hxxp://valikio[.]com

Analysis

max time kernel
126s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
26/04/2024, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://valikio.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 1496	4036	msedge.exe	81
PID 4036 wrote to memory of 1496	4036	msedge.exe	81
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 4416	4036	msedge.exe	82
PID 4036 wrote to memory of 1036	4036	msedge.exe	83
PID 4036 wrote to memory of 1036	4036	msedge.exe	83
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84
PID 4036 wrote to memory of 4120	4036	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://valikio.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9f9e3cb8,0x7ffe9f9e3cc8,0x7ffe9f9e3cd8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,11093172513644955974,12775442180967842176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1a9c7fa806c60a3c2ed8a7829b1461f

SHA1
376cafc1b1b6b2a70cd56455124554c21b25c683

SHA256
1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b

SHA512
e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f3f6e86c8b7bdc605f5559df800bfd34

SHA1
862d05bfba760ae8adcbb509216dc18ead59a6b2

SHA256
5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78

SHA512
de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c0fb8d3e9e8bd070a583050851b7e0ba

SHA1
be81cd009bd3b3c818adc0fcb27440005ffa5409

SHA256
5969d8bccadeda3ffcb4998e00a25e71c375b1de18637f0fb356294d0ef90736

SHA512
0b86ccf0b7aee7052cf2b403d0a5cc02ddc3e51a4c557293a22fb8cc564c262c54b1ca1e2ecf19bb940a8cc969019a954c632dff05342f038f107bd108bb9d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c3557dd4232653845297317bb50fadcc

SHA1
dfe43b370899c0eb2dc7f4877188bbf66629834d

SHA256
d06ecda7a7157654a0a116ca2869e44bf772e513fbafe0b9bb5240e5b7f00d14

SHA512
72caa153b9bb46cedbd9f4bd44a9d4284c810bebbfa148982237d4ae469f462c20624660ff951abfca55203942245d4e7e44a701aca56aebcba48afe6b28e265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e659bbce1b654b3070d58c67915bdbd8

SHA1
c87c0d13972974f645447c98bf8fe965e543b83c

SHA256
db7231d730db25a790bb4ab8eb11118ed33aceef79f88ee4e7efc288a33a0a86

SHA512
113fa8a9713e9d938d9ee0e97b6baa2f59051403d842d3e5e4e4730a8ec741a3fbe2d1534d1afa95399553e16637d2afe5e100f80e506a9b129db12c9cab0a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afb754321ab288896e232fc71278eb57

SHA1
b54adf85ef1a42a1b7fdd56ac8cb02c3e5efe3ed

SHA256
f335fa92804ee542f388188203ed23d6d415e177ef458dc877226aba71fe2cc3

SHA512
b8f9b68fb2b7baa7d4aa16d390fbf650a3106decce32589da46f4e7232da449bfe5c5918984afe27506d47b87b8c980890405fad735df461109e13a5e2d395b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
322c14844979bbd6b7cb49a99782c05c

SHA1
306723c00feedce969b9195f3fe0bc94c9fe532a

SHA256
abed2447cd71aabc091c93702d2ecfc0e9b173c21de6c4cc7861518802d266a0

SHA512
c68ecd1859c69556b2496fa02566d6930c0e5316e307fd03df74bd0d4db7205c6ad51859a59671c0fadb6e1f5d93efdd81539673ed242f0fc4bffc0671b7146b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90aba280fcf88f16c4d6e57f9d95a3b1

SHA1
184e593de7e4b3d8c2e2fcb1927583a95cd1da6e

SHA256
83afdb886d8cb318431324e2aff1eeb4838e664d647cde7589c897abb7e7d9a5

SHA512
181866d4349b4a1815feae44c432f158175b9f69995927ae2eafcf19e8ab222fdea51b16992f40dc6738cf75d70d34224958460ef5c4282751ac7940a3115100

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit