ramnit | 3d08f0194e417a34913be6108bbe460b931c01d5fc18fe63fd8110024442af04

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe
Size

183KB
MD5

239ba803d903e46e8936c2b2a92a3692
SHA1

bd18239891f9888eb3b6eb773997734dfc3c2f8e
SHA256

3d08f0194e417a34913be6108bbe460b931c01d5fc18fe63fd8110024442af04
SHA512

4db07d76baa5fcceb6b0936a3ddee110ebb49e851ae658ec0a5efa05bfb004134be88957c1d723da261983fe6af872d95470a2abb2191b920adc249ee6862b4e
SSDEEP

1536:YfR8PvYs+zXp171QFL8H05LrMd7foPdSiWDteYBYkx0l5dVFWuA65GWiZNIsV2BT:YTpLRQFm4rMd7foPdSz6kxotwI+2BT

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 5 IoCs

pid	Process
4200	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
4300	xcvzci.exe
4488	xcvzcimgr.exe
2272	WaterMark.exe
1608	WaterMark.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4200-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4200-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1608-56-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1608-52-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2272-46-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4488-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2272-41-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4200-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4200-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4200-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4200-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4200-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1608-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1608-299-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe577223.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5782ad.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\f7497b31-e50e-4ad3-a6ed-35a9e8786433.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe576f35.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2A5A26DB-3989-11EF-B1BC-6699275097D0}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A556195-3989-11EF-B1BC-6699275097D0}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\c74b247e-0078-484f-b7be-8df1cb902bbf.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\fccfb090-5f69-40db-b8c7-3886d7c3fac6.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\1623778a-0abb-44ad-abc2-a497a991025b.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\eecd0db9-e46e-49ef-868f-9338131940c9.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5782cc.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK	msedge.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	xcvzcimgr.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\14c04120-247b-4052-87c0-5365f8797675.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240703221121.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px34FA.tmp	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px351A.tmp	xcvzcimgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1004	4776	WerFault.exe	91
3736	2460	WerFault.exe	88

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116693"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4277473484"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116693"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116693"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4274348676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116693"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4277473484"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116693"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809650"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116693"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2A5C8814-3989-11EF-B1BC-6699275097D0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4274036010"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4274348676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2A5EEA0C-3989-11EF-B1BC-6699275097D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4274036010"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeHTM_.mht = "0"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{C89E2069-AF13-46DB-9E39-216131494B87}\DeviceId = "001800108A87A243"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ie_to_edge_stub.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXdn5b0j699ka5fqvrr3pgjad0evqarm6d_ms-xbl-3d8b930f = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr = "1"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID\	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 5c000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f80329e331e9d488483540e92ce8dd80000000002000000000010660000000100002000000027873606b2d2f2528499ba7ba616cc52147f50989836e626776ebfde9f2d8c54000000000e8000000002000020000000d1a4e8ade7a96c5eab0938033a6ca1e848623d3214d700d95b404e3769b7e28a1000000010fc571e60f7ed1f5e9eda3218f0f1584000000037eaaf640cc2208613496a1d840220fed8d3fc950318622e92f2c39ff30e7f06edad209bff5fefab57e4a9c0e70bd14f48cee7f3572620874dec13b893961ded	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\Hash = "h18SLBJP+cY="	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ie_to_edge_stub.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ie_to_edge_stub.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr = "1"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\session.startup_urls = "1F27196D7A447928B6D5F10280F68C55257A82CF64571ACC6903503D04DDEA9C"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\Extensions	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Flags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge\LastStubPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\BHO\\ie_to_edge_stub.exe"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e80707000300030016000b0014006b0300000000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\ProgId = "MSEdgeHTM"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge\LastStubPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\BHO\\ie_to_edge_stub.exe"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2272	WaterMark.exe
2272	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
1608	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2272	WaterMark.exe
2448	msedge.exe
2448	msedge.exe
4220	msedge.exe
4220	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe
Token: SeDebugPrivilege	2272	WaterMark.exe
Token: SeDebugPrivilege	1608	WaterMark.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4800	iexplore.exe
4800	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
3940	iexplore.exe
3636	iexplore.exe
4800	iexplore.exe
4800	iexplore.exe
4800	iexplore.exe
4800	iexplore.exe
4800	iexplore.exe
4800	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4800	iexplore.exe
4800	iexplore.exe
3636	iexplore.exe
3636	iexplore.exe
1836	iexplore.exe
1836	iexplore.exe
3940	iexplore.exe
3940	iexplore.exe
3456	IEXPLORE.EXE
3456	IEXPLORE.EXE
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
4736	IEXPLORE.EXE
4736	IEXPLORE.EXE
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
4200	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
4488	xcvzcimgr.exe
2272	WaterMark.exe
1608	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4200	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	82
PID 1824 wrote to memory of 4200	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	82
PID 1824 wrote to memory of 4200	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	82
PID 4300 wrote to memory of 4488	4300	xcvzci.exe	84
PID 4300 wrote to memory of 4488	4300	xcvzci.exe	84
PID 4300 wrote to memory of 4488	4300	xcvzci.exe	84
PID 1824 wrote to memory of 1392	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	85
PID 1824 wrote to memory of 1392	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	85
PID 1824 wrote to memory of 1392	1824	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe	85
PID 4200 wrote to memory of 2272	4200	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe	86
PID 4200 wrote to memory of 2272	4200	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe	86
PID 4200 wrote to memory of 2272	4200	239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe	86
PID 4488 wrote to memory of 1608	4488	xcvzcimgr.exe	87
PID 4488 wrote to memory of 1608	4488	xcvzcimgr.exe	87
PID 4488 wrote to memory of 1608	4488	xcvzcimgr.exe	87
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 1608 wrote to memory of 2460	1608	WaterMark.exe	88
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 2272 wrote to memory of 4776	2272	WaterMark.exe	91
PID 1608 wrote to memory of 1836	1608	WaterMark.exe	99
PID 1608 wrote to memory of 1836	1608	WaterMark.exe	99
PID 1608 wrote to memory of 4800	1608	WaterMark.exe	100
PID 1608 wrote to memory of 4800	1608	WaterMark.exe	100
PID 2272 wrote to memory of 3636	2272	WaterMark.exe	101
PID 2272 wrote to memory of 3636	2272	WaterMark.exe	101
PID 2272 wrote to memory of 3940	2272	WaterMark.exe	102
PID 2272 wrote to memory of 3940	2272	WaterMark.exe	102
PID 4800 wrote to memory of 4736	4800	iexplore.exe	103
PID 4800 wrote to memory of 4736	4800	iexplore.exe	103
PID 4800 wrote to memory of 4736	4800	iexplore.exe	103
PID 3636 wrote to memory of 3456	3636	iexplore.exe	105
PID 3636 wrote to memory of 3456	3636	iexplore.exe	105
PID 3636 wrote to memory of 3456	3636	iexplore.exe	105
PID 1836 wrote to memory of 2848	1836	iexplore.exe	104
PID 1836 wrote to memory of 2848	1836	iexplore.exe	104
PID 1836 wrote to memory of 2848	1836	iexplore.exe	104
PID 3940 wrote to memory of 4228	3940	iexplore.exe	106
PID 3940 wrote to memory of 4228	3940	iexplore.exe	106
PID 3940 wrote to memory of 4228	3940	iexplore.exe	106
PID 4736 wrote to memory of 5012	4736	IEXPLORE.EXE	107
PID 4736 wrote to memory of 5012	4736	IEXPLORE.EXE	107
PID 2848 wrote to memory of 4284	2848	IEXPLORE.EXE	108
PID 2848 wrote to memory of 4284	2848	IEXPLORE.EXE	108
PID 5012 wrote to memory of 4200	5012	ie_to_edge_stub.exe	109
PID 5012 wrote to memory of 4200	5012	ie_to_edge_stub.exe	109
PID 4200 wrote to memory of 1616	4200	msedge.exe	110
PID 4200 wrote to memory of 1616	4200	msedge.exe	110
PID 4284 wrote to memory of 4220	4284	ie_to_edge_stub.exe	111
PID 4284 wrote to memory of 4220	4284	ie_to_edge_stub.exe	111
PID 4220 wrote to memory of 1520	4220	msedge.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\239ba803d903e46e8936c2b2a92a3692_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 204
        5⤵
        Program crash
        
        PID:1004
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3456
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\239BA8~1.EXE > nul
  2⤵
  PID:1392

C:\Windows\SysWOW64\xcvzci.exe
C:\Windows\SysWOW64\xcvzci.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\xcvzcimgr.exe
  C:\Windows\SysWOW64\xcvzcimgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 204
        5⤵
        Program crash
        
        PID:3736
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:17410 /prefetch:2
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10066
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10066
        7⤵
        Drops file in System32 directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffdb9d646f8,0x7ffdb9d64708,0x7ffdb9d64718
        8⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        8⤵
        
        PID:2748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:8
        8⤵
        
        PID:1684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
        8⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        8⤵
        
        PID:736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
        8⤵
        
        PID:1764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
        8⤵
        Modifies data under HKEY_USERS
        
        PID:5160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
        8⤵
        
        PID:5172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
        8⤵
        
        PID:5428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
        8⤵
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7309856293026279563,16164938029224524620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:8
        8⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        8⤵
        Drops file in Program Files directory
        Modifies data under HKEY_USERS
        
        PID:2324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff78faa5460,0x7ff78faa5470,0x7ff78faa5480
        9⤵
        
        PID:5952
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4800 CREDAT:17410 /prefetch:2
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10056
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10056
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb9d646f8,0x7ffdb9d64708,0x7ffdb9d64718
        8⤵
        Drops file in System32 directory
        
        PID:1616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15363974819406455598,4140969535946908796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        8⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15363974819406455598,4140969535946908796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        8⤵
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 2460
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4776 -ip 4776
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A5C8814-3989-11EF-B1BC-6699275097D0}.dat

Filesize
5KB

MD5
3b73438723700398f4b716befb0e9fad

SHA1
1eff0afa410ebfc462dff386ba837dd97ebfda61

SHA256
252ce117807883a8e6d33386896fea2a3ad671eb81c1b370b7c3642dfea6a448

SHA512
139d6c064baafdc34b2390ba63134e4df0b690bd514d969a52843dc0dacfb357c1f1ec2e1187367904038ecf7e1f9af106da2ca0b3fba287547a9624def85229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A5EEA0C-3989-11EF-B1BC-6699275097D0}.dat

Filesize
4KB

MD5
7c99da130f2d0e1021d99a2d8ba1587e

SHA1
68c13746d1e9a15bfc78cf37a49f6f88c5e96b32

SHA256
7712a129beffd16b67a3b4293b9889ad588ebe5258c932090235c69251312495

SHA512
af55497973912d8a28605fd7cd3a5871ab6141e9cbf906b45b231c8675da96f5c7d78c35fd74f8da6d273de0c144e3c44c5e927bc148677cbb625a2564d04126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB7C7.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\239ba803d903e46e8936c2b2a92a3692_JaffaCakes118mgr.exe

Filesize
115KB

MD5
0a745aeddb83ec4d137dfcc0f3d1ccad

SHA1
bc9f3298a33b71a6a26dc56408eca55d313800ab

SHA256
d28522f5a1bdd4cc70d29ce457e9bfcbb75d6d5fd2537ff15877ee2a502dd907

SHA512
85be6d620235ac9447ab8a65055cbf4d29ef0b6dbffc5d38bfd35071c26622fd0c48729daf4323d7c58e34b0204ba131792b40c9ec38bb4a597f5693e5ba2eaf

Download Submit
C:\Windows\SysWOW64\xcvzci.exe

Filesize
183KB

MD5
239ba803d903e46e8936c2b2a92a3692

SHA1
bd18239891f9888eb3b6eb773997734dfc3c2f8e

SHA256
3d08f0194e417a34913be6108bbe460b931c01d5fc18fe63fd8110024442af04

SHA512
4db07d76baa5fcceb6b0936a3ddee110ebb49e851ae658ec0a5efa05bfb004134be88957c1d723da261983fe6af872d95470a2abb2191b920adc249ee6862b4e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\1623778a-0abb-44ad-abc2-a497a991025b.tmp

Filesize
1KB

MD5
95f9a2a6a2fa372f954250b65a441ae7

SHA1
32c78571bf1ff90bbfb3963c1972b21fa030b832

SHA256
ec316c92d87fb9f6c9b4b6229d45d14e59a463449a15e5864d67c86f911a6499

SHA512
2cbf527e445f59db29d339b35f8ed8c1b5a2252822ce7046f1d7df2f52f6c003fd7dfa5dbeb9894ad34bcaa33a0722ae1bd513890050ee1b8dc25f6f9127dbdb

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ea3366148a8b4c7cd14b81cb9398db8

SHA1
1fe1942fd2660cb88c4600439020e1a703d113ce

SHA256
52efe81d2949fb38fd863417d2ba8916f15e8e04631f323d49c4c35aa7cdbb11

SHA512
fc254efd6d668f951bfd2220d96f13996911c3a9c4e8bcfc34d0ab8e3b2cd572e09eb524004c2d00b8d4ad320eef6471cf5dac9d7c8b71c936851ee0a11f63b2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
3KB

MD5
5098d954326311297c940de0afb23a3a

SHA1
409e353a707f0f824d220c1381fdce1cb9f538ac

SHA256
ff93edf5304a84c4f57ad9f3144d47e4e856753a5ab5a6e7071d14edc96e78e0

SHA512
8e9cdce413569cd63919779229fed7475cb82e048c5e93783110d9cf96ec05cd8f871cd9a1eed11af7f4e76d38c882586e12771266660a3f1824ea3623ff6a12

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14c0bc055058fd71c0bd5887f012f1ce

SHA1
784d391627245e9efb91c272a78e330c38b50f11

SHA256
aa4cdc020687bd4fe739cba4661e1202a2798a50aabc8da35c2c6c56fe756b94

SHA512
aca3b894caa1c5b16176b4f4d855f91f76453997fd4d8562bfeb304da52030d9c36297ca719f74c670e6f0d00b6b68fd2dafbc221883cac29d57502a857bf8f9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8ce8d5a56df6ca30288db5f21b472bcf

SHA1
c49b322c34190025e5998044d90050f77bf2c620

SHA256
18f6a6873e9b7998cbacd98e5b61a93714cb93f72901a4234f1784b1a4c1b6f6

SHA512
ebc6da550eed8ba9389b1723cd1ac07da6bfaadab947fe37b1f0b0e180433c33018251adcbaa4456dfd6a5a00ab4315f38fd6ff9803ba59991c7585b0c7ecc45

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe574ab5.TMP

Filesize
3KB

MD5
9421e4fccc75d1ac1f86315723c58c57

SHA1
8a0c32db5c212fa2ef84ab2265eb2f336f1d7f45

SHA256
6138b0bbfb5ca78bd73773e771bea7f40c52d7c75dec54e676d002b2d0fe77bb

SHA512
a01930d5d026caf94f28c915970993c1f8e99119742c8ab4a1cf6ec068fb8b4c18945d3f60398c5dbc6c047b10057f220f197c2058fdbf09a8de557accd8d11a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
82ec47f30cbf9e3d254438d24fa758e8

SHA1
b59399f7d5d53bd99d0b834b16ffad6e6187aaa2

SHA256
f91ee2ab5e0ca17fc932cb7e70ba555516b5a6e214ab265c96ebed391c9d345c

SHA512
3eb84e5d3c7e2120888049f15971be2aaae54533fdf75ba82927ac89bed194c25cf9189b9bec565b0596c718dd581cd0529c90383ab3f13749ee687fb2c36bac

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe577223.TMP

Filesize
24KB

MD5
b4092d68914690e74260a65a13612fe0

SHA1
cfc361f5138e57a12ea3ebe53dfb53b90f8571aa

SHA256
8b4e131b8fbbb21a24aa84fd78be0299417dbaa79a532a44c19b9aeb5b911353

SHA512
ae2a2b6977806b0e1489dbcdaba7d32ca34da3d47c37a515ea2c66def8a6c6266c2357eca6b6bc3d0b0a76e323e273e910b608ae58500fe7f2bc91e4b6f05ddf

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\fccfb090-5f69-40db-b8c7-3886d7c3fac6.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
cda6ee9dcb3fe73ad4298ac68aef7014

SHA1
8fe0fce4b837cb79849283005779d5f13e96a542

SHA256
985a2fbbdff6fda66a55db3c9ddaa60207f1b0085ce0adfaafeb9d884a3186a5

SHA512
6aa63bdccfdaec6c886b9a250da8fadc6955e43d4afe486c685a11a11468fd5310f76232809c5ea0e369059751d40a0e8300b7037445663ddaf0bdab5553469c

Download Submit
C:\Windows\Temp\Kno597A.tmp

Filesize
88KB

MD5
002d5646771d31d1e7c57990cc020150

SHA1
a28ec731f9106c252f313cca349a68ef94ee3de9

SHA256
1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

SHA512
689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37587cf91770667997547e2dfc4a0d0a

SHA1
14420f28fdd849429470d47694c9596b354aa442

SHA256
c951924c4e52bf0544b6608a6b2c0082d5b9d83d6da2dd70163636a632799c4d

SHA512
f4a0cdb15009238e57534915707fe863529bbb4d81179ff8200a4a0e5ca5e5d68e684cafc0bcfd871342bc10d1964cc8e89079a8ad1c6916eeecfb43fed748a4

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A556195-3989-11EF-B1BC-6699275097D0}.dat

Filesize
5KB

MD5
60363898924270071494eaf5b0fc9dd3

SHA1
8b0d35dd7f3d358d7f1490377f83a00c951afa34

SHA256
5966cd786f5fbde23443ef44c4e78d053dc01637616a9c37f20f51abb8b830fd

SHA512
878821f8cab386a0df8e157eb7462920cd87054c471297a32b5848e6cd1d1c3f521fd85af1b1a5398e7c9a5ba5d38e91425947608324c586be440ee04aab790e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A5A26D9-3989-11EF-B1BC-6699275097D0}.dat

Filesize
4KB

MD5
8cff92fc38e4d0d58d46c313887e4c98

SHA1
467f7b62e4367463a7e81bb61fcca1bfe34453e5

SHA256
e0e128065579b4b93bea0eb64de40851fb4ffa1588bd456a03a2f75d4a81a80b

SHA512
fbf504e698820c66868f6f9471484f388d7aae149ff3faf8346451ac51a97f685e01c6a76851c19829d35b375af69030b4b6d359120ac083106877299d924f42

Download Submit
C:\Windows\system32\config\systemprofile\Favorites\desktop.ini

Filesize
402B

MD5
881dfac93652edb0a8228029ba92d0f5

SHA1
5b317253a63fecb167bf07befa05c5ed09c4ccea

SHA256
a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

SHA512
592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

Download Submit
memory/1608-55-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

Filesize
4KB

Download
memory/1608-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1608-64-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1608-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1608-299-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1608-52-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1824-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1824-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2272-61-0x00000000772C2000-0x00000000772C3000-memory.dmp

Filesize
4KB

Download
memory/2272-58-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2272-46-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2272-41-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2460-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2460-59-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/4200-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-27-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/4200-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4200-13-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4200-10-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4200-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4488-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download