7996193d63e20bd710428b35fc641994cef05603fbfcfe62c817f45d5443a523

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe
Size 519KB
Sample240603-nl8twach2v
SHA256 7996193d63e20bd710428b35fc641994cef05603fbfcfe62c817f45d5443a523
MD5 919f0b952be305acf5c76109e7a7b901
SHA1 70f0242d8a8fe506c109e981f55a3540cf11ec31
SHA512 bcb35791c5305522154583f016278cc4d3732720d0fd33c3aba2209ccc00826f173e6336563fe4d06889f7426a7f28c93b9fb09786fe38f8f2ba1cd66d735ac6
SSDEEP 12288:n/t6Aexe00+wICm93cJ7G8GNpcxJ2YpAJ/bxjWbyQ9CE1hobt:n/t6BUAZ3Ab3C/bVWbrCE1U
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4464	SecurityCheck.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002348d-6.dat	upx
behavioral2/memory/4464-14-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4464-30-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4464-30-0x0000000000400000-0x00000000004BE000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 957603.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4464	SecurityCheck.exe
4464	SecurityCheck.exe
4840	msedge.exe
4840	msedge.exe
2732	msedge.exe
2732	msedge.exe
116	identity_helper.exe
116	identity_helper.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4464	SecurityCheck.exe
Token: SeRestorePrivilege	4464	SecurityCheck.exe
Token: SeDebugPrivilege	4464	SecurityCheck.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4464	636	919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe	82
PID 636 wrote to memory of 4464	636	919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe	82
PID 636 wrote to memory of 4464	636	919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe	82
PID 4464 wrote to memory of 2732	4464	SecurityCheck.exe	91
PID 4464 wrote to memory of 2732	4464	SecurityCheck.exe	91
PID 4464 wrote to memory of 1200	4464	SecurityCheck.exe	93
PID 4464 wrote to memory of 1200	4464	SecurityCheck.exe	93
PID 4464 wrote to memory of 1200	4464	SecurityCheck.exe	93
PID 2732 wrote to memory of 2128	2732	msedge.exe	94
PID 2732 wrote to memory of 2128	2732	msedge.exe	94
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 1640	2732	msedge.exe	96
PID 2732 wrote to memory of 4840	2732	msedge.exe	97
PID 2732 wrote to memory of 4840	2732	msedge.exe	97
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98
PID 2732 wrote to memory of 3512	2732	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\919f0b952be305acf5c76109e7a7b901_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe" /autodelscript /htmllog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tools.safezone.cc/glax24/SecurityCheck/SecurityCheckH.exe
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee16246f8,0x7ffee1624708,0x7ffee1624718
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5624 /prefetch:8
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6426727749379616186,8533357774594162468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3968 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del /F /Q /A "C:\Users\Admin\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe"
    3⤵
    PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityCheck.txt

Path C:\SecurityCheck\SecurityCheck.txt
Size 462B
SHA256 9813a6794f7b8070b06d0b0fbd36def67f5f006cd25a6dfaa136ceb5dfea90dd
MD5 e0a270a5af0faf4ddc9aa55beee9875c
SHA1 8116d1b4d31d9da7a7286c6d3c7e58e2fcf58ca5
SHA512 93d1757c33484628b19b15139f4950db8c5020281d040d032a628b2f963b52afdb651e7a08866258c73226b0c84e5d3b92a1afe50b873f7170c7c5e7eab0662d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0e3f4f595bba30bcd0b788b9150d50f31aa75cf9d017aedfe6bae09d9353314c
MD5 998b86cd8badb8587f146ba49d2c7b0f
SHA1 bdd317295d6993d01c8cfa50b7b120bb0eaf337b
SHA512 3c46feb03feb343f8f4eda23cc16ce1e98eb59500d41f99fbfdea1acd7482543d338b28d498136001e0f47b320b7ba70a808d7a1a0479e4be876e75da560b5ca
SSDEEP 96:n8ks71whwpvWMoiVmdeHm0J+UWQyV+VDCziEwb:n8keahGWMX9+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e8812e44a8eb21c117a318fab68fcc7ae69f23129ade4ed5a52ce4df8a931afc
MD5 7d77fd313508660af0c472f041c94d8f
SHA1 323ab65dd5d70869211c3d56eafe3b7315484c0c
SHA512 9726a722477a558a66dfe1a63cddbc3e9939b1d7ea11088dd581fc338df9ed0fac325c32829b2bc79b463fca8bfae8dd16f9cd67a3e18c36a3d3302c6ac64343
SSDEEP 96:n8k8sQt71whwpvWMoiVmdeHm0J+UWQyV+VD7AiEwb:n8kEahGWMX9+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 afb4f40fc6c321caf4c09a43dbd4b4f1434a6de8fe70a6ca23b3cc1869de3b86
MD5 52740888695a74331c2a634b4bbd1c62
SHA1 e60d56f7d5451227854ea3aede6dd5b44a826768
SHA512 816cff2359331961be71e4b713b496ea0ea843639e5005ebfbf3fdedd1f80313ce99f960822835316ad0ffc967ce906029ff73ff4f8337773b1ba0035e830227
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiFe2RUoezT3z2OMDCRHqlL:A9iIxuERzA83h09RZxYYqTaOMWRHqlWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCUpdate.xml

Path C:\Users\Admin\AppData\Local\Temp\SecurityCheck\SCUpdate.xml
Size 315KB
SHA256 a3d80d6699ee006c3e537e319ef121d8962a1bdf549d0cd8270af4c86e6fb97b
MD5 a3aba85a8949440e30a23d1706e9f2c0
SHA1 3f2c82c6c02d459c8a14d551dc67ca6d1cb8a7aa
SHA512 9b5552e1d4d3d90ae03dcae31d1bb05e479beb5b2734c2fe79c7ead2e2859bbe0b08c143589156db00decf320d41861be4661aba74299a45a5e2c0624cccfe51
SSDEEP 1536:7jml64wRr5Hz5dH1xpHEshmWc8oTWll8dLcnWE5YjdEmkmvbCLQ663Hh8BZzbO:7jmM4wRr5HfpdhlcyWYnWemJsGUNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SecurityCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Size 355KB
SHA256 5ada70a633fc0c9a5fb02727484e56f96d9e779c63a63635b93a878d5b6919c2
MD5 e841cdda042325185b84f672f7e62014
SHA1 623d96ed30e409983916299f12683daff5710b05
SHA512 d0874c230ddf21025d0f24e402e21b9cdb8f7e92e268c09ab01f0677ad7ef86aa9326419289cc37717b1d94dc6bba83f8d390cd652cd1d2d939d5a9d50650bd8
SSDEEP 6144:tuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLXrqBs6eRzaMv9eKUC:A6Wq4aaE6KwyF5L0Y2D1PqLXrqB7eRBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 957603.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 957603.crdownload
Size 537KB
SHA256 47f7fe520343f5e5c51c23451cf2671933b46384cf0ba6994951780947aeda45
MD5 7f208818faa2a026890ea2a80d30a72f
SHA1 d99e563d43c1bfed9b979b85ea1b4351b66973ca
SHA512 c32b40040dc7d4edbf663efcfb6de3197a8c81d62a8a1d44ec5df2e9994b5fc2d421dbef55c3a85d6f8518b2bb6c178628fb10e80bb9740a79433bf742aedb75
SSDEEP 12288:j1hbYUuejT7SqpRp5790XyRBP/sy6aWQh6n8YjLJC3H:j1qUu2SqPx0Xg/HW+6n8OC3H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4464-30-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4464-14-0x0000000000400000-0x00000000004BE000-memory.dmp

Download