hxxps://lyndale-vic[.]compass[.]education

Analysis

max time kernel
509s
max time network
510s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lyndale-vic.compass.education

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1420	msedge.exe
1420	msedge.exe
2776	identity_helper.exe
2776	identity_helper.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4732	1420	msedge.exe	88
PID 1420 wrote to memory of 4732	1420	msedge.exe	88
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 460	1420	msedge.exe	91
PID 1420 wrote to memory of 1372	1420	msedge.exe	92
PID 1420 wrote to memory of 1372	1420	msedge.exe	92
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93
PID 1420 wrote to memory of 3028	1420	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lyndale-vic.compass.education
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b2e46f8,0x7ffc6b2e4708,0x7ffc6b2e4718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2169313527540993313,15755173989012104004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
97e9978d0c236a2e7fa19b00edfcc815

SHA1
13510321c9ea2f62c15a389b3f3e8417d1d41641

SHA256
bb3c556472fcaa9a5194f2498a49595f9e6e0ac859c8ce3a3047c8f654b6ae65

SHA512
c059c0799462fd159def21f7fd874fbecc2171a87afafeb4dffecbf75bb594a7a96a5437c1de72ee652dcb79e01e77f0f88f031e6a7610c0087746a416c3e3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
933B

MD5
89b3aa11d241d4cca94e8141e8587e4d

SHA1
1405f58871b1d907feda1daba29de78767f1d319

SHA256
d26aa224804afa9a3ffa2b851fcc67ad7c2073b3c89e8a8f7adf1526af443126

SHA512
8986f6c1bc88e4ee763d71378dd0e9a5f247a6a59d86297f69dc99f73c5e5e7f28c32fcaf4fe82d6bc176e14c69b730dbf8e56b181b357014812351f5aaff0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
863B

MD5
ff6fd6a43efe6dc2d6ccc45470c97a7f

SHA1
4353d937f2ac578880c1f297907b97bc02ae543d

SHA256
c44f65c9bb7cf3387b5960645565b60aa8ae3094aad7c2f56b663a407590135d

SHA512
648b60848e09be578640006e1011a27e76fb53809a9c507d0befc62ca2848891f858c19277639cff2d24fc796b9acf22c3708a701ff1187eee03608db605a532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7ac65efe5d8b256c686474237118484

SHA1
85e36e7b0682c262ecc267416fcac73b2b209bf3

SHA256
25e1a505cdf8909ded7eceb4183d54b3ca278c56ae00815502bd6ed0b1e4b023

SHA512
e89f70fb61c77207d63dac1946778faa6c034f544c2a465278b35db72a252cf864b6c56a2a97c321af954fb4e5b3a7ba520a96413cf4a940d47fe7e2c5f27a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab69d3f990e2db9968da7e2bdd29916d

SHA1
a68b4c3accd26a276d74df15802bbe9cedeb6ed9

SHA256
87e472b88e504600b5f0a1df2dec9eca36ce57245dfdfbd3a18e999507ac4f9a

SHA512
10ae5548d09cc3a2ff1eec9fc2931d321d20cf30c4930010f0d9312e3360b6e4668aeb2a04474c9b63b571b2fe148ff2e597452725baa7d862ec6d9161ac06e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f00060fe7f8264197720db2f2bc682b1

SHA1
b24cdaa0f34a0e8648c9413a18f7d537576b0d3a

SHA256
4b5bccc531cd256270e524ce66b18720794e286dd3d783d99b22b10e1ff5ea0a

SHA512
e4b4c8a38bb66bc9bf16af50a9bad5680a79d2658a7eab5204e50da936439b71a28ab56c48620de6a6ea63d890d60549b853a3221f23520f2a9a08eae593ad27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c0751f73b5761ace36d61976d3ae525

SHA1
a2769d50d605a4550e11a43b1ee0330994ba1204

SHA256
0fa2a335a0d9793fb9d96940953118a0888c31dad2d1595d9b99782961231227

SHA512
682362876746db214f8e5ab556c6c730409001d6a7dca5bb76e86e66b317d6b8e21a9cbbad7d625d0bcba60cee8b60b2f5ac6540cc0d38b8beb6e1f25e599641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cb2925ad718ab32d640e30491ff7fe5

SHA1
d7ed688b4f64c0381e6853018de5ec27ac5731bb

SHA256
32e04817e6c6d3e5bcf083a6a44e12adc3cf2a8f69fb82c25d098ddbf40a71be

SHA512
bcb88558286d58132ce6f655e6a09401078501b7133250ea9bb8789cacdaae6842dc3032f2293eca295c139b69040e45c69215fc2950a6d19388d91c3a673910

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit