9e45902b78d3aab01dbbcc594c8c3f98792086749a1ff0ac31444412ef37b585

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Size 1.9MB
Sample241014-ywp5matfne
SHA256 9e45902b78d3aab01dbbcc594c8c3f98792086749a1ff0ac31444412ef37b585
MD5 43f7c4b0b936fd7a19aedecfd22a9f2e
SHA1 8c3736aee9abc24c2f2cfb4902a611c0ca510f63
SHA512 dbc6bf1a34e8510478c4e4eb46a78dfade4a972a0141fb828284292016b4c7ef32f1368ad525c8c1a480cc25c35a38c3552dee0aebb0bd43b0ecb403aa70f168
SSDEEP 49152:aZrHlnF8XeeLJbRJResAYZ8xxJicINAedyUn0ZA4n43D1s:aZZFKeeasAO8xTQNAedxnxu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1376	gamevance32.exe

Loads dropped DLL 3 IoCs

pid	Process
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
1376	gamevance32.exe
4440	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Gamevance = "C:\\Program Files (x86)\\Gamevance\\gamevance32.exe a"	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\NoExplorer = "1"	regsvr32.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Gamevance\gvun.exe	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Gamevance\ars.cfg	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Gamevance\ars.cfg	gamevance32.exe
File created	C:\Program Files (x86)\Gamevance\gvff.tmp	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\ars.cfg	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gamevance32.exe	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\icon.ico	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gvtl.dll	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Gamevance\gamevancelib32.dll	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gamevance32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	gamevance32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gamevance32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gamevance32.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gamevance32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	gamevance32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer\ = "GamevanceText.Linker.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib\ = "{014C4232-6904-47B9-9144-7E0FB7277444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\AppID = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\ = "Gamevance Text"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ = "C:\\Program Files (x86)\\Gamevance\\gvtl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\ = "Gamevance Text"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker.1\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ = "Gamevance Text"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GamevanceText.DLL\ = "GamevanceText"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID\ = "GamevanceText.Linker.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID\ = "GamevanceText.Linker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{beaC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GamevanceText.Linker\CLSID\ = "{beaC7DC8-E106-4C6A-931E-5A42E7362883}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4452	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	93
PID 4080 wrote to memory of 4452	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	93
PID 4080 wrote to memory of 4452	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	93
PID 4452 wrote to memory of 1376	4452	cmd.exe	95
PID 4452 wrote to memory of 1376	4452	cmd.exe	95
PID 4452 wrote to memory of 1376	4452	cmd.exe	95
PID 4080 wrote to memory of 2552	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	98
PID 4080 wrote to memory of 2552	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	98
PID 4080 wrote to memory of 2552	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	98
PID 2552 wrote to memory of 4440	2552	cmd.exe	100
PID 2552 wrote to memory of 4440	2552	cmd.exe	100
PID 2552 wrote to memory of 4440	2552	cmd.exe	100
PID 4080 wrote to memory of 232	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	102
PID 4080 wrote to memory of 232	4080	43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe	102
PID 232 wrote to memory of 4704	232	msedge.exe	103
PID 232 wrote to memory of 4704	232	msedge.exe	103
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 4364	232	msedge.exe	104
PID 232 wrote to memory of 1760	232	msedge.exe	105
PID 232 wrote to memory of 1760	232	msedge.exe	105
PID 232 wrote to memory of 2032	232	msedge.exe	106
PID 232 wrote to memory of 2032	232	msedge.exe	106
PID 232 wrote to memory of 2032	232	msedge.exe	106
PID 232 wrote to memory of 2032	232	msedge.exe	106
PID 232 wrote to memory of 2032	232	msedge.exe	106
PID 232 wrote to memory of 2032	232	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43f7c4b0b936fd7a19aedecfd22a9f2e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Program Files (x86)\Gamevance\gamevance32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files (x86)\Gamevance\gamevance32.exe
    "C:\Program Files (x86)\Gamevance\gamevance32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\Gamevance\gvtl.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.gamevance.com/aj/ty.php?p=srKz%2F8vowsH0srK24dPwtND2y9ez5%2BbF%2F8CzusXBssG0wMGwwbDFt8H%2Fo%2F%2Bzs7Ozs7Ozs%2F%2FMyA
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e0146f8,0x7ffd8e014708,0x7ffd8e014718
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,16424073213078864388,15234434921459101278,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
    3⤵
    PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ars.cfg

Path C:\Program Files (x86)\Gamevance\ars.cfg
Size 53B
SHA256 1d7e888b2df14c8224487e0e340d4bdf4cfc139183b4da45dc5e349a9aa8de4b
MD5 878e924ebb472096633a2c25417d1dbf
SHA1 dfdcacf55f63dbd04d7d4f482ade57e9f2d77661
SHA512 1711f98bfab3d27b3ddc5dd40e6ce5d6c3c2bf45cfb5bca3c463362b050e85b3b1673f1b76128be5ed0f33d88129270823ea4cc9a30f25b0028da567119036a7
MD5 SHA1 SHA512

Submit Download

ars.cfg

Path C:\Program Files (x86)\Gamevance\ars.cfg
Size 95B
SHA256 c3b8c036a63374ddc1aa7a753f9a3be748b22d93f4e7213e0f1485d1292a6fa5
MD5 2e9960f9f79e399279726520247c7367
SHA1 78fe4e81c2093d46f4f4f7c5445ae1f2550b6042
SHA512 9b14f8a918a9d856cdfce97fd32d24a64f3f2f5dfd046d052ec70f8c32938eca485415e720c73165d1d7581b3d1290233fb058da10efd7f35d5a469925c48c18
MD5 SHA1 SHA512

Submit Download

ars.cfg

Path C:\Program Files (x86)\Gamevance\ars.cfg
Size 107B
SHA256 178321298849eb4f0e8060cefcf65cf18a369d49d90ee58838eb9d735b07eb9c
MD5 c8ed8bf9fb47faea4e30fc5ec5f0d024
SHA1 0cbaa4cac24522afa0d3eabd3f7d1eae7fd0e473
SHA512 2f0863293e8c0465ac884898c5d93e474b3da87e8be59b0397c0b7115ea948bae6267406810897763e53eba6f864e71e62d087a2c82ce470382e59a4506bc1c9
MD5 SHA1 SHA512

Submit Download

ars.cfg

Path C:\Program Files (x86)\Gamevance\ars.cfg
Size 165B
SHA256 ba2e36178baa745b97537675bf3a4eaf9c4e994a892a09e10a9ff0151f505b1f
MD5 25e657a4267b360d36c76e44c9857cd5
SHA1 e2ebe5d705b6f9286db1516fff3feb8202ce17f1
SHA512 f7a5d660e611e5873a73bcc41ba83f9901501ac5175376b9fab3e8c8e22f4960a9eb8ac5f0bff014450705c2f01d401f3d831ef2c98d915132a3f1d8beaf1a29
MD5 SHA1 SHA512

Submit Download

gamevance32.exe

Path C:\Program Files (x86)\Gamevance\gamevance32.exe
Size 243KB
SHA256 c4dc7f4a59dbae870e295e859b79a2f5e553d69a7ca606e4a9ecfaaf1ab4bc15
MD5 ad9b8116024eb0040545585d4e1a96d8
SHA1 587ce7640562b00ef2144abecd608cefba6d1335
SHA512 682340a6e22c5b64b1d71929202f689a191c57097981d8595367c13e6f4e54192198cb014cb47eee8d845f35cd0561ce3c9ddf5397afa5845b4d665a7f2464af
SSDEEP 6144:mdH4AG4Nu1zNkUhZplf1p3/mcLkcV74FTRBWnKp4q:mdHPGD1zNkGZT1pOc1V74FTLWnKv
MD5 SHA1 SHA512 SSDEEP

Submit Download

gamevancelib32.dll

Path C:\Program Files (x86)\Gamevance\gamevancelib32.dll
Size 224KB
SHA256 4a3a3e6db320955e1d0cdd89d6fe0fd641bc1cb073c81e8979bc2394278550a3
MD5 ea2c71fcdcba32e47e7a517d6ceb6b38
SHA1 5b28a468927097ac2f31324f4d7539004797c40a
SHA512 f2fa9383d7970dd6d435d580ef6fb100dee266d3938578e1cb241e88fff01f3869f8fbf1761528204ecbad81f6220e6530c693f8e80707149171b532eff298d1
SSDEEP 3072:YWRpu+/QGt4n7RaztUKWM9sW6zSj+KI4RPRH6Jd4IY8nZjwXqxoNfaE4IkEyyTqz:FHuEl3leQ6/TPqCEbGq38eZx7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvtl.dll

Path C:\Program Files (x86)\Gamevance\gvtl.dll
Size 154KB
SHA256 1bf7f94b9acb4c61b921986cc7f9833c5451d90dffd64fb1d6e45f425928541a
MD5 cf2f28d4183ac5b6cb06c2e4536136b4
SHA1 7fa52c34384f8cbf67349eb9024b615481817f6d
SHA512 174891a66537a4d50bd19573313a0a830b9ce65b917497b82616405ce80c79ddc0a80be26164d545a041a17c27dd8c25cc85440c50b9ee6bf70a1e3e51ce33ec
SSDEEP 3072:finh0fBWCZMAkitvt3eOnK4bs4U0FKwSyqevCJw5T9oG0:/RTxeIec3JqmGiKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvun.exe

Path C:\Program Files (x86)\Gamevance\gvun.exe
Size 265KB
SHA256 d1e80f4609072481373cae298e041c7a2c69a73cf82f83d48aa4c56650216df3
MD5 5474fcfcfae1ae9cacf3554eca438232
SHA1 ef45a6f79bc6dc1cf1639c08d3f2fe009785af18
SHA512 2ea63b9ef7107e3ba1bba92fe59391a6ba73482ecc6e26335bc44e9a7171717470ebc490d523470215dace6b9a5eb92cff06c212ebc81aceec51713ad8b44187
SSDEEP 6144:Di3P76Q1pYeyDjDWkoGNcO/x5XSRdqbPxRxtS/PeQW9:DiuQ1pYNWkLTx58qbZRjwPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 215KB
SHA256 18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
MD5 1585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1 aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA512 7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23
SSDEEP 6144:/Hl6MVIiSyiXJeJNmem3pF+U0jBMSrhhH0z1kXEwYR:/kMVTShSNVETSBPVh0z1kXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 c2e380503944471c1a78e012a65f3787902e7b0ba2863d980eb061ba45824c27
MD5 bfb7397c491975614413591e2e4d6aea
SHA1 7e70f5173e975a32a5e779c308aeaa17fa370a15
SHA512 b2b2525fffec7992058bbe963b8eac0506fe30c005fcc29764d153f5d47e1c5c707d2b3a6ddec9e5ce1aea4e5ebe5dbf7b9f155cbe950fd7d88a79c4a554fcb6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 81c39f3018d1e9c6f47ff91bae747ec8aef0665d1ae4b618720ada9c15cd8395
MD5 91401c22507435b5474c97dcc62f96a9
SHA1 db0284632b76188fbdd1ceb329b46289b797c6fc
SHA512 f8e1ff011e9752beef5031cfa7d927b2801f6d73c77c29e46454fe2c0786e7d279a4d0b9115a1981458d2456bbe9eb4ac23649eb2a9779db9bb0ab89da3aa3b1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c62bab26d5cc17ef1f03af5130433fba644dcf61bce8ed6369185c1020621492
MD5 d2c5271034b48a5e2ce074149826a34c
SHA1 f7f23b81784dfdb7815719c079c71c91e8f94a45
SHA512 d3badcc8099b7d60d5033ea819a45ea263310d8dcb944c3e0e126beb24a66643707eb0d4ad49cebb0668dddfa5501fd578b461772968339bb77cf6bb5dd3e267
SSDEEP 96:njkOxm/BFmq41PAPfkwpvWMoijR5mdeFuI1mMQ2ynVtUWQyV+VD7AiEwb:njkDuTVAUGWMjzuIEMQ24trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b1472396125deea077ed063e74cd0f288a5087274eacee602a15f505c584f807
MD5 961606c923fa465c0862f7d5ea98931b
SHA1 cbb739f004b517bd1ecff880abfc78dceb08bcc2
SHA512 e5a0c22678e963921622652516aebfc5028b89787bfe8637b0f2a3454eb839f83b0c6472724a203cc4c064abe9ab9ad85ca1e4f34d68443172e81a523b1628ba
SSDEEP 96:njkOxm/BQYmq41PQPfkwpvWMoiVmdeHycVtUWQyV+VDCziEwb:njkDKTVQUGWMXNtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 44d8c2d079253a5d3effd96e070c7a25963c4fdeee860f735d9ba7884b8e7be5
MD5 fafb948fa0d1c4cbb16a68f3e70e5fc8
SHA1 9b7db151ec47ffb7140e7cda5d9de0dcd094df28
SHA512 0ae361b000c4561ba4fb512f6e04e4422d14f5b5aaab2016c076d17b1ea7dc2878a9a9ecee4892a14560ae89792a9a111b414f0b5598d73e4b3bb06f44d65970
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585c44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c44.TMP
Size 1KB
SHA256 63e83a11f5f734bfa9200e09c7777c4607bfb9e7f6fdc79ae98a0a651ecccd12
MD5 3823144d9674f0d28abd27d729663e46
SHA1 aec0f30b2e052f44ff25b5a683b9a7df176c0b7c
SHA512 c4e1110c2cb77a5f7c672909cf413d1ca19c7e236b0ddd648cd1fa59f8c284ecd9a6fee661398079f979f59cf78c4225f4ca743ab8ab735db36baa327a3e522d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9b73209ae80086d39a04369a5fd27864ff3ad36c1b8bac9203d52ffb37f9e255
MD5 febf3be88c79a99ab7f0cbe006b15634
SHA1 ec1641b3dd38c7114fd79a5c5dca36328bbb79aa
SHA512 77bbb99272d2cd653c3f96cd5f3b2687378f4f62c19732659ae68ef9a5071d912b8509b8ded7ce455aaf06e80880bbf42f3662622364e351b90e5c94c5fdf004
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupie2RU3Hp4zg6+B1EA3tu:A9iIxuERzA83h09RZxYcTkbEytu
MD5 SHA1 SHA512 SSDEEP

Submit Download