d564fe6c8e7368cdc8448eb64e9316383afd27719a738647474dda95669728d3

Analysis

max time kernel
175s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe
Size

14KB
MD5

eb35de0bd0c83e1eacf05571c9a0d139
SHA1

3bb0ba733c02642cf654030e20e74e028dc1fbf8
SHA256

d564fe6c8e7368cdc8448eb64e9316383afd27719a738647474dda95669728d3
SHA512

6a39217714705e4949ab40e7d645f6c751f2b4984945a9ea6bbfa215dfd51a6d4fef6fd050856f1538b2b9014abfcb3e2f4f06ab2d5fa9e47dd20be72f3764b3
SSDEEP

384:8KakuCXYueSyaNJawcudoD7UfH82eM4moDpw3:EqdJTnbcuyD7Uv8RTDK3

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2100-6-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
1524	msedge.exe
1524	msedge.exe
3940	identity_helper.exe
3940	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1804	2100	eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe	88
PID 2100 wrote to memory of 1804	2100	eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe	88
PID 2100 wrote to memory of 1804	2100	eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe	88
PID 1804 wrote to memory of 3936	1804	b2e.exe	89
PID 1804 wrote to memory of 3936	1804	b2e.exe	89
PID 1804 wrote to memory of 3936	1804	b2e.exe	89
PID 3936 wrote to memory of 1524	3936	cmd.exe	94
PID 3936 wrote to memory of 1524	3936	cmd.exe	94
PID 1524 wrote to memory of 3516	1524	msedge.exe	95
PID 1524 wrote to memory of 3516	1524	msedge.exe	95
PID 1804 wrote to memory of 3500	1804	b2e.exe	96
PID 1804 wrote to memory of 3500	1804	b2e.exe	96
PID 1804 wrote to memory of 3500	1804	b2e.exe	96
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 3592	1524	msedge.exe	98
PID 1524 wrote to memory of 428	1524	msedge.exe	99
PID 1524 wrote to memory of 428	1524	msedge.exe	99
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100
PID 1524 wrote to memory of 948	1524	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\FDA.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\FDA.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\FDA.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\eb35de0bd0c83e1eacf05571c9a0d139_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6359.tmp\batfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ads.regiedepub.com/cgi-bin/advert/getads?x_dp_id=1075
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff87b2946f8,0x7ff87b294708,0x7ff87b294718
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:3592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
        5⤵
        
        PID:948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        5⤵
        
        PID:540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2231141601308254367,11224411566933365494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5e509118f6429d224b500961792f1cac

SHA1
a4f22362146aa16f68fa233543a74ed4aa02ecc6

SHA256
5a9c562bfdc31a3852b54f78817df51e124a13602638b51c4325b02c3f2d7cd2

SHA512
7f93a53de3aa002f494ba47d2306f82acd771fefd3b98fa254b2fdaccd762b7022614305d1e38e30cc6ece0a25697ba82b303f9dea942f5d383716f21ce16cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7e6999f0a158219ac38893cb168ea02c

SHA1
c1554056edc27508f69db747bfab9bd9d801bf13

SHA256
22a7f06548e7816c9257bedd0312dade08eccfcb259b732b44d7519ec6212a1d

SHA512
169e681a876ff212e05d986eb5753672981d4152c5e254a6c836dac9d2cd0079923e0f49d90f529df11ba5625eb65c6e33226b3aac7e73733edcbad207a2e97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
e096ec38636079b78935fcaaae7c6180

SHA1
0acf546b17229ee990e7067e662d5dd60f912421

SHA256
52b301f22c6100a8e374ff9b72f4be8d2cfeddb072bc2db8730416f4e4a33074

SHA512
6aa4443d3ba4472b846438f8407ced1f6ba854ab3f597e6e13f9b43b3f5e98b8125cb663af46a472b99a90de731e8041122fc6a8eefe6d37c191715e7b5395ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34a9725ff8f114d147478dadae3da943

SHA1
51e19abfcb2519777b9590f58ea2a29d3ed05f24

SHA256
32fcb4585bac02615822fcaed2d16eeaf944f4b6a1e48b54564c24683c582041

SHA512
40c683cba800eb74c6c29c39a80d59b2d139cb00ed9f7d16cb7f00a34c64022d2f8f34f4643ecd3223debc8d9dbe81c996c618ab28d5cf6ecf5f9254598af57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b51d5862517ed7421d0d9074a5fdd24

SHA1
67d8dd2b2471d51993a33c772073ed7f8fa9a4f6

SHA256
48cf192c275447f1adb598718d1cbabcd6b8d8e6411a76a648670214a9746f22

SHA512
087e5a113637db4ff15b60f22d8ec75e5f8e268a45615a34788713122927a4dcd50fba705eed1cc40f15d37462ae22453f832ad1fc13aa540c19e9ae0e98d63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
064ae0468247c6578884fa419ec4780c

SHA1
00dea4cde341cda5eb3b7b76885cc1891f3312e1

SHA256
aa923987049da66c456cffafe79706acc40691d9d4195ba976fbc56899a6ad47

SHA512
21a918e62026133d59703240b9d96add721a81128461a38385bb36137b3e633dbf287879d18eeee09d546f14f59fb0b3df8211abbc8515c22fbedd3f1d5b2dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
54bd17e5a84216ae4b161eb929d7663b

SHA1
1578e1fe8b945c8ca6f362f74233a16093ae74a5

SHA256
86d8099bd5afe57c1a3d52f01f7ea2201a0f21a7c3782eae3d8e072f91d35146

SHA512
24817a6de776103d238e451a7eea1da15b16f5055ba5df37625ec2f4484d93da555210b1c90b6bc580f424deb5468e5ad8fb5a1b659c09a05f03c3aad72162e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4e9151afad910fd1561bc7ecb2894a4

SHA1
a7debcdb7b6b36885b53e289abaf67986b4922e6

SHA256
5a4bd205716174004c5115f4f75d5e3d862cfec7b3419b8576bdd56a973953e8

SHA512
636cca05552197f03e942f23f3e2b27a379a0038462a8b9790cdb06d79e3bf8f11d72eea0d5dbf40674588715f69853e096070c8647fea73ca5a257a54fbf4c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6359.tmp\batfile.bat

Filesize
79B

MD5
f6e97650797d5de7ae79a577934bbeaf

SHA1
f188878c4a7bf71d3bd547e8c13ac7a3f2151d3d

SHA256
6821865e2c9dc5de823000b9e717432ca21dfb20ab2d53b32a7535b814f21a20

SHA512
7770f9277f39539b07f76c1388330c543a813ebef35137d3d1f0b6c2fabc17eed64be5267be920f89a781ea715056c5660e7a281d1a899a04b2af1b137830673

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDA.tmp\b2e.exe

Filesize
8KB

MD5
d08b21007becd4730dfe18f188e86f98

SHA1
0988a17b9ff21597c41dedbb28ec57011cbe7500

SHA256
9c3bbfff9f34ac651d5e7b4d6d3da15e5110e4a3ccd219b043dd38aee61c7c50

SHA512
a1f19590a4354ffdd4a9c70fdf06fd0bc5d72168005a6f0b40dbafaf87174af4d9118cc0358a1a1a9c6ca489d209bf8fa4907cd2d41f03de5775ef97d7f898b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

Filesize
156B

MD5
02f0e18f6110ce46cba4535acdb6237a

SHA1
13549b7938e2e97261a86f94a2baf7d066ac4e81

SHA256
d305c1568269f93daa474ed48b79b6e08d7319d50ff70ad1e52cc267ee3c8430

SHA512
90410fa2abae65649eecc0b598d58fae28a3eba7f7005a7260ca2a96acd45b1a5b7fd6eb4d5333c0801bc0853143707a2d5b7efd2745d6fa5274f9d369bbee32

Download Submit
memory/1804-21-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1804-12-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2100-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download