f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214

Resubmissions

13-01-2025 01:41

250113-b4f6csskhq 10

12-01-2025 23:10

12-01-2025 22:49

12-01-2025 21:15

12-01-2025 20:53

12-01-2025 20:52

12-01-2025 20:50

Analysis

max time kernel
1799s
max time network
1801s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-01-2025 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Size

136KB
MD5

bfb932c0c15243704cf27cb8c7eff520
SHA1

8c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512

b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
SSDEEP

3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooljy.exe"	spooljy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooljy.exe"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooljy.exe"	spooljy.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	spooljy.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	spooljy.exe

Executes dropped EXE 2 IoCs

pid	Process
2172	spooljy.exe
2296	spooljy.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spooljy.exe"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250112231129.pma	setup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	spooljy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	spooljy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx	spooljy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\is.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat	spooljy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\osmuxmui.msi.16.en-us.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\powerpoint.x-none.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\da.pak.DATA	spooljy.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fe5794e3-2e59-4dfd-8a18-dbb0d6fe8be1.tmp	setup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat	spooljy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat	spooljy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	spooljy.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hr.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ja.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	spooljy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\bg.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\office32mui.msi.16.en-us.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\powerpivot.x-none.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\external_extensions.json.DATA	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\am.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lo.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat	spooljy.exe
File opened for modification	C:\Program Files\OutAdd.docx	spooljy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\de.pak.DATA	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat	spooljy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat	spooljy.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\PersonaSpy.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.HTM	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\equalizer_window.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Keygen.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_view.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ReadMe.htm	spooljy.exe
File opened for modification	C:\Windows\svchost.exe	spooljy.exe
File created	C:\Windows\spooljy.exe	spooljy.exe
File created	C:\Windows\spooljy.exe	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\index.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_browse.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Keygen.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\MCABOUT.HTM	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_equalizer.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Keygen.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\error_window.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\license.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\browse_window.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\stream_config_window.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Keygen.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Keygen.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.html	spooljy.exe
File created	C:\Windows\message.htm	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Welcome.html	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Welcome.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe	spooljy.exe
File opened for modification	C:\Windows\svchost.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe	spooljy.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\offset_window.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\view.html	spooljy.exe
File created	C:\Windows\svchost.exe	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File created	C:\Windows\spooljy.exe	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mosaic_window.html	spooljy.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vlm_export.html	spooljy.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooljy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooljy.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	spooljy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6"	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	spooljy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	spooljy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a7bd99404765db01	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	spooljy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	spooljy.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
4976	msedge.exe
4976	msedge.exe
3276	identity_helper.exe
3276	identity_helper.exe
3180	msedge.exe
3180	msedge.exe
4652	msedge.exe
4652	msedge.exe
4548	identity_helper.exe
4548	identity_helper.exe
2296	spooljy.exe
2296	spooljy.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4792	msedge.exe
4792	msedge.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe
2296	spooljy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4556	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2172	3200	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 3200 wrote to memory of 2172	3200	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 3200 wrote to memory of 2172	3200	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 4976 wrote to memory of 3888	4976	msedge.exe	92
PID 4976 wrote to memory of 3888	4976	msedge.exe	92
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 660	4976	msedge.exe	93
PID 4976 wrote to memory of 1784	4976	msedge.exe	94
PID 4976 wrote to memory of 1784	4976	msedge.exe	94
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95
PID 4976 wrote to memory of 520	4976	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
"C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\spooljy.exe
  "C:\Windows\spooljy.exe" -xInstallOurNiceServicesYes
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2172

C:\Windows\spooljy.exe
C:\Windows\spooljy.exe -xStartOurNiceServicesYes
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RenameRead.mht
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x140,0x150,0x7ffaacda46f8,0x7ffaacda4708,0x7ffaacda4718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff785bd5460,0x7ff785bd5470,0x7ff785bd5480
    3⤵
    PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3435218879741531061,15064960487364980583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RenameRead.mht
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaacda46f8,0x7ffaacda4708,0x7ffaacda4718
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,7536606169950735369,13490801824665175243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x344 0x384
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23fa82e121d8f73e1416906076e9a963

SHA1
b4666301311a7ccaabbad363cd1dec06f8541da4

SHA256
5fd39927e65645635ebd716dd0aef59e64aacd4b9a6c896328b5b23b6c75159e

SHA512
64920d7d818031469edff5619c00a06e5a2320bc08b3a8a6cd288c75d2a470f8c188c694046d149fa622cbb40b1f8bf572ac3d6dfc59b62a4638341ccb467dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef2eecfd8b9d5d9fa22a8b7a58b4300c

SHA1
0f9ccbbe964685ab241d9f87901095e5053e3c5d

SHA256
acd94d5afbd7b6ec927ff94ebb2efc03b924eb93956421472350ce519723b8a5

SHA512
f5a47c06e3da089f496878747540dcdeaca08a2e4867088226324b45c4ad18dd38fc6d16923d9501726a5919f4305a020085c128af6c033f61a259a48a0b7664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47e3d03e60d014ab2b20e3246bacb122

SHA1
4cf5e2cda1d28a85f53555ce1da1705a118e8b0a

SHA256
1a6a22a23eefb9bbc7767f6c2ee79ae7a47f0c08bf70cba7bf63b441241524c4

SHA512
7785d2a9ea47d2179a6d4c880e7e5dcc22d80f1d37875793b9bac18a2ad5e52f93c324d5b71a29b2b948ea9ff6f6a7acce2e080c259bd00aece0e1022019fd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b19b7ecb6ee133c2ff01f7888eae612

SHA1
a592cab7e180cc5c9ac7f4098a3c8c35b89f8253

SHA256
972bc0df18e9a9438dbc5763e29916a24b7e4f15415641230c900b6281515e78

SHA512
16301409fee3a129612cfe7bdb96b010d3da39124aa88b2d111f18d5ae5d4fc8c3c663809148dd07c7f3cd37bb78bd71e25be1584bd2d0bacf529fa7f3461fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
21KB

MD5
ddd23e100a6474a6e64856960bf087ee

SHA1
719a7078b66f5211032106665c77faf7eda99bda

SHA256
78aa31d0b825a124c7ca14f4fe049560d1bdd186e8cdd7785be87c1d005384e4

SHA512
c92bb45c0c4367d2a92b75bbfae381372a1cb9ed77ee66c4d8df7537eb88768a7a835f637d3b7556ec43026b88c9b3a6db4c5b57b9d68e8d446554b5faae0277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
3ab98dfcd673860805674e1451583583

SHA1
b01b9bdd9be8c00d5d87f7b40f0e8d9ba1c8dd93

SHA256
c90847e71ae111cbe8273df13bf2b954debf67404b12040a99a5f6db90ace206

SHA512
21d4187cd23ad400b75d629b7005fb681578d37ec58bc54e1004bdbea68c8ac3ec78a04ca79f2a427658a806483e59c53f5f64295c4599e64bed64a6225d1006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
af633e2271af82b1d1b7b99ccc1b2513

SHA1
d3a21c42da6a9bb28a8d0399ad1328ca79b47241

SHA256
080a818706af1b5837548c13e562cd7752e5d1e8ea857c7d167dd1137a594d6a

SHA512
0423cbb1683c8eb947f533aa4c20f6e15155ded5f7d73da11b6f9f2a0009a96246c0bea0f48c3b53c65769e5746ba3a306311f96bcd47ad357cc2bb64ef8987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c12f890ab82cc58ecaa7ec7e76623daa

SHA1
53b443808ed9170c733d2eecbf162208d4759415

SHA256
08f4a2cb5d53321a39471f077860bc9ba1c98e5992af5b24816f1b69f75b9dc2

SHA512
a2b150038dfcdc29ddecd0e3862d894a24842180981bbe9afe897aa04c9512d7cc1b44ce4ab7c96f395af0c06bb6db32cda748ae9585f8c5893aad618e1d1731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
75d26e9a92377fcf80bc06702818e37a

SHA1
fc1cfc1f9b0b8739e7064b4bb2de1af03726b195

SHA256
e8679ba36ebd783ed7f384a4fe3cfa3eb5b11da36258ed37a7a0c9b0f0956eef

SHA512
4b179d38a8be970bc5c5b5f506fff92f10303206e2d2b603adae2d3fbf70fca501565281464cb76bdedc77ce6e25b7039555769ec26e6f8b357da89045f04bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
281B

MD5
1e845a10c9dc02a6c53134b78da8a6bb

SHA1
c359decaff8f2fe0e5e2d94ed4da2ca57fafddba

SHA256
b7e0fe29b06394744e207d031e8f000ee2ea9e89ae8062206fe1addb7b6adbdc

SHA512
65ee9334b224f0993b840acfbdb0122d873378618e9546f6053b30b37d11a5c73e28bb41339c72d255c9150e0297c289267fc9a2d9ef87b2933b8fa1f1cc33e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
d4fc457be8e76126341075f6f2b056da

SHA1
5237a6e2ae4b6ee2ed06254014b7b389c7f21f86

SHA256
dad8b06c10e417ac66f8356d013fe59f59ea58de994091cabbc6b3363222b639

SHA512
9b24b076597230b60e311afd51263f26ac970bbc5a782fdebe01ee58cf0e9af2482ff52954fc0bdb7921047a3d48dadc8864da527a297d6da31d5cae595399fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
75642e4aa8896b16ffa6948ee699b22f

SHA1
a5e9a35f767115e81aa8f1aca9dfb8914dea34ba

SHA256
2cf37efa43ed6b1c64c27fd94e9644be1fe2fb1a4c7a98825fbbdd95361fe183

SHA512
f614232eb83da7d2fb32db09975f84506e74daf522a7027c64b650b087c341d52e4441a72e389510add75d284865a90cde82aeadc7f7f0611f32794b2078360f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
482B

MD5
c6dcc4055a4f78e0533664bcef22c9b9

SHA1
0ccc2f703d6aedadef161ad13b1ff129cffb8537

SHA256
75fd1d41a2e8a6f4d057492b15a238ace30fbcbb36897288a7eabb6625c073bb

SHA512
4613cd3390312587980e263eac46e9fab5fe9db766b3ef039e8cd8f7a93414582b5413b35eb7e68579ca50dc13047a345ad4f91b42dc130ca323003979f98fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
20KB

MD5
fb37f038d0742a0fa5977bbfc0e9432f

SHA1
c95f9abb4f7243c49aa044e91e8a36e494308a2c

SHA256
5cfa52f457ee5fa7cdeb5a84e1413f6cbed3bf87d8898cd8209da9d0fdbb08e1

SHA512
8bbd97cfa0ec06f6f510aa10e6cfa526c84876958132aee0899e2dbc7a7615f799ddce6f34d2fe0c4588980000411355fa776b0b19c90613807909aab4dfed36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
291B

MD5
35e084950e012aec6a476433f82948d7

SHA1
212933dc7ea05a081800889e32a5eb310e070721

SHA256
e017ef5df55078d0c0ed872605593bc486b62697cc7149ee3aa6b1607ef2ca56

SHA512
6047f6e1fcdb31b909aef014ea480c4aa3d8d848ee2fa360a25a611c4792632ce18ae0fc3fd36c242c61c3ec486802fdc5a9a5faf14b68f017d5c6489544918d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
865B

MD5
88874e7d6e62320094b2f07a69d7b2c3

SHA1
9f5b15c45b694b9c217a96c517a3237644cb1c03

SHA256
e0cf8e4ae4ed1d73d33ec9659fa4d14b1af1c6adbb87e032234dc5bfd745c050

SHA512
81f19b094c0b22e250cb1ac057799df1c8b88144c88a86da204b8193033e26166388b9694a31e77df5eafbdce4a2580e253d7ae7b4c291c8e9ecab18070918e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
390cfcd9331903bd7131db3484a98147

SHA1
ce296d9a31ac1ee87cf38f924b435157204f8599

SHA256
0e00d8d1fba63b1e513c1deb9681cb0966a93fe33cb7489ef813d993231f592a

SHA512
630f7bae06b0307b9cd702a901bb0389a937b0dd6a7af30a780a9d875dbfe1647505ed495ab67e82f011309540aa95b21cb367bb61dbffe3b7d4e544ffba2afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
81f50d74f3432f838b215517336c8186

SHA1
d802f7bd96c18d3366adf642b58ee400f7040482

SHA256
588656536f046c729743924e1aa2682c199a2d4781ff46916ed309f40e939222

SHA512
b98cfd96a52cdd8c3435a2a8a01b3f7d637b2b1e2a5bddfdb9e49ad4a499de01701bb8bf4d5ffa3185ad0205b96f98522ef504a3e50947deb7bf247f6f4a57f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
66e0292439cc1230e7cf1e8530346d97

SHA1
efe55eae9e52bd4c4a4c4274a6fea06903ce4b26

SHA256
90f042f9636b23534d0b0074768d6b833283544a22bd0eb7d56ba3c524b12163

SHA512
fdf0cee32c91874b0eb09b2f1e0d8c226928e85a4c7df3abd0c0d81abaf5b8e0829e39437231335e46eaeaa7d59b1bc5629f961353e255b02d97fb6332f16294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0b97e2a1d100c16415c174215749883a

SHA1
6f1d2602692b8da72e1936fc783371e6cfe18da1

SHA256
d7f4f143297a8b2a50848d2075cac8bb7e89103965f1f99031c7b47659c21ad6

SHA512
11d788b5caae4bc4ed6455e79d7f352c3ae7c26728b38dd889f8b3f278f6d0e27b113f240fb994c8388215d797b13a638ba7f3d7fca26c4a798b7c43ff1c419a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e514ea38c7db0ed807f3853a3153470

SHA1
d6d83eab14a294cd349ca99ffb58df3427216b63

SHA256
b5cebe7d1abc1056bd0780b0ca94b45062b5f75bc99b3b32f15f85b76016e02b

SHA512
e201d1db446352dcd9e4e4956a90555e2101b4e89be75f0050938c21cc653ed181e7ed96ac69a6ca1020cdd462c14347f01dd8f180dd11238b9bff5192b2dc7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fff7e478b82f710661b6d0f0bd771c55

SHA1
0b5575a560ee34e6989b6d973d89e4eac08a6580

SHA256
6305437f2b780063394ade763b9b422a96be4c9df389500eb089f0941d0138ba

SHA512
28892f493f163b7478d2a11615fe8aaca625b18f5a8afcf0ba7579a1cee57396ae422d620952f2ca64209308a146a97eb0f102d81fabca4e4212caea24cb8bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
54c00da93463246a909745e53a658c80

SHA1
0a53fe69264d2952e8d488451ce004a13783728c

SHA256
9026bc63ef44bc8bc1b27f13c337d43957e77250ad67555c02781d88361d1685

SHA512
b478ef3d947056d50f53faf0dc9c30f36716622b5940d3a336f1bd24f2160568a75a66969625141beaf43041104f567841b7f727c0fb40371630378e51266915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab4d8736c67becdb472881248bbd59ce

SHA1
9b9eec4801fdb0f5915c71115039572736a8efff

SHA256
5a7ea4ef6260ce31aba9a86f86383e7aa35c7c360b80dcb88da5e8a24c3d8f51

SHA512
cb34c7dc0b63599e0ad3129084990ad197f352db7167a88c2a79748d11681627dcc0e3ecd78f479ebc23da7a588e697def9af0aa2acec2660e2b57ffa9e8c2e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17517ac50b4bc752b4ae705928e7e3b0

SHA1
2fd959e5a7819d49268d0a4aa0fbc42982ea9249

SHA256
da39775a5c58a9b483b03885ba1060eff84d6bc2dd4fd4d1014c5504f5441d23

SHA512
7cfcaaf179a1a620b9c1d662dd2d83db06a8d9f9ec6eb2f50ce50d2b58c4fd16b2096084ff9376e3399d3f77ecde8c04983ad1442c310b4bb32068016cde9018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49464fda7d6a3deb3511ff8e00028af6

SHA1
69a08ffea1168e4733f0208ce886f1ef5926fda3

SHA256
8c83b2c661141a4b62609f10e7cd21e9b326f164f9ce87e35475664c38dd52d9

SHA512
4621e3e6a4f9eb7efbce2e34cd670f1b65d19d17d042ad3e37648b664a9be1579f5ba7207dd20881fd98f1d7855888c96cac75b30b8d1f3a8455312d8194c713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0fccc8860672f59a2be60994140fc794

SHA1
44b61d047a01c292019a2cbf8f69d0df42c97c2c

SHA256
da89cb4797e5a76ce7af85067eb758b25a39a559c3d0038afb0e32caf2263a67

SHA512
602a1cb8a1a1028d23a6419bbf70ada748a95abba344bcef56313371289d4ff8937f7546edc27c54811f7d5394469eaa2bdc86231e98d2b7f965428f005a1524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a758226ad3fda572657cdf30016aecd4

SHA1
a58f089ce916e7411714c2d21093806e8a69727d

SHA256
f3f747d075f6fa538bdf08ace9bdf9cb580fe3ef0243f46901648582925cce2e

SHA512
eb7be71fbc74c7380701fa4684f3b0d4767bf2ab05eea3789be1f04ecdcf887cbfebbee782961a4117b3dc4d0a07c51a45f4a53276b62f15f02d5ac4c528fa46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
90f0b521b8e2d2ea82dcf6a8ab93c882

SHA1
29af05374c7379074c69795e995b49fc1ce79ae8

SHA256
7000b1ff7e4cd1129cf0863a001dd0debba2f815726f86f0692a783a89241bde

SHA512
fce56f6278e8cb4bf2d2b0d617f68eda7093f4f393b7f27e886d53418dcfde2b0d51d703a8a294cb453d3ddf1aa48168184afe3d2fd5c3ad18e5b8779bfd33a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
132c24335b0cf852b610da5ab012396a

SHA1
35971610772ca98351b8e36228e7936ff5be862f

SHA256
2ab15957842f10e417ce6aab9e993f4a65a58dfe69ee0148ef95012ca60c3521

SHA512
555f47089d1b507da4c5fca4538997d9f9dcbd04986d162ffd4c28c880a7dbc9192358ac9f8ed7e2e8082a28ad2daf8779b6b04860ef1cb36d7a3fc846b37ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8cd513127214e252edf0454f329bc002

SHA1
6f47fac6be8e7331e54203a7865e86b32cddf16b

SHA256
3df220380a8bf881117c17102a5c70ae7deea18ec92e7c478df2ee904d882108

SHA512
0b6d2f2e12bb8b15175875b7118778e57475934dee0476bc3ec989c5408d1ff5cf1c2d5dce4bd980a3ef9bfee232f974fa90050171826f3f0847f9682ae7e4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ffbe7d9b2e7283f7ae3ed1324237ad7e

SHA1
2ee52d1d1e549524aa1abd2ecedcb9d4fbafaa4a

SHA256
a55cd3929ea7ed84e238bcc0723f8c3ba34fc3ede6085b635641e8cfca31af07

SHA512
6fa41727c1392a6480854d30aa4a86efb3e2efc44f73f051f895b67341f06d7d4be7e08fbf4df78a695d1143fa6fd57413f7d9177b486387c2ae9bf3a69e553d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
99B

MD5
ba92e5bbca79ea378c3376187ae43eae

SHA1
f0947098577f6d0fe07422acbe3d71510289e2fc

SHA256
ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f

SHA512
aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
279B

MD5
f987136cfce750d2915f9f8d4dcfb4db

SHA1
a28a17f69409bfe8c67f06928706888afbd80291

SHA256
d49bfa755439aca65ff2180d508f08d79a83a77482f9d3d22d810d303112e438

SHA512
d166c555234fb428371f12470be7e38be28a47fcce37ad471426447f50e9d371e061dd726747fe9a62e51d7fb1f8fca489189181bf8a2b95546a311fa3248a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13381197089880305

Filesize
877B

MD5
e5a090f11856edd3b548196b3e1929e9

SHA1
0fc8cef4da6e5ae96ca997fb1e37ac5d861d29bf

SHA256
19101d60a8e75f0263fa6823d63a18c00ad5028ef4cdb25dce5719ca81444877

SHA512
5336073ea420e774bdaa4cc1f08c0f5b68d888f2fa8477b4871be2a72014b6b519fcbda60635680ec715944874daa0e4d5f3ee7d1a254a9e5b8687433f1f7dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
822cd131da3fb308d61824f9fe67a587

SHA1
de0a8c8859eb696b252b143f9f4ee931b479e5f8

SHA256
5208fcb968bf75464a5d5ccb3ce118401e704b6f2aefbee8685da2e42028d2ff

SHA512
19e1623a2747ca40973be87fae49b9f08fd4c041e24862cd6be10176d0d6979b9bdd7ee0a0556b464179fe64c3c27a680b7e4b6de18a17ef2b4dea4807489868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
318ff0f9d4375933e9a1e4b07b35f90b

SHA1
8ccd2c18b151a81013d43d54036e0efc86f33efc

SHA256
ba113fbe22cd340215ff086bf05dda54abfe373b20e3f34e07d64da0a9fec343

SHA512
91df49f72b50008cc00ece28923ad94fae6851c52be138c5f1e19ad36b44bf731e3714c7bfd07fa9bb6bcda7d42dfeb8643fe3e1f24e3158ac059ea932833f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
22ffbb7eb0c205be7021be468f49cc66

SHA1
92be42104e0ffa19f3f8b2e51f22f157382c61d7

SHA256
8ba99771d7bae5d4aaa722cb06a780ac67a25a5399220d7e20c4eb0abce497ca

SHA512
9a8a8293d08c0daf8fc0b8bf67f61f2211709b5ec7cef5732cc97294d4e99ab1814f765c990528ed2507e61bfa656e314a5c38ab1e5dd7258755644fd615aae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
447c3f973325cbb305684e1414583e51

SHA1
63b66440011048f35d93cef043aff15a40f3d933

SHA256
be8942a9ec6ceb29934c170ece892869ffb4d935fb22a0475ec7bf4dc0dc4fc3

SHA512
b05efd5a60060f3a29021352972c4e5d622edd13d81dfe4f71bc46938cd010ff5c6285f6670aa6d4de88fccdd0b5fd80db7578ed211becec23c3ddbbe2006a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58aee8.TMP

Filesize
1KB

MD5
62e02e66869e8a8a06dfb74d4b6ee321

SHA1
44bd3790e30ca3140f8ca42dab6ae1a31901688e

SHA256
942479f3d2d2f49ea94d692a8e6c88e5b85ba70d5be434c44314fac26857468b

SHA512
75de3eca468328f2030f23119450dc0b66e3e7a12344f160c39b4de113eb0534850df1fff021c5ef315aa4cf90d2d98470155a00f0b977e78b328f48e25dbb68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
4ab62b7a40a15fa4b859fb68e7a6761b

SHA1
6ca36c853f4dd64217cab0bd59937bba1530a515

SHA256
7f93e9d9124ed8e081c53f4b409d1c0564c26e06460a2d6cc810d7a5b22df55f

SHA512
69e22e1508cbb2651a360c8532cc52aec4bc48f8f6b988548a70f7da147398febe844206733795ee3ec30186da7bd096c2ae859cbc36aa443409bacfbba3ef85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
9799920c1ca0b54a411291fb11932c7c

SHA1
76a015eeb9afe54a8cda9ddc72536db78b061578

SHA256
3c02398d84c8d4a0ada2945148584742d5da8ce51663a3f06903dab0ce213a08

SHA512
a18c70442a67c92dfedc68d9c694f9852d2954a5252ec733efe06bedab2a338fddefc242a49c609fd3e9e3d9b319ac9bf028db42500297d75b0fb108cbecb75e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
281B

MD5
855a55855570b95e8ae0cb4caba6914a

SHA1
05618fa8490fe5ed5e9d928425488c426014b23b

SHA256
34670b886b289698ee1504d0e19568872d2b22ca454c2457cce227e6af4e2b42

SHA512
96662d8756b107b184e5ddc00777c541079ac219aad0275f27af0ecbb032bf6ff7305187ecc0cead9e4530061adc87ecd0362e537b83e978c777e6e7c5856a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
504B

MD5
9202d082f5248ef14d5a5a7d968ca6cf

SHA1
182769e6dee4b7556349a3a31ad4af1c6e708cda

SHA256
9a5e84016888b2670547e372b550bfcbd925028f9f658072641aa66c9c76147c

SHA512
5534e3c5e66d4fb90e858dc1532cf2962bc96720b75f56221f468bcc43817fa10235230727e8c17486166a620c5041337543fcbc45e52b7e764f87dcaf44a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
299B

MD5
afbe2c2cbad54bb5f6bb6504ec0e748d

SHA1
339853a465a8af21fbba18f13ed6d1e990d880d1

SHA256
d244ce161807a431dc9a804de8c734f83716772b422a293b22777aaa0377666e

SHA512
357f9571bd5c7af2a3fdf762e2f2bbdbfa07730dfcbd21960590d74f704b9160f980b920aa7d57b5707c16c4ce27ee1fd95f2cf4ac8fa2ca082d9e715a1fdf17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
826514fd473da731e84f816422305102

SHA1
87b10607772d4752ea13254f82332c63cf9e591d

SHA256
79026e5cafba8b98f1c3bf4945f3a23494a2e067d097f7b3e765164dff3c1045

SHA512
785764a649ef22acbf8503b6152afc36004da94daba79aaf7f8bb6caa15697112b645c1a4589517ea4dd184e86d15d615e9b6301ba2b39d5bf408936c77006df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
4455b4ad3c7ae51906f086992e7931ba

SHA1
8ed46107fd9d060f1e37f824936a977a239e85fc

SHA256
ae385b956a6cda375bddeacc4cd472ccea9a96482b0ccf0f6a9cff74ff89ad99

SHA512
f8e423fcd6ef8446040b8860df9dd54b6037de3df3f6f3a79fdd65a23d24d73fb60fa90183e6d4e23058e19c5204246bf2c70e8de9c20fc8c9a0d2b4dd11f1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
13f04ea9e4af58bb8bbf870924f7c998

SHA1
0652ce7a9ee63af8c4d15d39db4554a3c8ee03c2

SHA256
5d629cf7f0e6b2bf0f8b055b6909f4777093823c704edbceb07c60c87271f261

SHA512
3faedc713368c9032d9c2e9afdad9b54933b71c24e2953e137f30d4b607d706e5a72ca4b69fa505c1feba3edae1e8156234d347d5b479cfaf0089f05f0ba9786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index

Filesize
256KB

MD5
612c9308aa92d6281fb855a99ef02f68

SHA1
dcab69404042c20541f5f1f6978a022e378b4a2c

SHA256
b9c26faaa1f82ddbe8dc12a3a51c937640d54ac23a892c8a7f2ae618c20821ad

SHA512
0341e6a162c58e7278c934a9c156eec2055297e810a5d41854b1616770d78de39101243a53232abe07e7dc09cd0617d3ec3a3ce161b495ae48d0d0182010fe98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fe5e2b11e632cf6f6c2c459a579db62a

SHA1
4bde61e80c709cb8a5b9cddba4b644d0e9f8c205

SHA256
aa77d07295888426eeba5ef93f021c80e562dd9f637cbec078e8d1387908ba7f

SHA512
bf16504534ea2d2bc9ecd7caed82982f3df2053ff46ab77653d249d881957636b6487738509e708845e1ef959721787295a1a414c02a526ba0ca90ed006a34cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
755730884cacd1fcbffb7af3d17558b9

SHA1
32d912d97e758e9014fd6e473d26a00fa13d09e9

SHA256
379e4878953bc0c3a36af91da9eae5d863144eec91766825ad1f4609f6d1dd87

SHA512
83809ab032d554bf48c95894a75befebb89d79104bb39a7ce6b33851d5b921c34433a9884d49e8a9a2c27d7efd3bbfbafeb9137de52136ecefc9bf8f490914cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9920bf7e996368023c2e776290bd7b54

SHA1
e2a6a174daee56ddbd6e4087b24e202511e6827d

SHA256
a7e4d519181e69021868a52fb7a06cd2a06c4b502982ce92882c61f0cd684e21

SHA512
98e740552fca90a7e48aec087dcd08a60c3b0c41fc0338a8dac1c12a3f1b5d17240ee4518eabfb32618bbbeba267614de74a744bcd4ccfd8609ba6da365b0cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
6a3a60a3f78299444aacaa89710a64b6

SHA1
2a052bf5cf54f980475085eef459d94c3ce5ef55

SHA256
61597278d681774efd8eb92f5836eb6362975a74cef807ce548e50a7ec38e11f

SHA512
c5d0419869a43d712b29a5a11dc590690b5876d1d95c1f1380c2f773ca0cb07b173474ee16fe66a6af633b04cc84e58924a62f00dcc171b2656d554864bf57a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Filesize
57B

MD5
3a05eaea94307f8c57bac69c3df64e59

SHA1
9b852b902b72b9d5f7b9158e306e1a2c5f6112c8

SHA256
a8ef112df7dad4b09aaa48c3e53272a2eec139e86590fd80e2b7cbd23d14c09e

SHA512
6080aef2339031fafdcfb00d3179285e09b707a846fd2ea03921467df5930b3f9c629d37400d625a8571b900bc46021047770bac238f6bac544b48fb3d522fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
1f90ddc875e15f6a65fae7179e9824a0

SHA1
79969010c0f1dc0f09d80a14a251a95833f2220f

SHA256
6a6724ab9110220af5939c1b26626cf474329ef73a2739d99cf58b8c3c084c14

SHA512
b30acdcfc4efc627959ee897d8bdcf1687d20796aa9cbeb8e748c7f1bdf887d67a7fbe13d537c3d3e6c6bc731e9e0a147dafd8cc150935172cadd76d7c0cae24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Filesize
2KB

MD5
0660bdedf0ac2c76f49710288605e9f2

SHA1
0571a118639dbf160d8cecc70e009d09a9521d97

SHA256
3e54c7079562f30e7a9b6aaedeb48e773f50194ea94f5b3d4d77107f02e3c083

SHA512
f598e860398b79d71109c016ebd00494134af9bff526dde2144fd510e4b4d46661c71d7c09326b7bb5c9ef09cf19fddc6bdf844e277492d76f48f049029c4f44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4cc8705c90b9628c721a890ef99f5a85

SHA1
2e61fe72d39ad8f6f69b80baf4b2177428dd915d

SHA256
d67dc312ebbd3a8adb14c3880f5a6ee1fafe387eb1ece607ff92d62db8d8e35a

SHA512
748dcec4854e87898250d46c1c498f8d9701a47a0d3cd2365c10d4687353f8f94ce07d02ea3a4ac5bb59af1f521a97888cee3244020b52f939d2f9e971b1c58e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
03994fb86d1e3655e41e092c34fae70b

SHA1
8168d055af03a07847e986fb6dd65119b1e3bf48

SHA256
9d3901c3e98949a58b6ac6df732adf144226c04e15b35c3a9dc1d263a9870bca

SHA512
7980e24adbb07a7dc3d2d674935f49456359ea28ef1db727599c076c44e8165c31e92fa360e3c72a115c00863f76b59377f79e1818e60d41c2786b89b900d644

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2f3ae1cc42ad14829af4e9117f7fbe97

SHA1
1bacc6e19deebf8b44f0ef5609f8f1702caedf67

SHA256
bd987a09ee8f64c35901a0b1bfd96817b742cef1de1fc73730dc61b3ea83e5bc

SHA512
f8caeac4485c4f0ee78278c5b3790ade2d76374618937f72e77f4def510513bede7050478274ff4a6b8e65f021cfbadeb200ed38b34e999492f8ebb9d5aef842

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
a02cffb03749538eb1b853d31dca0040

SHA1
efb278d6ab6fb96936016e83d497f0757e23434a

SHA256
38a97978096254cb1381b5543177e220c0bf43c6accc4bb3db3dbf75097e285a

SHA512
63b4d1853d2af995c547d245105916135d602bcfd591a116bb1bd11c90a7fbfd3dec719d0212c9ae3fb3479a946132abba478086cde68ca9707572b1fa7e0339

Download Submit
C:\Windows\Temp\MGRlesQp.Diu\message.htm

Filesize
187KB

MD5
31bb87b5c3ff0040a09b92560c7fc415

SHA1
6ec27b05f97685e4b85071889fbd7baba349d382

SHA256
04fb229c9ad4ae166e9973ecd7b2f09e5c8d997b14930582988810250274bdd2

SHA512
7fe2f98a32ad391fe2e0c7076d542c4e49db4f6a90b1a2f8d0ddf13f5f401e05849e90664f3a5cd3a264730110de1fb283295d624595d02b5fb90657a1c6c6b1

Download Submit
C:\Windows\message.dat

Filesize
187KB

MD5
77e498263723ecdebc74ea1027910e40

SHA1
dd34b3abe5d91890f3999a6570cf429bd3719b70

SHA256
d45bbbe3394170258848b1fed788e0bca84224e36f78d0f5442869bf0dbac56d

SHA512
195a05f75134b9826d4771055547065773849cd21dfa09afcbebcbeb27093e20d6b7a4047e5f03d9f47bea6a08709bcdba01e7f38d53be1ddc86bd7207a53396

Download Submit
C:\Windows\spooljy.exe

Filesize
136KB

MD5
bfb932c0c15243704cf27cb8c7eff520

SHA1
8c9e5e096e0f5855e435978b932d8ab63e859a29

SHA256
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214

SHA512
b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5

Download Submit