807ffef96e236f31ee27ec55a8a457cd289aee9b4c6f1730c68c6c91e6ff2433

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
Size 488KB
Sample241002-2mb37a1ejl
SHA256 807ffef96e236f31ee27ec55a8a457cd289aee9b4c6f1730c68c6c91e6ff2433
MD5 0cbed370b033e7f4e76ebcbe856eec06
SHA1 0e73e0ef4afef8b9bd81bebbf2815c5c186701ee
SHA512 726bc71fbf8ee63a493421c384e6894e4b4a801f821762e7e16ba5b02e127852550dc859df8300932a4aeee67e4c722e932ced4ce2946c067d48f5f11c2969a3
SSDEEP 6144:Pe34R2DBgzh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7pw:72izh36VVTGf0ZTsnz7O7L6ju7pw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 13 IoCs

pid	Process
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
976	msedge.exe
976	msedge.exe
3548	identity_helper.exe
3548	identity_helper.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 976	3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe	82
PID 3452 wrote to memory of 976	3452	0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe	82
PID 976 wrote to memory of 4172	976	msedge.exe	83
PID 976 wrote to memory of 4172	976	msedge.exe	83
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 1356	976	msedge.exe	84
PID 976 wrote to memory of 3052	976	msedge.exe	85
PID 976 wrote to memory of 3052	976	msedge.exe	85
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86
PID 976 wrote to memory of 1380	976	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cbed370b033e7f4e76ebcbe856eec06_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.phpnuke.org/s/2/7/27712-663816-total-commander.exe?iv=2012101700&t=1727908900
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff969ac46f8,0x7ff969ac4708,0x7ff969ac4718
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,12196700131008547161,10927959439050749154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bf7869b8e94c4e2ecf3b06da2f3f5eb01f2b06ddffba6213ed3f1f5aeab52f1d
MD5 cb3bbc5c8a103f3a70f6502044e390eb
SHA1 34e591e047934fa02ef8709f3c4dd90ad3964ea9
SHA512 7aa4dc81c25a12c1bfdffb9411de861ab6ce628eb2b274b4d9c183e53adab1677edaaed86bc477722e95fc582089b572ddb1a1c706f69221224efbd9ffa168df
SSDEEP 96:ntk/2u1NcpwpvWMoiVmdeHm9HjUWQyV+VDCziEwb:ntk/58pGWMX6jro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f90a45169ea8c814418fccdcc97e63ac501485ae39abd67ac0dce8730b452fe6
MD5 661b97c7c62ce49d5a25a569f10966a5
SHA1 cb69dac23bf3edeb12f2b69f867ccc1707c0602a
SHA512 3f0439c00f22b31393c31c1a18ff2df40e87482ec1186f9c46f60d15e3132bc675926bb343aa8c64605f166620e209b94243c61aeb852bc80bc5c2228cb6ca95
SSDEEP 96:ntkdou1NIpwpvWMoiVmdeHm9HjUWQyV+VD7AiEwb:ntkdnopGWMX6jrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ec8c9b8bc3252b4bf9d5a7490de096245d20ca6bb80494d775ff5af501b8eeb7
MD5 d866d23138088fa16594f8c25b4c9022
SHA1 c307d55e46b5aef473e3b7dd919381c46463d8bd
SHA512 9defe68e6a1968e353961019dd285a421ea10d25a748efc83f37a9eba20dbe666d5278c6f92eceec41cb86b9fae45bc88cfccb7529e43de8c72e98334ef79125
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoe2RUalYOEIcM/bo5Zxb:A9iIxuERzA83h09RZxYGNtqZxb
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrandingURL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\BrandingURL.dll
Size 4KB
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\LangDLL.dll
Size 5KB
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\UAC.dll
Size 17KB
SHA256 3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
MD5 09caf01bc8d88eeb733abc161acff659
SHA1 b8c2126d641f88628c632dd2259686da3776a6da
SHA512 ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
SSDEEP 384:w9JzaeWrF8d22hXAGFkr2WqErkuCYMAWS5Ns8AXXki:wLaBrrTXr3qruCYuS5qk
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\inetc.dll
Size 20KB
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\ioSpecial.ini
Size 1KB
SHA256 fabb723250f3814202de3d0e8bc37de7ce5d1312f9ce330c7f59a34c2b64e4b1
MD5 3f363de2c780da86b4474a2be4004208
SHA1 4270e8bd9741b0c33b9129f6a12783377b4054d8
SHA512 b537247e3fc89cd7604e13630ff2be359f95ba7d2776997c0715f2c2ca20d914f360c41b0f1058651fa881f4ccd24027c15858aaad641440b6ed08820a33644e
MD5 SHA1 SHA512

Submit Download

show_page_toolbar

Path C:\Users\Admin\AppData\Local\Temp\nst5C98.tmp\show_page_toolbar
Size 940B
SHA256 01378dfc6a99d4341a56d597ab584eb13d46629c73c6cec1e4f02ff449f5823a
MD5 b66e7fdd84c4e2db3580a9602ae8ddc7
SHA1 e037728865af4babe5cf45e227ba5c89b644f963
SHA512 994d65cb43e3b02b00cfbf3050307f9462ef6011cd97dc660defec97de6a22846ca91ebe3df9f71c5735f105eaf7686988f6ec761fde131816aaa4aaf883bcb2
MD5 SHA1 SHA512

Submit Download