darkcomet | 243742280dab2a4f0cb78465e95d53009b4f3f942a88e87d7c08471407565f42

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2025, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Size

722KB
MD5

bb644d9d074bc7ed49fe48e8da82b40c
SHA1

4a37c9123958c179a6b107571b7468a99c4bbf96
SHA256

243742280dab2a4f0cb78465e95d53009b4f3f942a88e87d7c08471407565f42
SHA512

c7189f330b32c3a562ed0cc4cc694387336431d409692ecad78dd8e20e2eb6344c31eaaf319487b0237fe445db13baac0a237c31d999740ae7abb66f23206a3b
SSDEEP

12288:jrwYAI1xDr3gPVFoSXfKyOEN2mYmlQ0KKe5aHWkEBobJaOYs+C9jZKOQk8Ndd9l:4Nk9rwPVF9KyOEgTmBe5rBoqsxlZW

Score

10^/10

darkcomet guest16_min discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

127.0.0.1:1604

Mutex

DCMIN_MUTEX-J3AF8JW

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
twsPYC9MBUcZ
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe

Executes dropped EXE 4 IoCs

pid	Process
2948	IMDCSC.exe
2088	IMDCSC.exe
3624	IMDCSC.exe
4728	IMDCSC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 set thread context of 3416	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	86
PID 2948 set thread context of 5736	2948	IMDCSC.exe	95
PID 2088 set thread context of 2160	2088	IMDCSC.exe	96
PID 2948 set thread context of 3624	2948	IMDCSC.exe	97
PID 2088 set thread context of 4728	2088	IMDCSC.exe	98

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3614765493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31174697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894018988115484"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4239789418-2672923313-1754393631-1000\{64E072FF-CBD3-40D6-BFE0-C729E7A4F623}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
2948	IMDCSC.exe
2948	IMDCSC.exe
2088	IMDCSC.exe
2088	IMDCSC.exe
6652	msedge.exe
6652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeSecurityPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeTakeOwnershipPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeLoadDriverPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeSystemProfilePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeSystemtimePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeProfSingleProcessPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeIncBasePriorityPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeCreatePagefilePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeBackupPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeRestorePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeShutdownPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeDebugPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeSystemEnvironmentPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeChangeNotifyPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeRemoteShutdownPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeUndockPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeManageVolumePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeImpersonatePrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeCreateGlobalPrivilege	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: 33	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: 34	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: 35	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: 36	3416	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
Token: SeIncreaseQuotaPrivilege	3624	IMDCSC.exe
Token: SeSecurityPrivilege	3624	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	3624	IMDCSC.exe
Token: SeLoadDriverPrivilege	3624	IMDCSC.exe
Token: SeSystemProfilePrivilege	3624	IMDCSC.exe
Token: SeSystemtimePrivilege	3624	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	3624	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	3624	IMDCSC.exe
Token: SeCreatePagefilePrivilege	3624	IMDCSC.exe
Token: SeBackupPrivilege	3624	IMDCSC.exe
Token: SeRestorePrivilege	3624	IMDCSC.exe
Token: SeShutdownPrivilege	3624	IMDCSC.exe
Token: SeDebugPrivilege	3624	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	3624	IMDCSC.exe
Token: SeChangeNotifyPrivilege	3624	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	3624	IMDCSC.exe
Token: SeUndockPrivilege	3624	IMDCSC.exe
Token: SeManageVolumePrivilege	3624	IMDCSC.exe
Token: SeImpersonatePrivilege	3624	IMDCSC.exe
Token: SeCreateGlobalPrivilege	3624	IMDCSC.exe
Token: 33	3624	IMDCSC.exe
Token: 34	3624	IMDCSC.exe
Token: 35	3624	IMDCSC.exe
Token: 36	3624	IMDCSC.exe
Token: SeIncreaseQuotaPrivilege	4728	IMDCSC.exe
Token: SeSecurityPrivilege	4728	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	4728	IMDCSC.exe
Token: SeLoadDriverPrivilege	4728	IMDCSC.exe
Token: SeSystemProfilePrivilege	4728	IMDCSC.exe
Token: SeSystemtimePrivilege	4728	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	4728	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	4728	IMDCSC.exe
Token: SeCreatePagefilePrivilege	4728	IMDCSC.exe
Token: SeBackupPrivilege	4728	IMDCSC.exe
Token: SeRestorePrivilege	4728	IMDCSC.exe
Token: SeShutdownPrivilege	4728	IMDCSC.exe
Token: SeDebugPrivilege	4728	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	4728	IMDCSC.exe
Token: SeChangeNotifyPrivilege	4728	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	4728	IMDCSC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5756	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	IMDCSC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 4296 wrote to memory of 1336	4296	JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe	78
PID 1336 wrote to memory of 5756	1336	iexplore.exe	79
PID 1336 wrote to memory of 5756	1336	iexplore.exe	79
PID 5756 wrote to memory of 2776	5756	msedge.exe	82
PID 5756 wrote to memory of 2776	5756	msedge.exe	82
PID 5756 wrote to memory of 4900	5756	msedge.exe	83
PID 5756 wrote to memory of 4900	5756	msedge.exe	83
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85
PID 5756 wrote to memory of 5016	5756	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://go.microsoft.com/fwlink/p/?LinkId=255141"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x348,0x7ffe68f4f208,0x7ffe68f4f214,0x7ffe68f4f220
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1892,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:11
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2904,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2288,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4716,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4716,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5960,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3532,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6080,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5664,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3684,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5036,i,9106234448507735516,3244311447451661628,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:6736
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb644d9d074bc7ed49fe48e8da82b40c.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      PID:2160
  - - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
1⤵
PID:3804
- C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
  C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    PID:5736
- - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e93f7a7e895750f95a2b42200b2f4406

SHA1
eb9edc7a2f5aff5ae1ef937ec351ae1adc59034f

SHA256
16af01493a8deae2d5884e7a0b4e4cf7f9b67a1c762e6479679500cda4ac928d

SHA512
de7167f6575862feec3e02150f1ac00ac9daed7528f3edb6dadb42266a27530ada41f7e2094ade3feb970ca8745e3c02a18e364c0e9ce04dee177472c1f5420a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d

Filesize
19KB

MD5
1b260cdc6bb984c36d9aa2b0d3c3183c

SHA1
66d4d213df2ecff52ac99a63bc7023affa8748fb

SHA256
f2416a9d280a75bc55d99fe9a66af512f3aa1ca9f3a296ab1c9466cbc3bfff13

SHA512
8d855f94fb4b7691882fd4855c864cdaaf887e941a547977d51307bf2244918ba0bfdf7ad7a8ef2dae837cd84af5e57b1d807ce71f5cb73346a44a6a4313bcb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0511e67164d63ecb9c57a2faddd92e53

SHA1
6aa05a552590ce64cb80971ce1b793f1802b0f1b

SHA256
4e601453f71d877e117f45dbfe6fe246e6d3cb6a92404861a5d0cb1ef5f7659e

SHA512
1eba11a79b146bad691bf18f35f8949e5279b9198a06d3ba6fa6017a4b4be0f045c932721990ebcf600358eff2b74e63dd2b56c639388be1b8671609bbd055c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
f7593fa9388c6789f51054edaa947e9e

SHA1
ff0477ae1b186b7f6b84a51f5ec92be56901e484

SHA256
859ff2f6c81e3d38e2f68d6d63029e7ee239e1fdc650c44ab4e6264f0bd548d5

SHA512
c4bc674d735da532608102295ac15c4b6a5d72398eee7c6bb7ca60e289e5dfc2a603ea7940132739cbd12b27bd14ce97228c7e8ae0c7509feee75063a3da0ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587182.TMP

Filesize
3KB

MD5
82b96251f008041dbfbcbc3a92c93e0c

SHA1
58f2179a278c37314808d38cf3d4218caeeee09f

SHA256
177e2a8f1ed46d415bdf88b9a1b949d3d7cd61173ec695d5d49c640838de28ac

SHA512
53e3fdeaebaa5118277d7ef6fc1b0816e0de850c398dba80fdb1b6705062c559ea9b9d1a630a403ea5de6ae8e9c120c26084ed86385dc1a300d7db4788f426ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b0abaf29931205159472f022b9c05e1d

SHA1
6b67a8c630c2a9e09bb14a2ebc737c8184a34d3f

SHA256
f1ab9a368c8304d779ddd7bdd84b3991093f6d68f7ddcb1852a88eb596bf3c0a

SHA512
63dfa141068e91f60caa4b19ad17e7bf077ded073db59b5db33825654fb6a114d50721b44d679aad195907f73d3c46795fb25503cb9e34eca16bb663fd1f58c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
81c5b784b66b3ef24af434e438c55f85

SHA1
45aca60b368edc0b5938bf575ff426e187cde1c0

SHA256
d28ac6e4311717959dc2a4626b7bfac66244196a43cc026d9b3a9609eaab05b5

SHA512
9d01b84fd741167b2d5e82733997fd58661d09e207c3834971208adde843ea7f93005e8af5951ea329627abad9f30125569beb25e056d75f511a96dfe4013419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
5d7dd97bff7d6d45aa8611c52a189bd4

SHA1
c3bfd7e10e087344f2f9fc8e3560d0f037717418

SHA256
e6026213a3f0b1ce42f3a82b349376632f148e6b316ee6d1af5abd1a4f9b88fd

SHA512
0623d23765c13a22312be931b847be0617b6888bf11cab3bd0f4a9210bbce8d67515fc19ed11309bc62c32585963c4e1379a16d12d3037b5740b3b2d251d1a0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
3b40d1433c9e8e4d3aa22f3aa414d8a6

SHA1
470cec5d4b2dbff397bd732731492aa261e25092

SHA256
bf156bd26098859ea60e2d877a692d150db69635e719589972e72d0480d12ea1

SHA512
89aa9d347f21dd87f7e9e6fecc2f11f0c237906c2c8d3f55749896924183fb6c9cc2a3742d0c918e96600e3b31c0d55a2caeea85576c75be28ef3db6f85665d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
227f21ffc3e4e7d0fc6303f75ddbabfc

SHA1
4ac5c24a31bfb5781bbe58658ae38de6e1811b1e

SHA256
cd3dede34530c4cc9ec7aee46bb5d00bc27fc70f193d77604499007532f57d23

SHA512
516dfd6252bfd273b9a4bd9773ef36293dbfbcc6c2837cc39563c3279c3774a0eadfb6015fbbcd19800e9172e68762e3baf32f82d462fc47f89267e32aa504a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0af3801afcffc81d8a2887c08e303674

SHA1
6202020ddf3301bb68054617fc14ac859beadc19

SHA256
6ee26e2960c9a27d637bb0e3c82f022095475d71b1600ffa448ede191ca4c1c9

SHA512
5ee1063d69691dce4f0ef8198eda6e34bf6ca4934718c71de93cd27b1073714ed3844f9b8d685396c0936518f87138561069249817fbc68cab0dd73e083aea39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
923fb87b09b51619189547180a9da77c

SHA1
a6ac2a8d8347108165c3973a91f272c66af60457

SHA256
fbee796d9796ec30f5e0f3888ba22de126875cf659ff7b9a031eefd4fd4f0659

SHA512
fc134ffaba1dd0a9307235fc326f5316b79f2f61635e0c3be52756dacdc4c99d7a444dc3e2208a6dc126e72024b0809d1c5454e9c171e263a52f1317483a8f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\f233b95f-1b9e-49db-b63b-af028d5bdabe\index-dir\the-real-index

Filesize
9KB

MD5
27f8a4046fa99dcd0351795d26fe16aa

SHA1
201c12cce5333aa621f964782a4efb8119372905

SHA256
641cd913f4701082e92f07a358f709e648949e18b9e8366049cf80c8b0b41874

SHA512
f8ad40f1ed398c65e93169d5a8c91b7bbd22cb07f682ac9778e0d9477659dec617dc02bb93773be67fafd11ec358b95c9a44a4b52ec386471f41995a95048a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\f233b95f-1b9e-49db-b63b-af028d5bdabe\index-dir\the-real-index~RFe5973af.TMP

Filesize
48B

MD5
6e9f26c4382b2f3ae0dbad65ffeccb97

SHA1
feb2ed0f3c7f49e77ea11d8f70f9cb592b490211

SHA256
ea6729f8079d12757d4d4a933990aa7c129ca417bb084846c59edec074a2adf0

SHA512
e96f3f35b08fe19c11be335efbe6c6c7618d017d4f00a4be3aed72f3998e85767d2b5893307e06d267dd306cf894fb0fcec23a91eb1b4c1f02d338a90c53668b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
115B

MD5
6fb781b31213e4bc704dca6c54e11900

SHA1
9710a3fbb9d1437d4e980f98207f1bd19cab2629

SHA256
646cb9df9be668c57f8cbd5f4aa7c11487957a6a645c1daa4bf083c6341bff27

SHA512
0c92707c4452e9a34e096eb8d23e4e54dd6a6213b957edbdd46d8609577cf87b60e00c805cfd0e555339570492b3abd2f086035db01c1e1ac095d7a11c94c6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt~RFe5973de.TMP

Filesize
119B

MD5
184b162bc06093fc65044f69bf0c8390

SHA1
3d45a0a1693562dbb68d2cc04afedab37bbfda04

SHA256
fcdac77f8d9a6ac206f9618656a1dfcb7158a89a30e5964e40283c6b6495ec61

SHA512
116835b6deb306441162f5a86582261e5b96f635b0cd0ccad2fd3c0f314cda329bfcf3ed34321f03422468a89f12704d75de6623570d1bcca811026f2a4c1a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
60fc895f579f1f3cb2443b58c6be6f4f

SHA1
d3aeb729f57fc062ba1e2e563074507b10ab55ea

SHA256
5310f8b58c312d19be4193be54e68fdd50d6136cc8e8b56453fbf2c024528c0b

SHA512
40fd2d8ef9b20dd426288d09d875a4f8201eaa6b22e583594ad4125e3405fb237ac7b61bcd095300bafdd06f7b9b0796e4cb5a81fb65a240a1347b212b9c79be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5863f5.TMP

Filesize
48B

MD5
c077f7ea72113d5e8b4e131c1696cd47

SHA1
61d442561d6904dd8aa98e7ad75f76065e53fcb5

SHA256
ba3a21deb7708ef2f111d2bfb30866f0974756beaa704815d9edd17d37c6bd65

SHA512
d4ae2fa2ebbc450cd81f79b771ec25b1afa6ee3a2e7e17f8cc897bdc658a50246f52010f479689cd914f0e42a543bad6731903f9bccdbd15cede5cb74d231c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c1aaeb64a96e006e17ad39ada477b008

SHA1
dbf6e47669e2d67a9aaa646ddb5a89c021f510eb

SHA256
0df6aa0571b45bf36dd3573342021eab3f96765e1e260dffec325009d47678ac

SHA512
6156431e1f5b8622e903fea87c96e950902b4cdd20ad23a33be1c6ad9cc2748fa130fd72ece2808ff1dcce2866212305cae2079d6041f5e75d795e3a6604f82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
4e1695a4025eaa2cd64ea0dd5862e701

SHA1
e9317ae2bb9066992c08f5bb92f6be0ef7047aad

SHA256
41aa33a0085ae068f658bbe694bae793d664ffa04beb3e0023ea1e448bd84b5d

SHA512
4f41ccc14d5ebca4a14ee9bbaa26c74016ee99918bc7a105a4371a751d1407cd820b0cf84d138183e27af32ef0142922aefce704f8f037d5b69f8bb19c653057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
227f733e46af622dc9b2850f38efc577

SHA1
b9fa5cb1a6c696b12ce3bbe01399ad89f01cbf9d

SHA256
41ad1c50489ce849abb67034e9b0e97a9665ed89bba4cc662bef7adf8057c95c

SHA512
7be601f5d5222dd259f27f9c2c9414bf68ca9d6442384b03a21640ae5bd19b105a41e73bb8fce8ffc95f9af718b4f6b320262ac2e24642df913f94e03089bcf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
39707c96b39f750420722a5920bc1ebe

SHA1
f81bffa623fba83897a2da25e0795ae3352d6d0d

SHA256
8e79cc348064a7b013bcd05358733e23b516323c2cc340e9d7f83339973a862d

SHA512
bbfce32a5497ac708f2f72fe58e07c7c9a19f3e190aeb59786ad64c6737aa8aca6d92094ff2c822a87c39eac9416773cacc4bdd4f094f8451866d4b4bafa1f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
90a6eae8fef270686e4615f46a2dc3f7

SHA1
5557b41c8ed22f8ebf7a7d16aaa6e739effad2df

SHA256
036ebb01e95d701aefce64e0f77150c619bca65af34959cfb6c3c2098164b336

SHA512
36b4b400136a39d2e501509b68787ed0ba19ffefa007f0d087e12e203ed32d9c170b27f9d76295d937de196efe5d7fb50beb0a6bc24ca5fdd6ccf8db7d2dccd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
156c93933aa776c945bc4f1ff9fdb27b

SHA1
0ec813bdde74c7e85c64c042c56e95f7e983ad16

SHA256
74582aa15e7e87116213990bba597b4e6091cdd6764ca56c890b6442e522f84c

SHA512
07f3a4a866ec1b0046b765f0c7416baece9f95046841c691d33675ffca7f06f9a1b02b228ed76227c8f80e1f9641b9dc803be6eac6d8c9d16720f839f0296df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
02131094549b0f1eb94ebd73a7b5f8e0

SHA1
4b3f7fa5fd1d26d3b8432211b34d175a0a4361c8

SHA256
ab454dae7d3ab9baf4f495da2fa63162b891fe8bf00a3186371d2dffacaf6dea

SHA512
6ebf3caa9ef4258c00386eb9f0156feac515567f27f603781cf0d032518caae655a3b197c8b95b35210b95065c78ade9c063f79acc9a57af3f6dff7d64696916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5aaae614227ceb508b4d9894cd5cbb0d

SHA1
e48eab82fdaa3c81b5246e5d3cae11581a981952

SHA256
765447084e3e24ebe540d3e2158fbc43040bc50987aca4d4241384bfafb3656b

SHA512
6ffae772e80418821ef4290fe3e21ca07060efefee8a2442dd77a4c6b4b5fdbf2f9ac9280b39f23d76a7cdfb2ba45204a50f824f6517beb37e4eae2070de7276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
cc1b4126d73f1c908edad9384fc59166

SHA1
d284e12093e623883656a79a78e185e552d9a9ee

SHA256
2046a8324eaffd6dd38b18f9ce87aa7aa74ddff42b7b12315b2ba016c88ea592

SHA512
1187b1b2974fa989ba1e3653f2421183e7ced80c1eddbe489c536e19d4ed736eea8979da6191db6a86ee7b44d72d3bad82814e7f94d9ea1c7e874c42952b7aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
722KB

MD5
bb644d9d074bc7ed49fe48e8da82b40c

SHA1
4a37c9123958c179a6b107571b7468a99c4bbf96

SHA256
243742280dab2a4f0cb78465e95d53009b4f3f942a88e87d7c08471407565f42

SHA512
c7189f330b32c3a562ed0cc4cc694387336431d409692ecad78dd8e20e2eb6344c31eaaf319487b0237fe445db13baac0a237c31d999740ae7abb66f23206a3b

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1445248808\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1647129491\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_42432206\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/1336-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3416-34-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3416-29-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3416-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3416-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3416-44-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-2589-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-1439-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-991-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-300-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-2570-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-251-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-1763-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-207-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-2612-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3624-72-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4296-0-0x0000000000610000-0x0000000000614000-memory.dmp

Filesize
16KB

Download
memory/4728-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download