ramnit | 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
Size 368KB
Sample240613-3pgbcszblp
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848
SSDEEP 6144:SWKRvtDOCzszEklyYFhaHnE1ZxFzrAXiL9a1gmjMm:SWKPIEks+OoZv/zBab
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe

Executes dropped EXE 6 IoCs

pid	Process
1896	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
1032	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
740	DesktopLayer.exe
3816	cqskqc.exe
3684	cqskqcmgr.exe
4304	cqskqcSrv.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000232a6-4.dat	upx
behavioral2/files/0x000900000002343b-9.dat	upx
behavioral2/memory/1896-6-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/3684-36-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4304-35-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4304-38-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/740-18-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/740-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/740-20-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/1032-13-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\bc0f76f2-2381-4502-ae6b-dd23e6714796.tmp	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\1b5643ec-d9b2-4091-9594-5dc31dcf7498.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d5785d41-dab9-487c-a539-7e3a73e7e687.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\21cba8b6-b6a8-44cd-9320-b1e72b80451c.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG	msedge.exe
File opened for modification	C:\Windows\SysWOW64\cqskqc.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6A5B6454-29DE-11EF-A084-C2748A3A93CE}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\9cb5f596-b177-4df6-8035-e776bf13c291.tmp	msedge.exe
File created	C:\Windows\SysWOW64\cqskqcmgr.exe	cqskqc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578608.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe57731d.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK	msedge.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px4508.tmp	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px4585.tmp	cqskqcSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	cqskqcSrv.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\55b8b142-abf1-4bc6-9e99-895d12bce643.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240613234116.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
808	1896	WerFault.exe	81
2596	3684	WerFault.exe	87

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	cqskqc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cqskqc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6A3C6654-29DE-11EF-A084-C2748A3A93CE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483950"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.last_username = "8E15851CBBAD3DFA04F8E33E349C8AD2BAED550D2960D363F55E21CAC3914A71"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029001400b10200000000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ie_to_edge_stub.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\version = "92.0.902.67"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31112717"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.account_id = "C87012B88178D73EA4C51CF29C811DE25BEC5CD54D94E21518054163AF9B72E2"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "4BCE1FE81CEA9938458CBE050C9BE1EFF716AFCCF3838EED2975D20D84D242F3"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mhtml = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\session.restore_on_startup = "D03EFD52E63E5932133A7A83FA6AD1DABE083A8DE72375AE66ECF9EBA5A07611"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEToEdge\UpsellDisabled = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_homepage = "26D14181F0E3E3C8B648EE8AE336F479D2300F24D82C997ED4223BD8EC3B553B"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\browser.show_home_button = "201AA4D916E6FABF532952782E2A226E593F6B2022A8DE5BDA822B4A838B6E39"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXcc58vyzkbjbs4ky0mxrmxf8278rk9b3t_.xml = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IEXPLORE.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids	setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000025211fa19d5026448d80ded9f423a63d000000000200000000001066000000010000200000007bea52c4aa4c57f37f4d32e5ebed684e50028a5f3a2e3420b8bfa572cd4d8907000000000e80000000020000200000007cdb64ceec55ce567df6fa313bd1379bf787a14444a0f333a5deee469194737c10000000f6a317d4c5cb9330cfc3b89d8234c87a40000000e61d9407c84b6aba854a8a3c41a654a0b45bd92188f169f60476f921cabd1fe1ba34e9701f486d3222e0b266311a44e4464e6d0f8837e04b7360aea650e83699	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.last_account_id = "3DFD580976E4F6710483AFD04F4EAECF12757A6A24B7D9C8CFBE676BF326AEFD"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\failed_count = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv_microsoft-edge-holographic = "0"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX7rm9drdg8sk7vqndwj3sdjw11x96jc0y_microsoft-edge = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060004000d00170029001000c50101000000644ea2ef78b0d01189e400c04fc9e26e	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000440300007c020000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\kmendfapggjehodndflmmgagdbamhnfd = "3EF01D7E54A5A792D5A65BB6CBDC48E7AD34EC255E3EFA4FC953CEBF9DD14DB2"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9_.htm = "0"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXq0fevzme2pys62n3e0fbqa7peapykr8v_http = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
740	DesktopLayer.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4304	cqskqcSrv.exe
4988	msedge.exe
4988	msedge.exe
3816	cqskqc.exe
3816	cqskqc.exe
4632	msedge.exe
4632	msedge.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe
3816	cqskqc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
Token: SeDebugPrivilege	3816	cqskqc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
452	iexplore.exe
452	iexplore.exe
1916	iexplore.exe
452	iexplore.exe
452	iexplore.exe
452	iexplore.exe
452	iexplore.exe
452	iexplore.exe
452	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
452	iexplore.exe
452	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
1360	IEXPLORE.EXE
1360	IEXPLORE.EXE
1360	IEXPLORE.EXE
1360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1896	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	81
PID 1792 wrote to memory of 1896	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	81
PID 1792 wrote to memory of 1896	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	81
PID 1792 wrote to memory of 1032	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	82
PID 1792 wrote to memory of 1032	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	82
PID 1792 wrote to memory of 1032	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	82
PID 1032 wrote to memory of 740	1032	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	85
PID 1032 wrote to memory of 740	1032	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	85
PID 1032 wrote to memory of 740	1032	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe	85
PID 740 wrote to memory of 1916	740	DesktopLayer.exe	86
PID 740 wrote to memory of 1916	740	DesktopLayer.exe	86
PID 3816 wrote to memory of 3684	3816	cqskqc.exe	87
PID 3816 wrote to memory of 3684	3816	cqskqc.exe	87
PID 3816 wrote to memory of 3684	3816	cqskqc.exe	87
PID 3816 wrote to memory of 4304	3816	cqskqc.exe	88
PID 3816 wrote to memory of 4304	3816	cqskqc.exe	88
PID 3816 wrote to memory of 4304	3816	cqskqc.exe	88
PID 4304 wrote to memory of 452	4304	cqskqcSrv.exe	91
PID 4304 wrote to memory of 452	4304	cqskqcSrv.exe	91
PID 1792 wrote to memory of 2784	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	93
PID 1792 wrote to memory of 2784	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	93
PID 1792 wrote to memory of 2784	1792	a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe	93
PID 1916 wrote to memory of 1360	1916	iexplore.exe	95
PID 1916 wrote to memory of 1360	1916	iexplore.exe	95
PID 1916 wrote to memory of 1360	1916	iexplore.exe	95
PID 452 wrote to memory of 2760	452	iexplore.exe	96
PID 452 wrote to memory of 2760	452	iexplore.exe	96
PID 452 wrote to memory of 2760	452	iexplore.exe	96
PID 2760 wrote to memory of 1984	2760	IEXPLORE.EXE	98
PID 2760 wrote to memory of 1984	2760	IEXPLORE.EXE	98
PID 1984 wrote to memory of 4988	1984	ie_to_edge_stub.exe	99
PID 1984 wrote to memory of 4988	1984	ie_to_edge_stub.exe	99
PID 4988 wrote to memory of 1964	4988	msedge.exe	100
PID 4988 wrote to memory of 1964	4988	msedge.exe	100
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101
PID 4988 wrote to memory of 2580	4988	msedge.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 264
    3⤵
    - Program crash
    PID:808
- C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
  C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A7258A~1.EXE > nul
  2⤵
  PID:2784

C:\Windows\SysWOW64\cqskqc.exe
C:\Windows\SysWOW64\cqskqc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\cqskqcmgr.exe
  C:\Windows\SysWOW64\cqskqcmgr.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 260
    3⤵
    - Program crash
    PID:2596
- C:\Windows\SysWOW64\cqskqcSrv.exe
  C:\Windows\SysWOW64\cqskqcSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:452 CREDAT:17410 /prefetch:2
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=11004a
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=11004a
        6⤵
        Drops file in System32 directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff4ae546f8,0x7fff4ae54708,0x7fff4ae54718
        7⤵
        Drops file in System32 directory
        
        PID:1964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        7⤵
        Modifies data under HKEY_USERS
        
        PID:2580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        7⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
        7⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
        7⤵
        
        PID:2468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
        7⤵
        
        PID:1328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
        7⤵
        Modifies data under HKEY_USERS
        
        PID:4572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
        7⤵
        
        PID:996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
        7⤵
        
        PID:1496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
        7⤵
        Modifies data under HKEY_USERS
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16282337783097177288,8545124810350403646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
        7⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        7⤵
        Drops file in Program Files directory
        Modifies data under HKEY_USERS
        
        PID:4928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff708de5460,0x7ff708de5470,0x7ff708de5480
        8⤵
        
        PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3684 -ip 3684
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1896 -ip 1896
1⤵
PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe

Path C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118Srv.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\a7258abe54185fa9651fd4c0ac03fefa_JaffaCakes118mgr.exe
Size 105KB
SHA256 54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
MD5 dfb5daabb95dcfad1a5faf9ab1437076
SHA1 4a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA512 5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
SSDEEP 1536:MOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBi:MwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

cqskqc.exe

Path C:\Windows\SysWOW64\cqskqc.exe
Size 368KB
SHA256 16571e6da1e5261d7a97e8f1bddd953dd2cb4e94cf67e378376521ef675fa6f7
MD5 a7258abe54185fa9651fd4c0ac03fefa
SHA1 7ca46de7d75de921d10cbeb07a8a91ec03cdc636
SHA512 43146037f16c74c683bdc53f7c24a0fcbb10a76821e84097910a6af72da52e611677256201d978f9f0773d8216e9d2a4b5ae4f91cb23122208acebe216816848
SSDEEP 6144:SWKRvtDOCzszEklyYFhaHnE1ZxFzrAXiL9a1gmjMm:SWKPIEks+OoZv/zBab
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 93b9708fc39976b32a37e04e5191b2f6c8db1e71579cbf0cc47440a250492ab9
MD5 977cf8fdefd0c0df29b95c47e1aa855f
SHA1 8c12667e5c929746a453ac23d27dea541432abf4
SHA512 0e39f017931fd2a05c2285bfbd423f727c76664aba70f78ea5bc3c790287db7a795876645d60ed008bc6872dbd663ca1ac3c98f93201bfe4d08f38391f94a608
MD5 SHA1 SHA512

Submit Download

1b5643ec-d9b2-4091-9594-5dc31dcf7498.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\1b5643ec-d9b2-4091-9594-5dc31dcf7498.tmp
Size 24KB
SHA256 7db36dfaf2ab66e37c85823f47d0b5f534f18273614176dad22a245259e2ede8
MD5 db13b5cb6825fc783f7bb7406f530fdc
SHA1 6f2867b988852ac7aadc47e2bf011543ee073429
SHA512 b74962538eb966000a0d7f7573338b0344c420a2c6084eff3f81ae1c6fffd06c7ab63cd0cd32c84935c4c84a9020bd8ce76967d839057860d35b1cf719e54a69
SSDEEP 768:NsWR88F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLlaSrUxx:NsWR8u1ja7Loxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

5db4c9cf-d6ae-4f7a-94af-0e9ad0ac15de.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\5db4c9cf-d6ae-4f7a-94af-0e9ad0ac15de.tmp
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 3KB
SHA256 d77b66cb70e959c8cb3a067fd1443ba7d86493cd2441f62d433b2879ac49e0d0
MD5 7a6ff8bebb40bde993c600779f67b9c7
SHA1 679571e9e6888fb5eda8281df765146bcde75b9e
SHA512 7d16cef9166cb0436e79f74e49c040f3704521a525869bcfe35288ca6460d9049e601d94223ebea08327b156356ba28fa02d62c687e33e4ff93d8df659a70831
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 4KB
SHA256 cf51bd63f71ecbea481e14b33e3370d2f362256cfbeec190c5fe23af5559332d
MD5 edeba22b63643fd6a5bca49cae8e3ce4
SHA1 92c0544d12675c0e080326351999cc8f25e6d1ce
SHA512 848662dd1d597628dffaac0b13fb79a0e21e9355b095364b3fbd4c5320c3ff64db1536f27b0a404b37d8512dce051cd62acd69b82be2acb9b378fa7b7bf08b97
SSDEEP 96:n/sjB1EtWpvWMoiVmdeHupU7PVD7AiEwb:n/gCKWMXAyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 4KB
SHA256 aaffc5e7b31bbfd8a7977c8e504ba722ce4443ff008b10d0901f2eb872c5c7a4
MD5 24d66ba1c74b0d959a30242a81745f3c
SHA1 e635895f4bbfce9e03eb5719aa7f9f2734217f04
SHA512 244964171f51f136bda5011b48e449e4e7844236febf4e29fe5fa26ebfbab54f1ab4013272fc06dbcca72d56610843c2baf659a15410793d03f96184daf106d7
SSDEEP 96:n/JjB1EipvWMoiVmdeHu7Ww7PVD7AiEwb:n/nCkWMXwWuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe574d26.TMP

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe574d26.TMP
Size 3KB
SHA256 f96b40181f976b286b1791c045755384845a2925e90ddd4d13250615fc42f750
MD5 575ec50ba6013fea3657d3f70568e7a7
SHA1 88f34dd796968d5f8e7d07bbaa07fb9c0528b590
SHA512 f6c14718793681e0778b818be7a865cda3533755930d834a887ca981c3f5ddafa6aa405f51c3a4f8baf76ceeaa42f55348db7322844d4eaf012316f53ef82fd9
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a9bbe3cf-5b2d-4a34-a8ef-2308bcafcc13.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 c966630ae99ebb891785ab2595683d74f00af78c86f4863794b18fa76069fd06
MD5 d148ff4e7f45da23326cfa90de3f2107
SHA1 b585e21b672c7fdbf446ecabd8985e279598068e
SHA512 9766420f44b421e74b4f98368c91cadda9bad53be87ff5e29cbc4f4eee1a07cc05cad673397266a0aa2aa55cf35f0b454f40db95d568263c543f99332456c291
MD5 SHA1 SHA512

Submit Download

Local State~RFe578608.TMP

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578608.TMP
Size 3KB
SHA256 8a53b2e7fdcc370ba1f1820268c4cbb5771898e18313a7a7385f0c542a9a076f
MD5 e7667cab2d3ee22b314db7c199a90fb2
SHA1 49a959f8b0d5616b0d00c4238e035822af2fb2bc
SHA512 78952c2dc7e60a9ea74efb0050eebebfe31a7e084de0589998ff4aaf41001772e62850cbf34853f517bfddbe59f9a08f27d9663771b36892c246c9fbd309824a
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bc2f4003e744eb008c887d4ac554da198d5a3c19a127e77c968927ae9fb5cdfd
MD5 0ff131b0b22303b6d81dbc5abf896e33
SHA1 ccabc586396c5fc009d5fa9fdfea8cff8e1da40d
SHA512 942d1dfbc1cb915b7838e159c54aed12f1192fbcb7008c125385dc83cd1eb80f97982ad8b617e4b209e3f693dab83c9a161f2bfed59d1dc6458cf69160261513
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

memory/740-20-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/740-19-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/740-18-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/740-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1032-14-0x0000000000550000-0x000000000055F000-memory.dmp

Download

memory/1032-13-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1792-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1792-40-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1896-12-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/1896-6-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3684-36-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3816-25-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3816-388-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4304-38-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4304-37-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/4304-35-0x0000000000400000-0x000000000042E000-memory.dmp

Download