hxxps://vincic[.]sharepoint[.]com[:]443/[:]x[:]/s/FleetMangement-EuroviaAZEO/Ec1t5QQymOFOpNaTOcgZiVYBeYMkgVzT_ZbotRZKvtfGUQ?e=4%3axcqsoC&at=9

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2023 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://vincic.sharepoint.com:443/:x:/s/FleetMangement-EuroviaAZEO/Ec1t5QQymOFOpNaTOcgZiVYBeYMkgVzT_ZbotRZKvtfGUQ?e=4%3axcqsoC&at=9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
2776	msedge.exe
2776	msedge.exe
2340	identity_helper.exe
2340	identity_helper.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1400	2776	msedge.exe	80
PID 2776 wrote to memory of 1400	2776	msedge.exe	80
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 4408	2776	msedge.exe	82
PID 2776 wrote to memory of 548	2776	msedge.exe	81
PID 2776 wrote to memory of 548	2776	msedge.exe	81
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83
PID 2776 wrote to memory of 60	2776	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vincic.sharepoint.com:443/:x:/s/FleetMangement-EuroviaAZEO/Ec1t5QQymOFOpNaTOcgZiVYBeYMkgVzT_ZbotRZKvtfGUQ?e=4%3axcqsoC&at=9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8158e46f8,0x7ff8158e4708,0x7ff8158e4718
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9361333770507981480,6693288764561489542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
764e1cb1d0ff11d53296da45bfeac4eb

SHA1
299e8b8fd33fcf2dd282630156f7d9bd2f8fc858

SHA256
d1fb13afa1eb85f786be4e9e1ce28752399830a3e5ab07dbc6936ff9034b9368

SHA512
90f7b6bede0bf16890a1c9d62f5c456eaa9a28b2333e352193aa093695a478a0752bf4823bf5bf73c198af9c2c00247a86bd7ab3508dc4844a0c49fd8590825b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
355B

MD5
f46fc33b0bd0cf74a017e6a00117e365

SHA1
61a0bf2e594305582e9a256f2fb7fcd4bb53e00f

SHA256
7e5671a5bc6ed719afbfb443d1e22f6e3328739042373f93b4aa1f2cdde4b5cc

SHA512
3bba1ef30c8ffdf5e562bd75b740784a561a2c3a76ad3861b2170619d86ecde577a6e365f8f3dbeb93cbdcc6d510219c93de9868e6b2fdfa74ad7584a0974cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df132a66eebc839e3962c9bea2c45f33

SHA1
d83bc1ab4bbe3c6c7f7fb8b6be7c14f439c3b8eb

SHA256
1f54eba45cf8d726fad223a6f61bab6d542125f8cdc2b0e4b6b4036b613ff006

SHA512
9e5facb6ea43385391f2aa872761a0ef4d1750a6b593b50f7123fa0502fc497b1a098eb0a4f9a18156338d4ef67ec63479264fa5cc4f86f88cf3c7c5941eb664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff47e2c14fbe36e1a9cfad987c673af9

SHA1
22e89ade3d58ed8e2239d37933d2f17a4065e5d9

SHA256
8f46ea87f2b408a79701ab5380b4fc265e826eb49e3d2181b69a881058fa9fdb

SHA512
ba64321ad3d69caa4107818c3f4115e2660e71eaa63ae426f6ced93b0042bed137323563dadfacfc7ea0ca27ad8a3a8af98b0e2ada1c3a9933c971144bd6fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7de96dd0f5b52e5732535b9dae6badad

SHA1
252cd9bdbbf954c4de9464da6268e393845075b6

SHA256
d5c44a7fcfc83f4c3dbed21785daa58fea9878ea7bedb301e9c935d4bf87beb0

SHA512
dcf2b7bc4ac966d0dcb6e457fd5b0b73d82a704985c21eab0e31dccbb25809acc8a2392278d89a1c0a2b1ed6562ac4f0bdecfc5867afe7db9edc8f1a734351cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fa1d01257224a5e38aade055c0b3344a

SHA1
8c24a447fc46b4d8fd18935c3043dacdc076ff50

SHA256
a4457a4aa9b3773145ce8e7288af2bb73940ef2be9e45cf9fa705137f020f60e

SHA512
9b0ab60ab7e24d4b31f654f8c9dde888eefb89045190a8b7837d0dac3b345f2c0b32806a9a5ce6b07c51790516f34f05ecf9655014613c0966e34416ae99519d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58363e.TMP

Filesize
371B

MD5
3f827756ed4b5b272e719ac25020dc5b

SHA1
47aca94219294101948356178d38555d2b6728b5

SHA256
6947694d0571165b631ced899780e5ed9b7bd9fa1d9528a1b79bed73932c5a62

SHA512
6d20884ddf512f00d683b7430ab0b3dd326cb3194dcaf73a39939dea363760b9866d76ac52a3b4da70cce2c8c678932eba159b6be121b3fc3b7f67c5d043c4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3bce217e183184cb864d46312e4cebf

SHA1
eb7c1b14ad713dda680cc62ed32755fb18b127a2

SHA256
8e1eba565b8c7d8ba6218f8b9642568a20be392e305b85a3bb5cf6ed0beac9b9

SHA512
c470b7eee48a0f0612d3ca04dec93eacfce83a071b8f1a474683806420b3591513e9f047ddfff7e636fb7e3b09ce4a1b926c60c95926ab57ce4d7341b2910aff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit