Analysis
-
max time kernel
78s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 10:28
Behavioral task
behavioral1
Sample
19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe
-
Size
690KB
-
MD5
19c9ac3ad43cfef8c4a5cf3640f6194f
-
SHA1
b256386cdf83edc56fa76cf0e8828c3b62991c51
-
SHA256
da40cf61eee19f3a427e9697956aa7af9a46c942461795bef1aa3dd385d4ad44
-
SHA512
e75308831ed8d5e7ab24b0d122775d966b9d8dfd7ddcfaff57b6615623d7558b9b1b6d89a28051188f6b220c3633e0c8af0a8fbcc01cabdd6087c6689ee00b71
-
SSDEEP
12288:0dtGgozqi5paO0lp9USQVUSyrkA4zZ6J+v5NdTgxWaSTAzG:m2eas1USImazIwPuIaSToG
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 7 IoCs
Processes:
resource yara_rule behavioral2/memory/412-0-0x0000000000400000-0x00000000004B3200-memory.dmp modiloader_stage2 C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe modiloader_stage2 behavioral2/memory/4656-6-0x0000000000400000-0x00000000004B3200-memory.dmp modiloader_stage2 behavioral2/memory/4656-9-0x0000000000400000-0x00000000004B3200-memory.dmp modiloader_stage2 behavioral2/memory/412-14-0x0000000000400000-0x00000000004B3200-memory.dmp modiloader_stage2 behavioral2/memory/2508-15-0x0000000000400000-0x00000000004B3200-memory.dmp modiloader_stage2 behavioral2/memory/900-13-0x0000000000910000-0x00000000009BA000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
rejoice08.exerejoice08.exepid process 4656 rejoice08.exe 2508 rejoice08.exe -
Drops file in System32 directory 64 IoCs
Processes:
msedge.exemsedge.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d3d123fa-0306-48d8-a52f-39d065ee67b1.tmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\79ea29e5-d233-4aad-b683-2217127eeb95.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\226438e7-0b27-410f-b364-3a6dc5947bc6.tmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe578fcc.TMP msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\f482ae22-06e5-44b9-99fc-adbb58d5ee50.tmp msedge.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\e0a25d36-8f4e-4a2c-a771-813213737854.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\fe20ff65-b899-4901-8521-0eb4bcfed182.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\e1831d0a-0268-44b6-a2c1-3bdde2776541.tmp msedge.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\79ea29e5-d233-4aad-b683-2217127eeb95.tmp msedge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run msedge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-667E9040-FEC.pma msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RFe575f66.TMP msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rejoice08.exedescription pid process target process PID 2508 set thread context of 900 2508 rejoice08.exe IEXPLORE.EXE -
Drops file in Program Files directory 5 IoCs
Processes:
19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exesetup.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DaverDel.bat 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9e054752-fef0-4429-8c1b-ee5641a7531a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240628102819.pma setup.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
rejoice08.exedescription ioc process File created C:\Windows\SetupWay.TXT rejoice08.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
IEXPLORE.EXEmsedge.exemsedge.exeIEXPLORE.EXEmsedge.exemsedge.exesetup.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0" msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEToEdge\QuietExpirationTime = "133641304968629590" msedge.exe Key created \REGISTRY\USER\.DEFAULT msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31115665" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenPuaEnabled\ = "0" msedge.exe Key created \REGISTRY\USER\.DEFAULT msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425732373" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "12" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\default_search_provider_data.template_url_data = "E619582CE703960A355BBCBD01F81F49A8DC4B202D1C4E40149C1D5E0F7772D1" msedge.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXdn5b0j699ka5fqvrr3pgjad0evqarm6d_ms-xbl-3d8b930f = "0" setup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\F12 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mht = "0" setup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "1" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lastrun = "13364044096863575" msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\geiinlhabolacmdgdkbkppfmijlemjep = "CC16E471927B0064B0196E1A33248C3118BE67905287A69E6F8C0EDA7A9666F9" msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\ihmafllikibpmigkcoadcmckbfhibefp = "9E4A66CFEAF78BE754FCA8142B9E04C9D66D1ADA20348B7698CEA6E93D94A3B9" msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 7b9d822a7ba1da01 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006593b1f73f4ea9459072eed77602f22d00000000020000000000106600000001000020000000fac10427b34d48c7b9e04eb64c3480258af74c1eb070c6442f5ca46675ebdfdf000000000e80000000020000200000007192790993744912edd1afa9d5e682d2a3c26ff894a17b6916f54f8ec832564e500000001bb27338452992858e6eb74832b4c4555066f88abe808bfeee42afe73448e8acb24c90167da00a07f7a4b074ffff87187b85f17c905b4f593271e51f7e12d731a0e7082e08911440f3cb2da7752d27c040000000298377774d71efc9e1ad44045328c9976cfa8e7737381ac5b2109161651b083d611278079c5ef399dc5ae000456de29347598ab15735c793340681dbe9f38cde IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e807060005001c000a001c0010003300 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9_.htm = "0" setup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX90nv6nhay5n6a98fnetv7tpk64pp35es_https = "0" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@ieframe.dll,-12512 = "Bing" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\pinned_tabs = "8E81150E9A755483F1D379E80225D40FAFB771C06C8B57B468EBDF5494BCB6AD" msedge.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\MUID\ msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\state = "1" msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723_.pdf = "0" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.account_id = "DACE4C7E6F47319031F407F6BF0CE1A60BB27739F500E4CFE2CE8FE4016E9995" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\ihmafllikibpmigkcoadcmckbfhibefp = "859BAC02B6532B922857EAAF32EA0C3B9BD2535E79FA3349433FD3D1841547B5" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807060005001c000a001c001300bf0001000000644ea2ef78b0d01189e400c04fc9e26e IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 7b9d822a7ba1da01 IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\session.startup_urls = "F42CCB3A3BED59D5A0F1BD6F4E8A703BCD7496284B2E9BB191243EE285D18B4C" msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "16FE27D7D0FC70B58B806393232A67CB0F402049A59E6FD5D360C90E8F6D2C7A" msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 4740 msedge.exe 4740 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
IEXPLORE.EXEpid process 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 900 IEXPLORE.EXE 900 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exerejoice08.exeIEXPLORE.EXEIEXPLORE.EXEie_to_edge_stub.exemsedge.exedescription pid process target process PID 412 wrote to memory of 4656 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe rejoice08.exe PID 412 wrote to memory of 4656 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe rejoice08.exe PID 412 wrote to memory of 4656 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe rejoice08.exe PID 412 wrote to memory of 1780 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe cmd.exe PID 412 wrote to memory of 1780 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe cmd.exe PID 412 wrote to memory of 1780 412 19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe cmd.exe PID 2508 wrote to memory of 900 2508 rejoice08.exe IEXPLORE.EXE PID 2508 wrote to memory of 900 2508 rejoice08.exe IEXPLORE.EXE PID 2508 wrote to memory of 900 2508 rejoice08.exe IEXPLORE.EXE PID 900 wrote to memory of 2460 900 IEXPLORE.EXE IEXPLORE.EXE PID 900 wrote to memory of 2460 900 IEXPLORE.EXE IEXPLORE.EXE PID 900 wrote to memory of 2460 900 IEXPLORE.EXE IEXPLORE.EXE PID 2460 wrote to memory of 4276 2460 IEXPLORE.EXE ie_to_edge_stub.exe PID 2460 wrote to memory of 4276 2460 IEXPLORE.EXE ie_to_edge_stub.exe PID 4276 wrote to memory of 4076 4276 ie_to_edge_stub.exe msedge.exe PID 4276 wrote to memory of 4076 4276 ie_to_edge_stub.exe msedge.exe PID 4076 wrote to memory of 224 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 224 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4776 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4740 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 4740 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 1704 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 1704 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 1704 4076 msedge.exe msedge.exe PID 4076 wrote to memory of 1704 4076 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19c9ac3ad43cfef8c4a5cf3640f6194f_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DaverDel.bat""2⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:17410 /prefetch:23⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=a00424⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=a00425⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e51946f8,0x7ff9e5194708,0x7ff9e51947186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:36⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:16⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:16⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16994590435497822414,1247219569194734057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings6⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff773a45460,0x7ff773a45470,0x7ff773a454807⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\DaverDel.batFilesize
212B
MD527f5ef967d6cf984d8b775d54ecdfaab
SHA19f33945dc67bc28ccae0f4639ed7e810de1bfdf6
SHA256de58923fa2879badda447c32ac42cdf3990dd4339999d7d31d70af384ca8ac09
SHA5121d86a04c61da6743d863cde770a14797a2184f247b166ac44e1b932232fd466beb95beddb0a331e5a4e0389f65b78e3d99874088d482f1a96afb78b59b0342db
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice08.exeFilesize
690KB
MD519c9ac3ad43cfef8c4a5cf3640f6194f
SHA1b256386cdf83edc56fa76cf0e8828c3b62991c51
SHA256da40cf61eee19f3a427e9697956aa7af9a46c942461795bef1aa3dd385d4ad44
SHA512e75308831ed8d5e7ab24b0d122775d966b9d8dfd7ddcfaff57b6615623d7558b9b1b6d89a28051188f6b220c3633e0c8af0a8fbcc01cabdd6087c6689ee00b71
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5db8f8a7ea054d11fe962b239b1237aef
SHA1c85b6e9fb4fe4ab55df3875b88c5cf5dddcedfdd
SHA2569a30e93b092a8214985d09e744a6e8a9678a7119160726ad6356b96d4cdeeedc
SHA512de7fa8656b106d545895070fb06d281c53b31d2dd3e14f73c5738e2265d01ef042628d2da04dc1dd92577473090856b26ad06a79de6db8f6b06e27a4d0223814
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-indexFilesize
48B
MD5915f32a39e443472fc607cbac9d65d19
SHA1ccd20b02818916c7a73e61138fb19f9c22570f18
SHA25602dd7dd9350dfa9a095c5bb3fb662d03517ab0067fff3e2c0ff658eb15eed8fb
SHA5121491e3a24690ebdfb3f0fd1ba97cff95c6926bbef1de05de78aa195a114b9fc036ced8a4cf5214678deed493f96ae3deeb4904db70b960722bb3132710257dc2
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD51c9935b8a2f57ab4bc11c68301abf02a
SHA14e039ccaba0562dcf3f84b507d2e61095cc3b791
SHA25619c30a8f241b71718cfcf6a43f9e2743d3a31dd11e11a6d79267a921c0c8cfe0
SHA51251c7166a9e848a452594ebc7b425a70248eaec3b1688ce147397194753130e8c4ca94ce20bfbef0b56e6b323c6066520de43e74c8143c27c6eeb26a598159476
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5e9eed32e7d28e04adc7f44ae9184e7b8
SHA1296bf26a7d4804b5052eb867f8db2ae0e1ab15bc
SHA25671d4a4bb7438161e13ec1b0db91fd3d7f50f4a66fabae5f8db4d5abe2528e5c4
SHA5129e01d2d1520e989e694944de0b3f38fade9ff5ac8cc8d3cd8d36a439e7b6c49c58d16a82bcb7bea73ba56301544794e123b604835bb57a2593c8cdc3ac6643ea
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD51e28f4d3acd85be47186470389d8ceb4
SHA14562b3eaadf33ee2718196a009f085e93e6dd7d7
SHA2568d2351ade9b83b96db85f311cfea87466e1903266fe15c8bf7c83ae35a981ced
SHA5123f83b656bd6dfd76a225d0e0a02dc8867f2f4e3d5a1770a00bb3a8e8ad2480a49db570a477591df0be948516b4b56005f5f9a17d4da9796f219a7c7e724282b0
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe57569c.TMPFilesize
4KB
MD5cd5864751a098279f95a99cc697f1cf9
SHA108e4ab30d547c80c859a309fe4b42be98145e039
SHA256a1930bba91d7f1eab036e210a6602b8565de55e814178994f06153a7d1a19ef3
SHA5123d980ea2bd5e9fc0bedb9b2d360e181247a49c7ec32ddc12e2a0ddbeab77663ea305b130b2d9bc994cf35d16b8e933a3ac44dc851f64073cb935dc62e25ca189
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\876bed0b-c3d7-42fe-b3a4-e3955c0e9e4b.tmpFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b9f02479-1ead-4acb-a4d7-a2883c8e787b.tmpFilesize
24KB
MD530111bff8f622009ae5165462f7c18fd
SHA1a89a3261150467769bf32fbc86e189ff4fad221f
SHA256a02b5bb24d7266deb669e85ff4a7dfab8181da610f205278768909d5f07f9764
SHA5121eb733cd5c221e5439eceaedb00b0a2600dff9c2f19a7ad08873829b92ebad9e5321d177e6725dbc8d1a63ede4ce8396a5c2c475b8d958e194061a14a0df218f
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\e0a25d36-8f4e-4a2c-a771-813213737854.tmpFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
3KB
MD5158a72abb3fe137f092f0bd0d1e8a481
SHA1691b1fceaa7680e823a8f118c04138fd91ea8979
SHA256252c83475287b6b005edaecf7fc298db7b9fb4be652cbe2dd0242d8357d39b3e
SHA5128cbd9aa757fa83fad795588fe35fc6569178a5c6e78b2e58f1c12de2645feae4bd0e979d991cb07066f29928a4fe704be6f76d3d144ec329d6b6f3a9680f1f95
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe578fad.TMPFilesize
3KB
MD53a7d8e5b227a0bfbe0aa702831140fa5
SHA104f094e946c8bbe6f2c0971b36e60a32898df2ca
SHA2568c596b58925a0e06ddcba5b1416778c57c1936f8978530650654c82cb4597f98
SHA512fc2012e0caeb928bce81115cc006cc64dcd6f5ea32fece107f8d90c287a929281131f3a341cb185df6b6713f58be3e4f72fc8b7398fc24ebcfade10736c76a8f
-
C:\Windows\System32\config\systemprofile\Favorites\desktop.iniFilesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54da29c7650ec838b5ebaa98e65152050
SHA19461dca95436793f72ebd1da97c03f58afe00fee
SHA25675ae0ce2af6c4255f90c370f93161464010a45185a331ab13033b8b039b677f0
SHA512a5c6370c1cb444f40f89e51f20f87a05f26d8b280cc2ac113088aaeb691ad770f60fa0d12d1e896d05e0b708454c90f08779f058076f81acfa0a89a280a05178
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.datFilesize
20B
MD59e4e94633b73f4a7680240a0ffd6cd2c
SHA1e68e02453ce22736169a56fdb59043d33668368f
SHA25641c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
-
\??\pipe\LOCAL\crashpad_4076_IRJMMCHDBFADWBEVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/412-0-0x0000000000400000-0x00000000004B3200-memory.dmpFilesize
716KB
-
memory/412-14-0x0000000000400000-0x00000000004B3200-memory.dmpFilesize
716KB
-
memory/900-13-0x0000000000910000-0x00000000009BA000-memory.dmpFilesize
680KB
-
memory/2508-15-0x0000000000400000-0x00000000004B3200-memory.dmpFilesize
716KB
-
memory/4656-6-0x0000000000400000-0x00000000004B3200-memory.dmpFilesize
716KB
-
memory/4656-9-0x0000000000400000-0x00000000004B3200-memory.dmpFilesize
716KB