hxxps://service-noreply[.]info/2cb5aa0957cf53a3df13339c688d5c178f7adab9

Analysis

max time kernel
174s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2023 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://service-noreply.info/2cb5aa0957cf53a3df13339c688d5c178f7adab9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
636	msedge.exe
636	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	452	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4068	636	msedge.exe	82
PID 636 wrote to memory of 4068	636	msedge.exe	82
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 996	636	msedge.exe	83
PID 636 wrote to memory of 2704	636	msedge.exe	84
PID 636 wrote to memory of 2704	636	msedge.exe	84
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85
PID 636 wrote to memory of 2188	636	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://service-noreply.info/2cb5aa0957cf53a3df13339c688d5c178f7adab9
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8d8646f8,0x7ffc8d864708,0x7ffc8d864718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,8987224867295547689,2798459980423571266,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
33a592a3007b8c5e1c77b13832f431f6

SHA1
a2e50f776afd86693ab06a5a4b62f9ccc05ba027

SHA256
45641f361b4c4e5e0a04321d22784fa3f7dac0aa3cd753bc6366d4d4c9b80416

SHA512
fc131afc844c3156ba56fb16e85dacd95d7743105a9f6f6077065e6ff6704c1424697215f3561f3dc2f74797ffbfde73bc500773ef9e858f1ed422d7731203a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
429d3d717525d9bd3eb3d943c9a2a20c

SHA1
f2ea9784e00d0e6400936949d8edb316892ab78d

SHA256
97e807cf8888fab51657a33207d96ac2283016af89c750ef50e6eaa07f9a49bd

SHA512
abed6120b34a7b1863a674de8429020c63b4a2a205e0fb19d8afb88e4ed4d0f31f3b9f0c35a14e47e62d07a0431b0b7f5fffb190bb6a166281e218c92e8b161a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
776B

MD5
7d0564359723fb1dfa27e63d1a5ef56d

SHA1
a9daba879a30a17355411a70d1873a63bb3aae1f

SHA256
6e5e173851987ec6cfb6d37dffdb5d8f4fcc82c27d3928b7ae6dff4f8107efd1

SHA512
26590679d9a4bbcdfd149928cfcc8bd41909571fc0819559418d8338870c9d79cacd1ee6a2921b2c1f990db270953372f76412f13983949b6210fc7240607baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8a606aa449f4b3608e3e09173095cad6

SHA1
9d329d6579e869ab3846a95463df181da73dc728

SHA256
bf99df14ba1ec0453673ebf7f3283a45d4d6e562a40264e09308024151b01d07

SHA512
32c3a3472cace58581a6b62686e323b54f555f04799f7e9d88c7d0d722e5e39a1e723f077cf68c206a9989a10f7ccdd3a94500525b84e4d1dcc762bed43071b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d1e0405afa2a75c44fb63b0205a48e25

SHA1
c69a321191419ba90c0fd5084b8646e4cecd7108

SHA256
8d748ad9778c4e7dc28569fff828704458a88acf81419d049dafcd6b7354c1d3

SHA512
83a89215e842c1d1c4377535fa9dead3f37e8bd685d7ca766c58d51b816467cb914e7e81bbe1dd54f96fe711632c4d77630dc2013e87a78838337f7a5b54a860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11b5798cf2acc4314c3b8400495a498d

SHA1
2a71e7a077363b430983abf9bb5bc23e3929af01

SHA256
cc9b02d95577315ff76177af095afd50169101df1b437496afc2d230dee5f787

SHA512
7b792de5567ffef4194de53b94c06f12f5b29d3991b8b8f76627b5593e0d99c7515ed082c1de0fe9a902480cafe98657e2f025946789330c28dffa54a6fca272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6ee9cc2ed928235ee9dedc7b4eb7291

SHA1
d714691eadb3e4a2dfc547556d279b2e35ff22e7

SHA256
1e72dfc2d669c8f5a581a3d24415fb1492301b3ec4c201574685adc526bdd071

SHA512
883958204e3cf4959fb32d6261d12f964858e63b40a177d6bef4f8a9c8dd984c7c6997cdb008b2f2b3756882b3d8cbaeafb6b990e17de4bc61d46f532efb3132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
2126adbf502f036e13c26caf4f593fdb

SHA1
8f496ca049fae209b2adb5061462fb8b3d6cf64e

SHA256
d2e742e1baf9df13fe56bb850f999edca4b142e4e4eda71ba0e7d324b1bd93fa

SHA512
34bb100a67a57484fc65e93fda696d17a9823140217a8c738c452da2b4c6878593847580a997754eb6ec377a1db23bb2462e3b6fa72b43e893245009ba2ab1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c05326d8f16bb560932ae8b26813086c

SHA1
142ad76cde4b66dfedc5e1f336b6aa276f242199

SHA256
0d937ae470186b1c502a3a0863ecf0556a0b99262b8fcc35684c1ecfbd99c26e

SHA512
6a50ff1140b952cea5e7f7454a16c30b5edb1e81da5150784c1db122de31ac0da15fd3e9a1e424fb26b832296bc8d9a29b545207c1967a5207bdee67ac24dc91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit