67c002b2237385fc7f83ba042d5b3688e0d8eda4ac6e0b5c02e390790fdcf8a5

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe
Size

9KB
MD5

8dd3d339114cce313768444ec605ee46
SHA1

067d5e083a48fe3618050ee976ba6bee82afbc07
SHA256

67c002b2237385fc7f83ba042d5b3688e0d8eda4ac6e0b5c02e390790fdcf8a5
SHA512

175c6ed6364555d8e64ad10904a5ba369a69be326ac14a10b4345b322020850038f12ad67f265e94ebbf6dd99936a1acb9899190b7480b88b2c4ec6c5a705caf
SSDEEP

192:3R5Fhp8cdwpHR3AkPLiM79mLU2PcCNDtQ/9+C8RCML9DmN:B5FZdgAkTiM79mgLCY

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2180	msedge.exe
2180	msedge.exe
548	identity_helper.exe
548	identity_helper.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3464	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	84
PID 468 wrote to memory of 3464	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	84
PID 468 wrote to memory of 3464	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	84
PID 3464 wrote to memory of 2180	3464	cmd.exe	90
PID 3464 wrote to memory of 2180	3464	cmd.exe	90
PID 2180 wrote to memory of 2040	2180	msedge.exe	91
PID 2180 wrote to memory of 2040	2180	msedge.exe	91
PID 468 wrote to memory of 2508	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	92
PID 468 wrote to memory of 2508	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	92
PID 468 wrote to memory of 2508	468	8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe	92
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2088	2180	msedge.exe	94
PID 2180 wrote to memory of 2724	2180	msedge.exe	95
PID 2180 wrote to memory of 2724	2180	msedge.exe	95
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96
PID 2180 wrote to memory of 2996	2180	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8dd3d339114cce313768444ec605ee46_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BF2.tmp\batfile.bat" "
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.postales.com/ver_postal.php?view=PO4855fa5e27113
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaf3246f8,0x7ffdaf324708,0x7ffdaf324718
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,18317658318901875851,18313069990553681906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
86d13161a770decd40b5229fe322a025

SHA1
3911eef43eaa58e7694c4ced178476e8ee9c7883

SHA256
9c9b08d247da17f55c09db357a13f53b1e309a449946950d84f01adb9be91a83

SHA512
9c1f656b79db3ada650a8aa4b7c25eedad4a55eb8c92477312f4fa763cafeac12c6a5ada719e2444a2c19e3d26f90cbdcd5054e7791c25e9171106e9a9fc4fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
039f6ee0bbec2d876889d2fb67eecf44

SHA1
ac274d745465e75c8e74344052ac1c58ec7b74fe

SHA256
5ff5a5d1ed7433d7b64e4c2c0cd24577a0ba16cc18811b10b0df93ac99da232d

SHA512
7b8eab381ce27671f6e569e5c6a6503ad61956745513a1fb51c43b3c2aaf9f8655fb6383e321548f77187ffc4926da6a32a230d7b2df3deea5d9f9a11b68a533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8561d42bc34b75724923a43babf89a3d

SHA1
9d4779a1377e36d28a69a5a4375ed732ccd1981e

SHA256
327498f9a6b4e1bb6fc5c10e0eeee9bd85fa1c5fe94ff78b033c9cac6369894b

SHA512
1708be5591c58adb5531a589af8ab912c91824fb9dd1a8046b485b0f8bea445a3d7efc7204b55b9a2626d79cb06f0cf809348957c147e2c0b61be3802951aea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ac74657d8962eb9094255c7be92b5ce0

SHA1
18df8758a456284a2ba7437124581175b0cae02d

SHA256
9f20f9656b013259d7d511f63b81ac3420baccb2c48d5451864467c4b591c35f

SHA512
d42a631f4392effdbd888dd57f193708bf669e65475a0893ef85bf4fb5e775aa47012ac1ec781fd12b9bc0175837fb72e825234954f78b575962b9ec02c72da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9911f0591e3d42d1c12c400762e2230a

SHA1
5f719a767d04d95d4200f7573fcc5621012df292

SHA256
e16192fa690280070ed594f4598717f5ead7c4d8909fc8c3e413aa5abc948e3d

SHA512
691943573299d13148569bc4a996d789c34c53b79cbf38b37b140ddfe9832b3a36c602e9e037836e029914fd2a1738f8e3460f903b8902ca099974de9e3bbc7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp\batfile.bat

Filesize
1KB

MD5
e88ea6c938d86a2a9297abec72a084f4

SHA1
78f4d2de769d336e963bab82d31c1cc15c66fdc4

SHA256
ab7ed156ddea2a31a8455d9ca9653e46f47db5bf9fbb50a5575a28aa71a1bcc4

SHA512
6b80df497c3bc9283df785f3e04640bfd4e4307c63a0207f96e6dc9596706466cb709379029ea959061b620ff6f8199f6064e9b847603e8efcf65b9f79a36d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

Filesize
183B

MD5
5a7993e7f29baa318502ce8c2cd3735e

SHA1
7a9ba266c0b577c23f0897f50dd59d63f724f53e

SHA256
5297b0ad7b2a1b80d9e87f181f51a3771d60da72bf20d6113e6c06bc29d91824

SHA512
218610080dca1c8a60ef397e124abbfe24c6663aeac22f8a336731e6565c6285a17175e9ee45092f9fe48ac3427b301a6fabe973da3e533ecbb046575a4c5929

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
228dcb893677669c15ffd0f86f781f5b

SHA1
bc953b5b01843d18b8235dc7243d4c0375eac763

SHA256
d9993a4b42386dc60d094e4c6374bc681d6f46bfc3d0d9309b99cfa02150b663

SHA512
191925c685baf006718d4d335725333e4cdc403e57f25cabe8680db975ed086b29ed102904db1d56a411c26c94bda8f2bceb679f0f199f6389cbf87a6e772d5f

Download Submit
memory/468-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/468-24-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download