d9648725eb71fc205b8e20e0c79969cf21fefcc3fc3ef82517d465cae5bdd759

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa47fc192a5832fe2f9e36945437ca5e_JaffaCakes118.html
Size

80KB
MD5

fa47fc192a5832fe2f9e36945437ca5e
SHA1

7d3cc674f4112eca8825fe4f16c950283eb5d0a0
SHA256

d9648725eb71fc205b8e20e0c79969cf21fefcc3fc3ef82517d465cae5bdd759
SHA512

7d5f03a5f5abfc47534a2799ddc38b4eb5ed0e5f760b215d764dd66bf1e82a4eb10f4d0db9d9c28c5fb9f487b6a0835d3bba8d3b8cf2c13940f1db6ff14823e2
SSDEEP

768:5ASljxr+9odz0S15wFJc0OIvKoBFVm73xY+begRnOgR+o53ID/S:5ASivlVN+begRnOgR+o53IrS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2800	msedge.exe
2800	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1004	2800	msedge.exe	82
PID 2800 wrote to memory of 1004	2800	msedge.exe	82
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 3192	2800	msedge.exe	83
PID 2800 wrote to memory of 2416	2800	msedge.exe	84
PID 2800 wrote to memory of 2416	2800	msedge.exe	84
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85
PID 2800 wrote to memory of 748	2800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa47fc192a5832fe2f9e36945437ca5e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54e446f8,0x7ffe54e44708,0x7ffe54e44718
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6938704206127678533,4768804766969486256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
8a435a5524d202c4e5785d9a255a3426

SHA1
3bcd4909a28d8fb7e009850dd28c2f5bb73ec6e8

SHA256
2e068d3aeec02eaffe3b47eb9e8b23d14f961f191400af1ffb0aaaea80f2fdbb

SHA512
765242b6ffe912def787ccced5b7e75e832bae601e3d3a49c936a17d95d2e913487e0259139483e1f9907196aea5f8c7c8883cd8e9b61817ab5a70fc79345705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
5764c954f72f31ea94989c4d68b9f84a

SHA1
4d1e007efc5bd3b543ba084b3cfa1e810c5c1d4a

SHA256
200092f88c495ee0844539878f8e8608dfe2e9e8bf99b0198e1dce749926c90e

SHA512
6f07393211551a844e242838fe6cdbc33f002368eb4d034268e8d1685ff9984a708fd6a828b68a2803af447e6645bdd2ab9f5441991a0e6bdddd7ca16f34969a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
693b94fc340891afbfab4cbd6549dded

SHA1
56da346214e8a1598b0aafc62319fbc2ba9626a7

SHA256
f8020442982337b44d724071d5c4a1bf083847d14f7be9872b1671e86dc0eb8a

SHA512
df771a4f7a6b8e5db4bad62d70683274c84caa83a8228d6f58c1b02cdbc3550c42a5943e8f522717a2c080815151b63daa3a33b076aa2bd295dae92bfc7df44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e487542867e96efcec124325a4913e8

SHA1
82d5824b60e18b26456545df7efadc6d8ceb6dfc

SHA256
d4905151419996031eabb4e6d78376ca650dffb3f07f3d65c6966ba3d95417dd

SHA512
66616612fad0c9339972bb0fd7eeb59071cc7ecfe94b650857386fbf67c7e10947d52c1e7f06b3459d5a8f5c7b1c724f0005a1bf5b10461464612880b4f7f811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a1979ac6a5de767cf91c9caa15ef0401

SHA1
3dab9f08ddd8f8c0ce0ef480aa55231376685ef4

SHA256
c23305d23ef647e042381a08301c4b927289924bae87674c49e10b11a247422c

SHA512
926db687dc9246f461530c80c229905d0c64f72293a88be0d25bde9500043d5a8e1548a50c8bc3bb9431ccd58acbf175eeacc50def014f8ef0719b754b6b0e7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit