pTWuy2DF1qUPx1/email-link/179214/2634/send-me?to=hxxps://savpos%E3%80%82com/temp/?portal=309712845314028021958904696572YW5kcmV3LmNsYXJrZUBtZWxib3VybmUudmljLmdvdi5hdQ==

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://luxsci-email.com/0wfPaxU_pTWuy2DF1qUPx1/email-link/179214/2634/send-me?to=https://savpos%E3%80%82com/temp/?portal=309712845314028021958904696572YW5kcmV3LmNsYXJrZUBtZWxib3VybmUudmljLmdvdi5hdQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
2976	msedge.exe
2976	msedge.exe
1652	identity_helper.exe
1652	identity_helper.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 232	2976	msedge.exe	83
PID 2976 wrote to memory of 232	2976	msedge.exe	83
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1748	2976	msedge.exe	84
PID 2976 wrote to memory of 1856	2976	msedge.exe	85
PID 2976 wrote to memory of 1856	2976	msedge.exe	85
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86
PID 2976 wrote to memory of 4248	2976	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://luxsci-email.com/0wfPaxU_pTWuy2DF1qUPx1/email-link/179214/2634/send-me?to=https://savpos%E3%80%82com/temp/?portal=309712845314028021958904696572YW5kcmV3LmNsYXJrZUBtZWxib3VybmUudmljLmdvdi5hdQ==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb4d46f8,0x7ffefb4d4708,0x7ffefb4d4718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,650147215535797016,953893236895058550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
502d6a079880e466ac1bbd84de5bc52e

SHA1
633d2b0019cfe3c314947da3e16a53de6312e628

SHA256
0f9e67a55db463ff4193811f8813e1d4cca881936a31ff24602ae2ca9a7967ae

SHA512
ce09c058135d7ff40e5625c149b1a20bec76485e5cc20e9174cd880325ad2627b56b18aaa2f8505a4b892b372a5f091347ac31c0ba88c88bd6c9b2ec4fb1f17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
8c7a4dba9773428e4909709c32d70f95

SHA1
f09122420d9d7f389096dfea6dad03d24f5d5cf1

SHA256
abdc8950a30e12ad47fe1abbe41e2f49769a404f336f842545183a81ded7e940

SHA512
afe0c849a241095685d6aeda50a93c13fd3f4fc50ad6edd4043e59ab30701db8bbbf5dcf9c53763490e70422775277e63a26fe5f0726d8454809d96206365934

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b64b95c2531e7172e6a9aab114e56185

SHA1
7ea9c1ec55cd2aec7d3fff62794412096d86f253

SHA256
6cdb3d8fecf351f3a71acea84d566b7171f38209f91b4fa1e0ce589efe339f30

SHA512
ba589c929d6fc4b1e40474b8d78dba14335301ab95851f675fd2e4ddd82e23606184183873778a33ffbd08232050f177f10a2995071a28b8b881dd4aa51bb5ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e2d29953c863d6aa6a89523b1bf1d16

SHA1
843459ec2f991df40da3a7b447f69058a80bf03f

SHA256
15e08b5c01725a3778a0a36b6f73f652d1edca9b45d2c625e2a1920e527ba23d

SHA512
1a5dab2e5fafa18ea055be77a7124144599aa9e2f660928de9a2f6142c4180afe8f9acc35ceaf2fe4e3adb8774187e2c95001f66f1e42273cd013f29bcadc1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2537a9b9c2dfd45d970ab9aee2819fa

SHA1
40295d32dba796d00e8092164e679f73217aef04

SHA256
7a183e060355a530d660bdf3dc9e8fbc76fa732a55012b195b33fc0ab28b3ef2

SHA512
bc49a2daa375822bc481e7c18e5a0469354b7b8489f70cf7b729160aa1b032ccaa6e918bf8201e6de9381f3309dceef433c3acda3a15b0e5e61e49121364d91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f74ac1777bae67ff7c1eccfba2596329

SHA1
8734d8bce9f0d3b4bb51d89c55a607bf32d24daa

SHA256
adb527a13f3148d892af4d0d433383e3e9b4d768f647384b5b311776cd44fc12

SHA512
8ffd8e6011c5ede745541e222e92fb0689de460147c502309e82c8e282e1bf89008a58ab64ed05e0faddc280364ea0a5d31d514adba0a91f351fb598629335e4

Download Submit