0562461825397e82ac413b904a6e72f82e1ed6b7c3fddc7ac02e85d7a372e51b

Analysis

max time kernel
136s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2025, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_79d1007e9250e64defa1e31e05689e0a.html
Size

55KB
MD5

79d1007e9250e64defa1e31e05689e0a
SHA1

432eed750e3935812840b8894e370d38b6f27a6c
SHA256

0562461825397e82ac413b904a6e72f82e1ed6b7c3fddc7ac02e85d7a372e51b
SHA512

75fb3686cd435e2c691c1db582da732ef68031499a8ab396e5209da3639dd50958a46de4801b8bf2fb9625bfb188d514719f75770d15d0f937cbd2692719b686
SSDEEP

768:vpGhKRcghp1Np18hKSoudNZRiZRNXINvjH06qDMs9tmnXb:Jvp1318ISou7ZUoLH06qQs9tmnL

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4328	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
42	sites.google.com
43	sites.google.com
45	sites.google.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1314408616\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_654591379\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_654591379\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_654591379\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1314408616\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1314408616\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865929386184631"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{69C7D56B-632A-4175-AEAF-7823F8DF3F3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6116	msedge.exe
6116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 5416	4328	msedge.exe	84
PID 4328 wrote to memory of 5416	4328	msedge.exe	84
PID 4328 wrote to memory of 2564	4328	msedge.exe	85
PID 4328 wrote to memory of 2564	4328	msedge.exe	85
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 4100	4328	msedge.exe	86
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87
PID 4328 wrote to memory of 3748	4328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79d1007e9250e64defa1e31e05689e0a.html
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffc7a0cf208,0x7ffc7a0cf214,0x7ffc7a0cf220
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2312,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5280,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5172,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,11905150972134931169,16382284137226647511,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1314408616\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1704714861\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4328_654591379\manifest.fingerprint

Filesize
66B

MD5
a9ad1318d1471dd1400e12e76d7a2c0c

SHA1
4fcb197b74943af818f72405ae2b4c0057bf47a9

SHA256
434cd3a6a04ec7395a5414afc841ce3757feac54a3bfe9173823a79e5751a55a

SHA512
341b4c3bb5792cbb8b092351fc0ff38a5698cc79d041fee9023fba37e7131b53de7c2b619a7b6c18e7d77973158fdfb94c8b76ecb617bace97f0c00155f7d5a0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4328_654591379\manifest.json

Filesize
118B

MD5
ffa5fcfeb00002903f6cf667e9fe6a3c

SHA1
ad765ea344c8cfd95a591da8259fe412e52d13b0

SHA256
dd0679c622258bad2e2ddaec3470297259dc68b55b8c4f4d7f2f28a378826217

SHA512
8da9b780e9bc6785efbd56b51a4decc8703c9f1d41b33469153cc0aea8190c1b6a9001128c6022756a66ee539086ad6f787da84b6b7082dc51939077365e7beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b2e7f648feb3c1fff1712cbfbeceb89c

SHA1
3cfef0b96b2fb8b8387893dc30ee6ddf92e50b6c

SHA256
4dba4aae959968a067ef8b99a6dcc63852f6e1fc68cf6c52ed36e8ec12c91395

SHA512
58f42a6018d37c81ffa85ef6d09383896edb455ced51980d9fffbd9c17f1ff7c9dfddbdbb683e229a592c281928ffb61028dcd56ddde621c9a0c7888f8e3bcb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
508d113b8c677c0953533bab71c2e204

SHA1
2dff4fc83506cd53131ca3520e34eee31d2bc132

SHA256
061023f3f6bed5085ce78b038b455465776d2d1f58d8ea2ff227a7a71ed9122d

SHA512
32b0e30c3423e81e54d86a372c52c2834007fd6276ef8aec07ae59113f546169921b258bddd9727a62f07f490483536890d3398178369d04cc570ca2bac334bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
c7c422a0b57a90ad286e4f687da6f0b6

SHA1
063b93a81c06b506ed6b6e6d67fd8b9cfb2bc980

SHA256
da0934266bab9961b71fc7508a4800136d03f99c34b498422bd3a64eaacdf28f

SHA512
44d28351e5d952bf8eebe94d7a7d995b58008e2ccccdd2d2a0f52065479010dbcfaaadfc523b4fa75205351bc35094558b7f041750d634816ac460cebc0012ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
709cea62d2b3c9a4f76c18f09b0f817b

SHA1
7638806c126ab291eae143acb52a7c78b581429b

SHA256
63b855254ba585fbfaf9fd0f8e435f8aed39f0eb464e342a7054beaef554f519

SHA512
5e2a5173c89c3e556819bbb1aee58672a6c330d566bf5b95be6128eef037b91b64d147ad54bf479121d69bb1253714ecd2e741dd1fe8791869c868e5cdaac464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
59e908485e13ff0eb4d112d6515cb38c

SHA1
eb65bd711e5b3ab69bd542b6ce6c1a50ede58e97

SHA256
449a9dc31d9bada691f5174027c5eac9b096b9084156e00470f76195d90bd700

SHA512
9a490537357c158691cacc2093d8c7f86bdd5bca8217b031139ac0da2f3b1e1f16387c897c30353f10093d181d58e965c38a9a6beae559d0f0ba86dc51282d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6954fdcaf2f3909131386025553f757a

SHA1
76f4c0cc2877d894eb55840fe671f36a439e816c

SHA256
7c7c624e898cabb70e1d29c6a6dd3eea489f136412e2a9fca24899a365087558

SHA512
4ce01cb544874e47a6a45b4c3ecda80d4c3eba983cf8affd92e671afe7d71522caf3f0a6366ab3cba15622e1aace3817934771c2789594bdf4a99f2199720449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
d48efb0ec0af147d8cb1d429977a7fc4

SHA1
e7a03b94d375baae76f00326f8bef4c76387b45e

SHA256
02d311ac983c1e25085c2a8e30987b2ccfb616b06de925937cd94e81587a52e5

SHA512
53b90b2e1e0216593ec8cb207cfacbb991cdfb5e0866a1c8629be1411870785395474e3225e880ed7ea69b2a5a92816767c8b21ab59776c1d43970b71f7ced1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
949f050d94ddb9ab0c4bee7b942e0629

SHA1
aa33c603de3f57c1dddae4a7c7a0f263791c9472

SHA256
ce651cbb6275e796516b2c2e226a54da62384810f665e2b93f16e0bc27d991b0

SHA512
9932171e7da4b8fe9b28b3913fe64acb68e42f2606ef3e25fa7422dee549ba231bd0de3ae3d5caefbf080a1c14a9815eb0ba94631b414e2aa2bafa17e141c31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3b00ffda80f724d3641db5813aaf2fa7

SHA1
9081bc3bc296d5d3f100aef46f01deff9e9a4294

SHA256
18937a4eb456ffad514173739238a50cf5445d20098953570fa051545291d4b4

SHA512
d40d82ee11045193ba1b96a1a41872c5cc0fda4780ddb7d4b8a94cec9abad3e7f7db38833d564389456cabf20f71b4532463bedc8927413ab34692db7b43b9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
617b0d066324f4ae021a60d5f5242304

SHA1
dc30ba870b90973239483c184a0c1363d55aad22

SHA256
a33e2df7dade5945ce881f0e51fc7610027312515a97fab2f5f23ef8fc8f2b7e

SHA512
598a6d59d2b559b5e483a3045804f0b6b3a19ffe08713695f867da6064656cc0f67446e1946562901cd26aec857cb0fd9c865f1c45335c412cabc3e1c159954e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.16.1\typosquatting_list.pb

Filesize
631KB

MD5
c3ec8bf0a625c2583833a3340825f1cb

SHA1
582054710a312897117128ed59ddadc983525eb6

SHA256
7d10e035e0b2e152a1fe32a92b0b34295a979f7db2269cfba69d4aaf3401b77f

SHA512
175125259eb39225d0584fa4e3c5cbfc66bd22646cf32677f0eb7514a0abeb2c08118375210a69207be85e6e7ebdd9b6fa9a967d3c4ecd40ecd514e306873c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
209173165d293e535f7d24602cf0c126

SHA1
1981e7a68711dae961a2524ce4e81bbf1d603372

SHA256
aa3426fd845f116abc5188aaf397fbc2eced1f7f3e34e1fbbe50591de957561e

SHA512
e39cbb6c29c4e0267bb494b55234578f85020bf3c288380a04978607a24c74126489baddb40956780a1bd7465b621cbb6d463cf898af231b5eb128cfb3ff6015

Download Submit