hxxps://na1[.]documents[.]adobe[.]com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAX01TtYd9sM0soY6uRiyOJdKEc88vC86eBWNqjTCyifNIDYAmPKG6lnG1FTeB6kc79vwsCkrgZT_Qi7BA3LTrJVhQcNk6kZwJYjJQjt0TkWvBv0k50Uyi35-1gPjUBv08&

Resubmissions

18/04/2024, 11:11

240418-nagk9ace8v 1

18/04/2024, 11:04

240418-m59pvacd7v 1

Analysis

max time kernel
251s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://na1.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAX01TtYd9sM0soY6uRiyOJdKEc88vC86eBWNqjTCyifNIDYAmPKG6lnG1FTeB6kc79vwsCkrgZT_Qi7BA3LTrJVhQcNk6kZwJYjJQjt0TkWvBv0k50Uyi35-1gPjUBv08&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
2448	msedge.exe
2448	msedge.exe
976	identity_helper.exe
976	identity_helper.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4432	2448	msedge.exe	86
PID 2448 wrote to memory of 4432	2448	msedge.exe	86
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 2192	2448	msedge.exe	87
PID 2448 wrote to memory of 3792	2448	msedge.exe	88
PID 2448 wrote to memory of 3792	2448	msedge.exe	88
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89
PID 2448 wrote to memory of 1068	2448	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://na1.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAX01TtYd9sM0soY6uRiyOJdKEc88vC86eBWNqjTCyifNIDYAmPKG6lnG1FTeB6kc79vwsCkrgZT_Qi7BA3LTrJVhQcNk6kZwJYjJQjt0TkWvBv0k50Uyi35-1gPjUBv08&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe432b46f8,0x7ffe432b4708,0x7ffe432b4718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10742851161552826560,6431879360690506600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
360b41173b200f064d67dbbdbee85faa

SHA1
066cfe357f2cf9d4d9f26ca2306fd07cc51df717

SHA256
2a403d20c77ec3a93142ee6ad52491077b63d4b24c19055fcc4299ba0c1419f7

SHA512
ff828acd1d8263f70a92cd936f252651787a89ae6d53f4f1dc086c2829207179861e390ca1315f7f302e61481c9c6ef8d19c024707fa5bdf2eb1f8ab7ce3965e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
640B

MD5
a34bbf46b3e3a89c5e32e58ac815e73f

SHA1
a45a5e8ef1be5749d1d8c626c906df14a4937728

SHA256
93ed79382d1d56b8220ea43416ca470542fd8ee225f6e88226ec6f0ebcecbd29

SHA512
cfa68f23d865c9e200c3b111368c45379998da8ac980cb5be38483eb8a3fbb372285915e54d78df4f5bd3a4fe00a7609d013be8ed969671d42f994958d6688a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2742e1f21731f560fefd873da3cb85a2

SHA1
e9d91499409f1262fb58ffc53f27de542559ba63

SHA256
04f8dc1e5794d8c470975813cb23a879744ee89248d78a99b4c9079a367523c7

SHA512
ba9b5991529a3d8939d8192aeebd1dbc1a4349a94e1237dc37824d1c81a6e3a4187ac9aeb347fc330cfea70744497de43431cba410c5475082d6c35e657b4f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c669214d8fc116f89618e7da353e6bf

SHA1
d41b88d0bcccbc241f17335d8e78469b5a8dd7fb

SHA256
f476c1447a5cf659cae40d0539ca4eaa3e3bc68d45c269fd8f4d6380ea5266f3

SHA512
9f247af349e2dd926476e0904634eb892af8c953a12278ed99cb73d19713a7ef1bf74a1aa641875fda158f770ccb11068ac9a7403ff7aa453b4ef468c86bb39e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c54c447ce8a942a9096394843b14f8a

SHA1
be2e2ea03f33563e52a4fcc57958dbd875db06f1

SHA256
319ee8b852e4d6d081da3b153f7ae84ec5bedf39f08dbbbb5c21635c5af2a2d0

SHA512
2203c3c1920ca685f536cb3745fd9f06ae306daca4a6b21341f0a7d1474277503dcbb31b73607c5dad9a907435dbe99143b83a90f0e30125943601bf1d722f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f220.TMP

Filesize
1KB

MD5
654cf52800db459e163d0ca0bb1a92f8

SHA1
5d84905027878f08fcfb3c7dd1300c1178f55be4

SHA256
68407973003aedd7291e441abccc5c5f63721fba9cb20ce1f27c5cc9b9315639

SHA512
57f514edb38f525d2c0ba9e65b073118279e15986976eae565edee4790dedb3a0bed97a709386b4c8d5d11b2eec9f01e428d8b8cd1c173a40feca087837e1d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a73676bde68937dc314e19b6fa436930

SHA1
62f62c3ad0322fb604c81a7c6a74a3f7a5d0f284

SHA256
ff81f5daaa66b19cf49369b04eee9a88f54225fafb99a3b30b8b264c70e27079

SHA512
fc67988b89d555341c0608cedfd23e05f35a41de567594275b319eaaee1d3785ff8eeccc6b83e0fd207295d0228bfd7aaf99f0ee6a803d0214bbb26e8460a415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52075163762f78fad936728464c333e3

SHA1
877f954937636902b4e1340f61b72afb52d79689

SHA256
60f1d68eeac684c6b1965856bd6a6472bb82e9869a31a50292de785e5f305a78

SHA512
43ce456b98dbe1aac1238b19573df6685cfc277a0756860d19a9af9a525a2f16f1c3a32ab2ff7f65598900ca55e364972e0c9a4c3f3b6fb60ccd0966530f7e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
496a19bae895d066fd75b8362e952f9b

SHA1
b17ba4d79251dfc053679ecb14166bbfc8d2817a

SHA256
d92efbfc22b84210995adfcc2359fdefd0578087de1294c5905dfe2a9ba84e9c

SHA512
0bdfaa10553fb6f818d428c7b197e2ed9e4423baa89e205e86be03c12b1a48fff383745e4077acfb4b77c27ddd124137dbb079d05212a527872a1cba96092047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bf32913987a268857824b06a7a06e5db

SHA1
307b78a7e4fc357d449467714eacf9ddd2a5e2f8

SHA256
dca1d8e0c2b05ecb8c0820950a307c02b38e56295625aaf7f8f37f8af92777cc

SHA512
4ef48e46cfae6b3f46050499bdeb4eee2b316cc52138146212cc3ce9e0fdc19b70179e0feb2e039c53f879c597c50c3c9ef8626be2219268ea5aa1ad10995a6a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit