7afb283cce73efaa3816937eacc87b381bb66aa42db61ec1446f27e8a822a2e6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe
Size 142KB
Sample240417-symjmafe3y
SHA256 7afb283cce73efaa3816937eacc87b381bb66aa42db61ec1446f27e8a822a2e6
MD5 f6190df048bb656470ba3c4d6810dc55
SHA1 ebfded549b24e1945a0b4d81aea08740beb42578
SHA512 bcbcb3ac98a4ebc9e71d1dab0e4b6bd357306957fbd0f1670378f835d475cc69fda51cf6c6b64afb1ef730aaf05c528036e3413f4f1591abf20635a5282b6497
SSDEEP 3072:Y3IBAB0cUFFCN+6VOOtWTRAez0tGZLtY9CtQF1h2pBNL8gXhYeU5f:eIBAB0cUFFGgxVAezSGJtCtF1h2LNL89
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

motw phishing

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
18	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\Windows\spoolsv.exe	f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
892	msedge.exe
892	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 892	2352	f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe	86
PID 2352 wrote to memory of 892	2352	f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe	86
PID 892 wrote to memory of 4940	892	msedge.exe	87
PID 892 wrote to memory of 4940	892	msedge.exe	87
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 3004	892	msedge.exe	88
PID 892 wrote to memory of 1432	892	msedge.exe	89
PID 892 wrote to memory of 1432	892	msedge.exe	89
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90
PID 892 wrote to memory of 3736	892	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6190df048bb656470ba3c4d6810dc55_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccb.ufsc.br/~anselmo/12062003/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe10b146f8,0x7ffe10b14708,0x7ffe10b14718
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14482856936127969294,5971329844127252697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5716 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
MD5 8c91c8582b0c918416d14bd7eedd686e
SHA1 b2ff8149bc21144fdcec64111afda492965c6621
SHA512 a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
MD5 2579d07b98bbefadc929d80fb3dbd32a
SHA1 1ceb57c4b81f0f23500e118a4b9a225116a467de
SHA512 53522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 0132a0278c6d0d1d5a108e023e00a3ff4a126d384e900c413e44fbe0af21f469
MD5 021890e84889aaa03e5b9559feb8f001
SHA1 1c2ad1f9c3bcf95448d6d34f6610dfeeb5988647
SHA512 71380cd8245849f93f602dc4fdc749bba8b2be8cfd7214c5204e981228859f095c876665276671aea617547311c3207de0270b0b9c7aedc157bad18e13e89a2e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f7864d5f1c3ede4340e05d700c6644cf79114a0498e10ed38b786fdb1eda3093
MD5 12be0b1034bc117ac07ee388b74e3e97
SHA1 e29af611a8b9280a5d9fa1762f358a07202669b3
SHA512 b68d2068a262af46dd8ae25b7b70264ac09b915cc57cac90e42621b60023829613d45f2cbc48e83638847ded310974a143fa0b3f6b5d0cbdd24fe0a0eb04be93
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d3226d34fc0cc38e7c6010d041d59192c1edc69e5679eacfc428559d2291a4ca
MD5 96942ffe573abff9e6755158d4ee8ac3
SHA1 0551d28e258856c2fc6d0b1008193291a9417145
SHA512 3844698bfe626e05d1616466609bfe1d8b13f40b8776a9e611fe8e82d3b84b2c14f18d6d85cae4e87519f0173f6cf49cafa3df67322dd785d98432d7f9b8a646
SSDEEP 96:nokyN3F1Gw7twpvWMoiVmdeH7VCAPUWQyV+VDCziEwb:nokyjkw7tGWMXkAPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3a55990c207a7a2eac6d729de02c3f468eff4d269bb10cf7f1754cf6552009ef
MD5 2849916441704254c4905bfd3fea62bf
SHA1 cafdcc2718c41f23eb3493d49cc894a4ea459a5d
SHA512 17794c609ba91acf18a3d483b621ec597b955e34182e50cfa681cccfe810365f252d627b55de047807646da1dbd2fbda8d56ab71da7220d7720cfb08048b646a
SSDEEP 96:nokyN3F1GwOztwpvWMoiVmdesluCk1aG3NGjoGIq7IWCAPUWQyV+VD7AiEwb:nokyjkwOztGWMQuXFaeqiAPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

faa323b4-d4f5-4f71-8fdd-6af28e307405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\faa323b4-d4f5-4f71-8fdd-6af28e307405.tmp
Size 11KB
SHA256 5a7e8e8defdeb3dc490020fd5e3b7d02966b1b2b4bf97b2ee9e15564562095b2
MD5 279c88fa202b29dfbc3eb93833a3e331
SHA1 0c253afa1e9f7b56ec170aa766ceaa8e80db6288
SHA512 c58f7fe0c8c746d8d416f77f9c5358d14432725e34c3b9a8cebd74382f4ead9d95af92987c939c926243b92ed43053b6cff165735736ec0d59f777cc4ce8e85f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphLve2RU3K+uCXdP4M+olzj:A9iIxuERzA83h09RZxYl4r9NAKO4ULJy
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\spoolsv.exe
Size 475KB
SHA256 cc3cbe565156d3e53511579ba42448301bc9ba795ee031e09c7932fbc54532f9
MD5 4a1492b2ccd2b5408872492cafa9f758
SHA1 af077d4d897bee179ddfe688246c2f6976518ae7
SHA512 106ec78ff0edbe81e63e9a79a13c88dd9b1ff0e40e33198362762e235f20b840005969d276cbc807d5c048c933e3eb6f63f3409bf5a0b0edd44052961a5d8b34
SSDEEP 12288:Ocbug9L836VosmVQJJuDtsSHunXaePG/YFI:7L8qVosmVQJADtsSHunZP4YFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2352-42-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2352-0-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2352-2-0x0000000002210000-0x0000000002211000-memory.dmp

Download

memory/2352-1-0x00000000021B0000-0x00000000021B2000-memory.dmp

Download