Resubmissions

11-01-2024 08:17

240111-j6qrksdbb4 1

11-01-2024 08:10

240111-j2ztpaccbk 1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2024 08:10

General

  • Target

    https://web.archive.org/web/20240102154952*/https://limeerror.org/PksZxJjJ

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://web.archive.org/web/20240102154952*/https://limeerror.org/PksZxJjJ
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc55f446f8,0x7ffc55f44708,0x7ffc55f44718
      2⤵
        PID:968
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4832
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        2⤵
          PID:3388
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
          2⤵
            PID:1188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
            2⤵
              PID:3164
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
              2⤵
                PID:1932
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                2⤵
                  PID:2164
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1936
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                  2⤵
                    PID:2948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
                    2⤵
                      PID:1056
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
                      2⤵
                        PID:220
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
                        2⤵
                          PID:2940
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
                          2⤵
                            PID:5752
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                            2⤵
                              PID:5840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                              2⤵
                                PID:5832
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                                2⤵
                                  PID:4524
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16059746255609241100,13248390014824466663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6020
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4064
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1544

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    efc9c7501d0a6db520763baad1e05ce8

                                    SHA1

                                    60b5e190124b54ff7234bb2e36071d9c8db8545f

                                    SHA256

                                    7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                    SHA512

                                    bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    384B

                                    MD5

                                    c77abe335f3fcedccf051855da192312

                                    SHA1

                                    f2b19068bffdfe84711c417cd531bdc49375d414

                                    SHA256

                                    e62c6f0a159df8a94a0624d9f711cd72c67800c2643b2d9e3ec2f143d68895f5

                                    SHA512

                                    90b986e21bd5d7de2d0e07481477627251083c9c64c337898b8c60958272001a6c44e82408dab2e14f4ec106977acdbfa517152ae3a976c8b59cc5f0650033f1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    456B

                                    MD5

                                    f00ad68713c10b68baa7468c215e9615

                                    SHA1

                                    b3cb20434d3213338afaf28297a1eb9f74fdfc6f

                                    SHA256

                                    3c9f3fbd8ed20a85dd3929453c053c1b804730cbbae72d7dbba9f7b24dea39fe

                                    SHA512

                                    31a45da3e86c576d6d24df41764245f3c9113a68b72f88d5de771c4a7745465c2c1d6035b14886637d32b3712f9c97d4a0ff0c4c78d801bccf2119b2de193363

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    480B

                                    MD5

                                    44489b4cea8a1fb79fc9154ae722aaad

                                    SHA1

                                    baeef68ec4af1c9558947c6e619d3cd486d616ba

                                    SHA256

                                    18398bf7d6af9da4ec1085903bfb9b30f715f82707d2c5915fbc316e7d510398

                                    SHA512

                                    7bfb4ccd195bede7e6b49337d2d5c7d5efb0b0dbb4699a9a7b2413653ad55aa52e70680b45be5b5294a761dc9aee673265861eb2823db5645f9957420aee2e41

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    111B

                                    MD5

                                    807419ca9a4734feaf8d8563a003b048

                                    SHA1

                                    a723c7d60a65886ffa068711f1e900ccc85922a6

                                    SHA256

                                    aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                    SHA512

                                    f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    650B

                                    MD5

                                    95869ce8dbf2f1f00215680594626d3b

                                    SHA1

                                    5333c13c1881619fd07a56fe3a86b44760f26a3c

                                    SHA256

                                    6d8db81a0c682998c4e8bc96c670153920df9c37cc33b7ca043ee981138c6595

                                    SHA512

                                    204f5b7c97d2d77ce516b9e27cd94dbb67fd9a8806dfb35d051aba0f995f8e4764294177f55cf961217757c9df3286829e2c20d3be8b22b8708c0b65006e19f9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    570B

                                    MD5

                                    c7de683c909239f7c47a8cc71e080089

                                    SHA1

                                    562fbd6858baaf2d9b5b15d09cbf926b9a0b65c2

                                    SHA256

                                    3442e504b4e0ec2c3965cf488218953ba992c4a1660d7125f3a78df6f5c993cd

                                    SHA512

                                    54284fcdcdc74b8205ccaae415254627e7a11bd170b091b1a9ea4941756a18aa3adccfaea700fd2ba828d70301c13be9cd7131c2f24b2cacf119d47906cc672b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    76c7f0ccad80fa357cbca1ccfe5b6abc

                                    SHA1

                                    f569a12210c22b6c38bdcc3e2e9a0a4cfb9cc596

                                    SHA256

                                    dccb8b70d6f52258c8a246541991347f103ab28c69b2efe0ab10c601e8cf845a

                                    SHA512

                                    d32ce0294a4024980c06b48eba811822b82cc5ca2b5dd1593cdb0ce2c473b9a5d9934064e24488a300cd1fe2cfbd9ed8eff670dff778494d57cd274a0f0b7553

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    48ba6b3d5855390156982597c844220e

                                    SHA1

                                    67ac087652fb8aa6a95d4622a0088848f820eb55

                                    SHA256

                                    0246f54a79c8eb5361fec8faf0d98dba90b51b3c36406fcd865e4e57c86076dd

                                    SHA512

                                    2efa907297e15430872df79683d168fd87b53878e698b1bbb483aeec6a9ee11fc0d7415ec7a355b91007edfdbf86be65981ee6a3decc2f9a054ae7abeec224d8

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    26364241b12a752b821a466917cf64bd

                                    SHA1

                                    938ee1d58e83646674ecb48cd934515b74c369e6

                                    SHA256

                                    2a62a99f3578518b9c2c4dac1a0383ba39c0df318904ddcaaeb64a186d5d2769

                                    SHA512

                                    b89fd45f49ba4441c1cebc6b55d0c4094ab34b8e6d7caa86f647a68b8154905dd8c9a948bc7c5770eeaeefd290974a2236233db415c07d93d3aad8ec7be8703f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    cdf44831a3290d2277fbea35b2432c19

                                    SHA1

                                    c40f10775d817fde6fddb37c3a236c7f98a93077

                                    SHA256

                                    af092118799292dd00f3f34eff47ddc1a5bbfe610e8f9f436e2903fc9081ed94

                                    SHA512

                                    b62e0b8384ca09266056152be823e11846aa14a1d11958ded79dc9c6d297d98f85ae6d0c47eb37506cd7898526820877f1d4956e6ba8a0ef58daf5450ea03570

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    9066cfebafa2ab5f476514d89845ae47

                                    SHA1

                                    1b47835760a8f02051e2e222071af5a4d6225c05

                                    SHA256

                                    3f5ae742a08b6ed29cec149a1e77806e42b06ad240cbca46c5e5e01f42bbcc88

                                    SHA512

                                    63dcbe4238e84d20c9d413c6384e0d00e8c11179c62283244cdf77112d6b6289fc296d4fad0397ddea7b9b12f48c3a8ed1ced657a5b4bc08c8789bffd687914b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                    Filesize

                                    24KB

                                    MD5

                                    121510c1483c9de9fdb590c20526ec0a

                                    SHA1

                                    96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                    SHA256

                                    cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                    SHA512

                                    b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    372B

                                    MD5

                                    c647613ea98a0a8cd40d952aa18c15a9

                                    SHA1

                                    29b574ade1c751d2ca484fd3f08a4af7f1220e0b

                                    SHA256

                                    26e2d5e2a4769cb59dcb78f2744c3bfb7a84f3e237b3c00596dee791ff3c6400

                                    SHA512

                                    6c306c789adfee4698c1696636f9c88bb71f9654e4e10c80070fc8579a2eb0c119caa7bfb69c39f56feb04ddaf964b4bad067987f4613dfb63cb805ce094a989

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    372B

                                    MD5

                                    908fcd9e5ced9d17ca894c5d2a51c6e9

                                    SHA1

                                    072aa6c90eda6603d14695992179965410d4a030

                                    SHA256

                                    db4f0dfdca17feecab0dad25230b0845701a66f13ed363bf920847888b084a37

                                    SHA512

                                    c958c83d833e61e2d83895edbd43b8abe0e62f5a9b5a9c40e38958d0bea9c5f574c077db140b01e9eaeac546528b52752db0dd55a740f48353f724309f98197c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    372B

                                    MD5

                                    6b5d4c57eaead3899fd495f7b0204f3c

                                    SHA1

                                    bb6cb23aa027d7cb622f02eefdbf615d6c0958a7

                                    SHA256

                                    a00c8466f91e706f3fd1a0d1dd95bdb285d5f5ce0969083cb9f1aadd64b8b152

                                    SHA512

                                    cae050f5d2759efa2be3f44fb5beaa903c78f0251036664b022999892c8b2c550baebd725b0975b6e0559bf062648b3268f700f344b2573e5c4babed81778d90

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586695.TMP

                                    Filesize

                                    204B

                                    MD5

                                    fbe1088afa1616dc4fe63dce4bbd53a3

                                    SHA1

                                    b9330f9575e691c5bb1675122a21ca09c604e622

                                    SHA256

                                    45f2a8b7b8f0710010b75f29ba6ad3334279e8a2f1102888126b5c0925583125

                                    SHA512

                                    8efd788b0975f991510d5792f2bfc2dcff1eeb85cab2fefbd3cb9b5f8dd74b379cae21598fafc467027a989aaef5c317f48aa47bd7f96748fa020aa74afc234b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    82ac6bfa4bbf6ae3fd8afc70d2d3258b

                                    SHA1

                                    ba40876771a45038ee7555642c5230bd9a8c12b2

                                    SHA256

                                    24c54f17edb79778f736716f3cdb3561a6e2317c2017f5b0e6cd673c1fbc0e3d

                                    SHA512

                                    1596f46481dc80d253691fc21b9550b3e48be227650e368375515cb5b2a2cdd44fbddb09168e35dc5ace891ecdba623f3e8b833ffe7488858998c9f8daa1a428

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    6b4878008b2c5fd1b90a90194935008a

                                    SHA1

                                    2aaf5cb6fe46694574fee7dc70081f7103109b6e

                                    SHA256

                                    aa14dc4cbab71afbf046e2ae2cae7a83fabe158052b47ab90834ad406126de8e

                                    SHA512

                                    85022959e99626c98be27db479b387da5e3735be9c3334284e56d406a04a2b76ec3a835227caa483385d4854020327f0e1288a5d20505177e7a7147d63ca6c0b

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                    Filesize

                                    2B

                                    MD5

                                    f3b25701fe362ec84616a93a45ce9998

                                    SHA1

                                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                    SHA256

                                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                    SHA512

                                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84