Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 12:54

General

  • Target

    e18f0cc290a707b689654fb92af14610_JaffaCakes118.exe

  • Size

    682KB

  • MD5

    e18f0cc290a707b689654fb92af14610

  • SHA1

    6618fbf13dae07fa8dcf6dbe6cfe2fd47dd9e83d

  • SHA256

    e31de0c7b93e99fa7b180af7cd61aa67e86e6ae0f9f2d2730e3703e791b0edd7

  • SHA512

    c16f93ac723fb3f142607ef91e2c4606f1035cdaafb59f6420a5f5be978f644773cc7defd29d4e70fe5aad5809edc00ca6a494bdc5f68e044e3a78a5225f2178

  • SSDEEP

    12288:lRgl4HcxO6/n1a5EeTaX6C8XwpgYgiZF3Z4mxxRLqjeU/D0w9I3Q5wa14:kyH21kJBCAwaYpZQmXRCV/fI3Awa+

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 9 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e18f0cc290a707b689654fb92af14610_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e18f0cc290a707b689654fb92af14610_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\rejoice08.exe
        C:\Windows\rejoice08.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1352
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\rejoice08.exe
        C:\Windows\rejoice08.exe
        3⤵
        • Executes dropped EXE
        PID:1644
  • C:\Windows\rejoice08.exe
    C:\Windows\rejoice08.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4520
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4520 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=3004a
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=3004a
            5⤵
            • Drops file in System32 directory
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of WriteProcessMemory
            PID:4156
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd77f846f8,0x7ffd77f84708,0x7ffd77f84718
              6⤵
              • Drops file in System32 directory
              PID:3280
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
              6⤵
                PID:1520
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                PID:4200
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
                6⤵
                  PID:4236
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
                  6⤵
                  • Modifies data under HKEY_USERS
                  PID:4772
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
                  6⤵
                    PID:316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                    6⤵
                    • Modifies data under HKEY_USERS
                    PID:1636
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
                    6⤵
                      PID:1192
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
                      6⤵
                      • Modifies data under HKEY_USERS
                      PID:4460
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                      6⤵
                        PID:1484
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
                        6⤵
                          PID:1948
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9636082171515651838,11623837254349748533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
                          6⤵
                            PID:208
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                            6⤵
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:3436
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff61e415460,0x7ff61e415470,0x7ff61e415480
                              7⤵
                                PID:2316
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4520 CREDAT:82948 /prefetch:2
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:4920
                  • C:\Windows\rejoice08.exe
                    C:\Windows\rejoice08.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2496
                    • C:\program files\internet explorer\IEXPLORE.EXE
                      "C:\program files\internet explorer\IEXPLORE.EXE"
                      2⤵
                        PID:228
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:2276
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1600

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE

                          Filesize

                          719KB

                          MD5

                          d62319fb4e8240d7d814817bc6fc9deb

                          SHA1

                          5569166e733fe54058864a18e7c53d8208f89621

                          SHA256

                          077ac2671ba6bff28798f0da650a271b4c368ec9092ea0a9419d9b6d6d91481e

                          SHA512

                          2a2c48038323f81f96963bc86f88badf69c53683393b5c3b8ac1d5ab8a09cc058b732044130cd95b45f7e0806a453e496f398690f3f59ebf1440b9b805e3173d

                        • C:\Windows\SetupWay.TXT

                          Filesize

                          26B

                          MD5

                          da51a02ee0a26e12ce7328f52cddbd49

                          SHA1

                          1c6fd79a2879cd78ec4c6c124f5a96ddeadfa01d

                          SHA256

                          887061a11ce6b2b9e76b17b3b28a17096283a91ee89a2a7871e52dd8921b770e

                          SHA512

                          aeb5e1f8c6e6c12663becbae5cfd30a4716aca7064794418092361f8cd8058ed28e81224a49cfd83be0c0a3bf9de3269d5e816025040100ad7de13a1bb8e30ab

                        • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                          Filesize

                          4KB

                          MD5

                          da597791be3b6e732f0bc8b20e38ee62

                          SHA1

                          1125c45d285c360542027d7554a5c442288974de

                          SHA256

                          5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

                          SHA512

                          d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

                          Filesize

                          41B

                          MD5

                          5af87dfd673ba2115e2fcf5cfdb727ab

                          SHA1

                          d5b5bbf396dc291274584ef71f444f420b6056f1

                          SHA256

                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                          SHA512

                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          3KB

                          MD5

                          22cf8659a0382d55baf32761a593dc61

                          SHA1

                          c18628de976a4c99020acbf44059317cab0425ea

                          SHA256

                          f37e43e76aefca1c482f00e58adbf6ea5430344dc04aa38ea4d72eff9cd9e697

                          SHA512

                          2d278078e5c2939681bdad074a5244de8b48f20f4f8ec8d4690cab3c2e4fdef09086487b9ba06fd857e5d9116a9b376bf4570e5b065e9a0a36f1e21a8d23b6ad

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          dd6d5614738b4b24345164a2ef6058a1

                          SHA1

                          e39d2489f589a2c22306dd4e58703520a9b6945d

                          SHA256

                          de8badca98415119a24c0752a2adc4b00f73e5ce3b8b29f046e76b5a73a3d145

                          SHA512

                          90b3870c57b4fc7e2f1468f05dff248cf2af6923f8802117ab92ca14965bcfeacf215a2cd309be706158644e7994e09fcdb248154b6103d9a54fbe88d3e9b574

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          6356cc38f016f39f6bb2dd08e0cfaf4e

                          SHA1

                          676a342514a540964fb5f33aaa04796d06a3ae96

                          SHA256

                          52dda351f759f2fa0dd28f54d0ce1cfdf8fa8e5b40620ac0582d1b745211cc13

                          SHA512

                          a0f0728e8e5e6345bf34af6c64153ae7a19ca5c0f3f1d1b897032ed768121d07196088b566d844a8dd5ebbb91d9ae51ccaae42cd323367db1d3e168b066c1e36

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe579839.TMP

                          Filesize

                          3KB

                          MD5

                          c003441be9409bd00eb6c2903ee50688

                          SHA1

                          56bc83b9c07c4467e6f5a0900b58b0a1cc32649b

                          SHA256

                          d7607613d1d97008e2bfebdf6653ba1d31cd97b6e0222f5900c6add51e59ecc2

                          SHA512

                          7551ea4ea4c975df848c320e6c2ede31db71e345edb69b15ee4d054003132a55a631e9ee888884e7d0c690f72ec62be9f5038650f0418e72ab39adf2af9faf15

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                          Filesize

                          24KB

                          MD5

                          8989173895c38e1ac28b64e99927f922

                          SHA1

                          c75185a5e1dd79f81a8096aae23a7ed81645be68

                          SHA256

                          b067019730fa9434b27a1fa6de922228396ab4b11dba7df88d5b8fed8dbf88de

                          SHA512

                          3cc167a0aff690dbbd2ea8a293533fc0b895301ea8931ed297469dda1c07b578bf45452ed2e3f9b60588973ff1ef45bc7bf254efce70785a685567076af9501b

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe57c0c0.TMP

                          Filesize

                          24KB

                          MD5

                          1a04cb2d6d1547da81546403d9791d71

                          SHA1

                          37cf4c0d24d5f1fb882b3b0e8c33a0bd59a5a3ae

                          SHA256

                          6ff8ad2b1788ed5416a987159184896d982a0f92e00479d5eab3704fe6ba4f2a

                          SHA512

                          882c1677a5fd0f9223e90829cf058f91d8ea0567b59b6d85e109ca95864bff10bcedf11c354b512ec4cb0d3124d6152d3a6e2c1e34bada9c5bc554f5698c2300

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\64a203c8-77b2-4e7a-bfeb-307983dd2f39.tmp

                          Filesize

                          111B

                          MD5

                          285252a2f6327d41eab203dc2f402c67

                          SHA1

                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                          SHA256

                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                          SHA512

                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State

                          Filesize

                          59B

                          MD5

                          2800881c775077e1c4b6e06bf4676de4

                          SHA1

                          2873631068c8b3b9495638c865915be822442c8b

                          SHA256

                          226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                          SHA512

                          e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\c8092620-e3a6-4ea2-9cf1-07a90fe904c0.tmp

                          Filesize

                          70KB

                          MD5

                          e5e3377341056643b0494b6842c0b544

                          SHA1

                          d53fd8e256ec9d5cef8ef5387872e544a2df9108

                          SHA256

                          e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                          SHA512

                          83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          206702161f94c5cd39fadd03f4014d98

                          SHA1

                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                          SHA256

                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                          SHA512

                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

                          Filesize

                          8KB

                          MD5

                          cf89d16bb9107c631daabf0c0ee58efb

                          SHA1

                          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                          SHA256

                          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                          SHA512

                          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

                          Filesize

                          8KB

                          MD5

                          0962291d6d367570bee5454721c17e11

                          SHA1

                          59d10a893ef321a706a9255176761366115bedcb

                          SHA256

                          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                          SHA512

                          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

                          Filesize

                          8KB

                          MD5

                          41876349cb12d6db992f1309f22df3f0

                          SHA1

                          5cf26b3420fc0302cd0a71e8d029739b8765be27

                          SHA256

                          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                          SHA512

                          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\cb005bef-4385-4aec-9e8d-9a8ae0787118.tmp

                          Filesize

                          10KB

                          MD5

                          36566da3e08387d835ae3e2ba4cb6f6e

                          SHA1

                          128b0dd17efda9da5b291619d4f777ba89405a23

                          SHA256

                          ab5be60282564c3c7ec329d9817e40da29408a09aab1fe6b72445be979daf351

                          SHA512

                          ce382084e33207171e8497b5d3482f7b0565a3c019e825c739332bf6243c7e187d9d3fc90c70c81f4f202171667e3695f5abaef4238324e71c7ede9b709fb6a6

                        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US

                          Filesize

                          17KB

                          MD5

                          5a34cb996293fde2cb7a4ac89587393a

                          SHA1

                          3c96c993500690d1a77873cd62bc639b3a10653f

                          SHA256

                          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                          SHA512

                          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                        • C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

                          Filesize

                          402B

                          MD5

                          881dfac93652edb0a8228029ba92d0f5

                          SHA1

                          5b317253a63fecb167bf07befa05c5ed09c4ccea

                          SHA256

                          a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

                          SHA512

                          592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

                        • C:\Windows\Temp\KnoA690.tmp

                          Filesize

                          88KB

                          MD5

                          002d5646771d31d1e7c57990cc020150

                          SHA1

                          a28ec731f9106c252f313cca349a68ef94ee3de9

                          SHA256

                          1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

                          SHA512

                          689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          c68f71ec86bd81360164115e3d6bdd25

                          SHA1

                          4ce0d5616018bcb582fc31c4d48ef74592246942

                          SHA256

                          8a081398ad34e06d3699bbfffda042468cb21901def2a8f731c788a0bcf66612

                          SHA512

                          5c019b2ad1f76a054533be8b65cfa18916dc28d4c2082db3afd3c43f88e20a54b9725a3a072587e8ae55a092d4f08af753870382a5c74df4581df6ac9e698542

                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

                          Filesize

                          20B

                          MD5

                          9e4e94633b73f4a7680240a0ffd6cd2c

                          SHA1

                          e68e02453ce22736169a56fdb59043d33668368f

                          SHA256

                          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                          SHA512

                          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                        • memory/228-43-0x0000000000EC0000-0x0000000000F6A000-memory.dmp

                          Filesize

                          680KB

                        • memory/532-46-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-12-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-2-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-48-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-1-0x0000000001063000-0x0000000001064000-memory.dmp

                          Filesize

                          4KB

                        • memory/632-11-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-0-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-6-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-4-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/632-3-0x0000000001000000-0x00000000010BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/1352-21-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/1644-45-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/2028-23-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/2496-44-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/2812-22-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/4520-20-0x0000000000830000-0x00000000008DA000-memory.dmp

                          Filesize

                          680KB