Analysis Overview
SHA256
a7649b2d10558ef34f24a40feafd0d2b4c96d89a03cd617d9a3a88beb3b4e2ad
Threat Level: No (potentially) malicious behavior was detected
The file 790745e107e6ee354f58d0315f116fa6_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-27 11:39
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-27 11:39
Reported
2024-05-27 11:42
Platform
win7-20240419-en
Max time kernel
134s
Max time network
135s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422971854" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D01D4071-1C1D-11EF-9A67-52FD63057C4C} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1680 wrote to memory of 3028 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1680 wrote to memory of 3028 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1680 wrote to memory of 3028 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1680 wrote to memory of 3028 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\790745e107e6ee354f58d0315f116fa6_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ui.hub.toocle.com | udp |
| US | 8.8.8.8:53 | china.toocle.com | udp |
| US | 8.8.8.8:53 | ui.b.toocle.com | udp |
| US | 8.8.8.8:53 | img.album.toocle.com | udp |
| US | 8.8.8.8:53 | hvf.nhdny.cn | udp |
| US | 8.8.8.8:53 | 31.toocle.com | udp |
| US | 8.8.8.8:53 | china.chemnet.com | udp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 180.235.65.12:80 | 31.toocle.com | tcp |
| CN | 180.235.65.12:80 | 31.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| US | 8.8.8.8:53 | push.zhanzhang.baidu.com | udp |
| CN | 112.34.113.148:80 | push.zhanzhang.baidu.com | tcp |
| CN | 112.34.113.148:80 | push.zhanzhang.baidu.com | tcp |
| US | 8.8.8.8:53 | ui.s.toocle.com | udp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 180.235.65.12:80 | 31.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 163.177.17.97:80 | push.zhanzhang.baidu.com | tcp |
| CN | 163.177.17.97:80 | push.zhanzhang.baidu.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 180.101.212.103:80 | push.zhanzhang.baidu.com | tcp |
| CN | 180.101.212.103:80 | push.zhanzhang.baidu.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 182.61.201.93:80 | push.zhanzhang.baidu.com | tcp |
| CN | 182.61.201.93:80 | push.zhanzhang.baidu.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 182.61.201.94:80 | push.zhanzhang.baidu.com | tcp |
| CN | 182.61.201.94:80 | push.zhanzhang.baidu.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab476.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar1099.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fe19e3dcfbc0ab46d85deab83743e8f7 |
| SHA1 | fb1717ffc71b4313922e4afa2845eea20f77cd3a |
| SHA256 | 2137356f4505ac9484da3c3df994eb6e372212f6b0f73605bb8b1539ba7af458 |
| SHA512 | 28d3dd34edb86acb72ad50ed5b0880ceea02e734001b8e88463fd3d0d9a75585f2a29d1a1850a919bcdb8677c299f50134d00dba3d2d914d86b4e96a07524520 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 36f3ce31cbd43447505b1913e255e35c |
| SHA1 | 2a97faabaed25806ddbf616280626fab2549670d |
| SHA256 | c4304c9be6a5a1fe7cf17bae6a0e4d87fe27eeb1b3f03ef953e44ce9430342d1 |
| SHA512 | 0e88f0d1ffe5199bb281d0ed74d4fce30b040feb20635bbe9548f47e9ce208e04be551130e1c45c8b69173f7fc3454eb71940741471648bf61aec7a7c83cb214 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | af66e207a512c066b4fbafa257dec9b5 |
| SHA1 | 75f7a2d27cf69506740722e2db8c938e4a6ade1f |
| SHA256 | b985f804ff027344bd8c8d44a8cd566fcf87cfa52359464fa53137ccf7e33de1 |
| SHA512 | 6f8f467966c5bf13cbb564c221fd5c1ff086613793121f55933e5d999e64691fe3922796b68a024cc564334212503c1d93aaf3a1d668b631ef07c8448a59b2ec |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bbed1580d86c55ba36e207fc2148172f |
| SHA1 | 7087816e929dc6f6e4c024b2ee1dc7ad95f7f7ab |
| SHA256 | c6f45d60f16e57ebddad34dd116b965d340a6e595b67c89e978a20600f81a28c |
| SHA512 | 05225364accb503905ccad2bac94205f98663b9abdc4791ad10485390806a2e65a08cf45081d62fca9965776e9201a41b8f16a69ab8fd9d254218574f7b91475 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1cbcf0aeebcfb3bbabeb38a88a5c93ff |
| SHA1 | 743c9b3b9cdf1efbfc2e6c99cf235fbf01ffdad0 |
| SHA256 | ea0e84d1a64358f8f5fabe2a8bac71f9f2be42309742b1ba2a4b4ea067f80dd1 |
| SHA512 | ab02dd2f4b186e168a64af99d261ac1802dea0b8ccc8fece962139eadde7aec2dd6638e7bdf679e2bba823ad41efb7478dbc1553ea31aa02a7179a65e907957d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 914ec10c796f1510e841a533581e8b1c |
| SHA1 | a15bd110afb1aa60f68663afc58511d19b6930bb |
| SHA256 | 4a368f7228008d54cf528dd7ca2c4d38ca4cc70427ea453a98fdac21280478d3 |
| SHA512 | 782428d5c1e33735e0e5d0eda7ddd6b42aef129c3624cbc1af021aa9feb1a80fe004fccc81149322cf5a9b56fe534373bce6dd4ed349bcfbc493abcedfdd0deb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fedab4afa04a7d3defdde63cf04a7cc3 |
| SHA1 | 9beecf93320f13af2f82176271a6bb288a66c7b0 |
| SHA256 | 5e5b3dcb3bd124f4344f4b819cee10eddde88b9e2b9ee4e5e794dce02a164bb0 |
| SHA512 | 388f30ac1e9219bc0912d9b7f1a8dceaa679ff07cb1f428ac78c8f1eb900be564834ff7c18934800ae7e47eb5d9758f1d6c116096db0756dd15c07e423de064e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 864c7ed37a28aa75da4979975f72c170 |
| SHA1 | 9b9fc19f681df17c4504e303f4bb0e0b9ff244fb |
| SHA256 | 85b288c4b00ec7fc23b9b2ac649918cd592e48c816e48521cee3bd053f2731a3 |
| SHA512 | 3559a63bb87e5d9c983f66d7fa3ff05b00f965560f426e289e47c6f01be6e16b247de7ad093cc2fb75a428bb8ff59551ab9c5cb75006e9e1de9baed6874ac4be |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 778ec57345676e2ca09d0f47331cbc85 |
| SHA1 | 3e587dad88d67c435639497b68b07bca510be56a |
| SHA256 | 5775db4fe62dcabdbfaeb5d07123d0a545a4203d804e55d6ba209f27827fb9f7 |
| SHA512 | aec4d29d075e52466d125f546c31adb8a56b598f746f99faf59175167d1d63f62416cec273f000945d80b3f0b0e90e183b88d17a1998e1990b12c8bb5dd5dfce |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 14da541b2777248c95a17ddaf9764ad3 |
| SHA1 | 656eed7895e00ff7538874b4f5a8ade54320526d |
| SHA256 | 03859d518426d25c3132b3af4aee07c9da49d43ac415a2a2eceb9b5062036e47 |
| SHA512 | 8ba1354c3001d98ee72205644c28649d6ba8269b806c8ae6c3313a6bc4e6c49400abab7fb515072ee417b3cd9c43e998d3fb2478b7465431af28beecf76795d8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cbd4310f50ac1e65a72e77ca85e20265 |
| SHA1 | 8004b4e98c6cef3c9bdec46457f726867d4f8bf0 |
| SHA256 | d34d9ba2986cb475b767253811a9077f0cdb9007ff9b2284acc952a1a3d1de5a |
| SHA512 | 58145e8e071f6e5be984763aff491aac375792768405634bf111c00cb9322e4c4fde5e6f82a031c7245795975dadbdee73bb33678309c82f67bbc9868aaf4d44 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 50d22a840065828ac3c272db9c85339e |
| SHA1 | a070a0ec106ed2140238db8693999796f30bb93e |
| SHA256 | 5d5cb5ab9aa42fda649eeaf3133f430055a8920a76599f30ad909c28893d1905 |
| SHA512 | 643fae81375616e7e4360fbbf3afe7536b34c4cbe42ee7b204ee2454e50759889a755de39ee1cd47866a99c52d57b3b0d3b1ef95c922b7b27af1e092874dd66a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2382e0831875d4fc41390bda47835d33 |
| SHA1 | eca06583c5601e2a67aa643248af8074f5b2c893 |
| SHA256 | e5e59ba843c832dc12dcf40aff514b308bac56e360b641746a8a73c52ebdffc2 |
| SHA512 | 0a46eb31ef068dfab1c5981e78604bdea9bdd4052c0b3965ac3e58f9cbc7eed89a921b5262d079ebbd388735afb6c2479e10ab92132647ac09563d29f1b03851 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 00361e9adfce04a1c04c51c6fd2f93a2 |
| SHA1 | 0c0e365bfff82c7db9e3598595ca43396d3264f0 |
| SHA256 | 6d49b284d1f46c96a1f2147a82b36aa6ec51f4696d2e767e9eda1c97db26469d |
| SHA512 | 529bf88ddb3fbf79eee195fbe0704894d589049edc1e9c1961b9d0a301d976fe05f4d7e4670854b7153ee697b17d36c71056dcc5fc150b630b40af84ae586d5f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | decdd088738ad57f3f4d136291a3fbd1 |
| SHA1 | 64fb6994956fe93af544df87776b9a671f6368b2 |
| SHA256 | 2b05448753a6bf7990ed383403d8f82ed81479457244c96cfd96986c49b61d4a |
| SHA512 | f8a6a4271154a1921b4e27bb19c1a94b9a0e2dce703dc86f5bd68835f6ed13404b39ea2b1cce2d2a78c5c7ddde7d177af46181b2d7a0319f3ed2b393f0e72d15 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c912eee2edc675318557dbd3cf4f83d8 |
| SHA1 | 62c801a8de7f27b1f1815bc0b7f1370a019d3e10 |
| SHA256 | a6529a203dd90423978403fcefa6e2fe7b1c00ee9eef546bad7408a073745d30 |
| SHA512 | b3b8ea6cab36196ec5740087226948174c5ef1446325df52113b48eb44473520be406df251265b8418235a22e22bc6856b20bbfbb2e2e5a1ee8451158eaaefb0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0b8f8d9d27b87ff319bcad3ba2348f1f |
| SHA1 | 5d784367f05e60aa1809a1aa10d628e0e03a0e07 |
| SHA256 | 3e37b9c60708fb084cc13688abbec85f4522d3c13d2aa257898c1f84c6a553ff |
| SHA512 | c03c682159c4580c951e931acac671caf7d42ee2ca253d27c059856d7637d39802ff08207ef792b5527fe07c01dd279bde0090c1880c8f7fde61327f35c5eceb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c9973f5b8fdb750753106765f70cb398 |
| SHA1 | b6dffe99ef6cb56aabdd04a67d18208dc35d0eee |
| SHA256 | 63dcce17c372977f85e02912657496ceaa66efe9bdcfee7eb26edde9827ec426 |
| SHA512 | 46b57fa911ef2431dbca3f595d78df7fa805804a5a788fed64c7adb089655bcba2f2c887bb00c4a4cf3838d43a4d59f536330fd7aa500509b525b8cc84031d76 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 854bbf51d71af10065d735f32308d930 |
| SHA1 | e716c032f00d20571c76079354518c4150b08495 |
| SHA256 | 49251f55f8dd9bf7552ca74769da7f3e47e8ce91fd181bb7da0e6f9d8a6f0b8d |
| SHA512 | 9560aa6021240767aaa7f54b1d2e2a561aaeeaa770f4983d9630771328b919e1489c090dac0eef01079119f169f9191f0c56102430567037ff3e663983254479 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cc4330300c77d0b9cac58a40850ac835 |
| SHA1 | 58f35100b892177f39f81122a605f58a9a843a02 |
| SHA256 | db0c48e19824d989b9d00be6efabfb89ac8e44a8fc8f8ed7182320b3a3bef716 |
| SHA512 | 021e9dfe0ff180684272fc1e5575f05de443f10f6b98d292fb02c96bb0a7c03a96916ca42bd00f1cc40f02074f80b6c9590993dbb36c048c34d167dcb0c80314 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-27 11:39
Reported
2024-05-27 11:42
Platform
win10v2004-20240426-en
Max time kernel
145s
Max time network
146s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\790745e107e6ee354f58d0315f116fa6_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4f946f8,0x7ff9a4f94708,0x7ff9a4f94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6124905194715180731,15727415817170553381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | hvf.nhdny.cn | udp |
| US | 8.8.8.8:53 | ui.hub.toocle.com | udp |
| US | 8.8.8.8:53 | china.toocle.com | udp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.88:80 | china.toocle.com | tcp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | push.zhanzhang.baidu.com | udp |
| US | 8.8.8.8:53 | ui.s.toocle.com | udp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| CN | 222.73.8.88:80 | ui.s.toocle.com | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| CN | 14.215.182.161:80 | push.zhanzhang.baidu.com | tcp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| CN | 14.215.182.161:80 | push.zhanzhang.baidu.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | ui.b.toocle.com | udp |
| US | 8.8.8.8:53 | img.album.toocle.com | udp |
| US | 8.8.8.8:53 | 31.toocle.com | udp |
| US | 8.8.8.8:53 | china.chemnet.com | udp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 180.235.65.12:80 | 31.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.88:80 | ui.b.toocle.com | tcp |
| CN | 222.73.8.82:80 | img.album.toocle.com | tcp |
| CN | 180.235.65.12:80 | 31.toocle.com | tcp |
| CN | 222.73.8.48:80 | china.chemnet.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 39.156.68.163:80 | push.zhanzhang.baidu.com | tcp |
| CN | 39.156.68.163:80 | push.zhanzhang.baidu.com | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| CN | 222.73.8.91:80 | ui.hub.toocle.com | tcp |
| CN | 112.34.113.148:80 | push.zhanzhang.baidu.com | tcp |
| CN | 112.34.113.148:80 | push.zhanzhang.baidu.com | tcp |
| US | 8.8.8.8:53 | 25.24.18.2.in-addr.arpa | udp |
| CN | 163.177.17.97:80 | push.zhanzhang.baidu.com | tcp |
| CN | 163.177.17.97:80 | push.zhanzhang.baidu.com | tcp |
| CN | 180.101.212.103:80 | push.zhanzhang.baidu.com | tcp |
| CN | 180.101.212.103:80 | push.zhanzhang.baidu.com | tcp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| CN | 182.61.201.93:80 | push.zhanzhang.baidu.com | tcp |
| CN | 182.61.201.93:80 | push.zhanzhang.baidu.com | tcp |
| CN | 182.61.201.94:80 | push.zhanzhang.baidu.com | tcp |
| CN | 182.61.201.94:80 | push.zhanzhang.baidu.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ecdc2754d7d2ae862272153aa9b9ca6e |
| SHA1 | c19bed1c6e1c998b9fa93298639ad7961339147d |
| SHA256 | a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7 |
| SHA512 | cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2 |
\??\pipe\LOCAL\crashpad_3588_VXAMUGRJUJIZFPAF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 2daa93382bba07cbc40af372d30ec576 |
| SHA1 | c5e709dc3e2e4df2ff841fbde3e30170e7428a94 |
| SHA256 | 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30 |
| SHA512 | 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | cda020f45a8effe2e346219f9d296be3 |
| SHA1 | bf85e9ecc6dc80852efbec4ff987da245d54c22d |
| SHA256 | ef83e70d75381cfa47361ff98ca9131f8552515860d847c0595ec5755dd9ed07 |
| SHA512 | 5bf0f66acd24f0491cd791ea87babeb7a2dfb6e2bacba0deea108469aedad4a6177e727dbe811ebb51457ea8e23149a924ca6e5ea94ff70ef39fb7ca2f5392e1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | b6e7d3b95430533c313953a16a06c687 |
| SHA1 | 5d95f173da1cc5e922b4043fb3fd15dab4ed5e3c |
| SHA256 | 98c4513b9669956c0144c5f317541f45c3b68e5ea980ad79e61d46f127809899 |
| SHA512 | dc7b837e57f7647d1db66f6944e4e108340665805e294a7025ab9bab1e324c792621b70942b866ef13059f15f3d66d9bd4a5969d1e5933c4fc1f988eccd11a47 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bd8a1a98c0575859bcfb666db43c9c9f |
| SHA1 | 4fd323d1accafd459a928bc2286f75980c944eff |
| SHA256 | d301c0486ed8a2c3e9e0ee6a313613836a2db432fd9aeb5d8f4090f530fa8d0d |
| SHA512 | de5e51a5e32d31df1c7031053b9f0fdc75341de541c0bd7d604d604d12bc2eb72c4d0bcbaeeab35fa9d20c8f8555ff0acbc2138d65dc6a8a59e0989a600087ff |