Analysis Overview
SHA256
d3576d029431675ee0c82f7d6984080d9ac0264afa2c83a52a0ea25190ecad2e
Threat Level: No (potentially) malicious behavior was detected
The file 82a327c366199e2f8dd5449d2a92979e_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-30 01:23
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-30 01:23
Reported
2024-05-30 01:25
Platform
win7-20240221-en
Max time kernel
134s
Max time network
128s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c5650930b2da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009937ead2a2e27e42aecc87b01b21cfa200000000020000000000106600000001000020000000ae2421a20b4cec06c78cdc0bd211d0633d01d9abd243c8d921b6f005afa60206000000000e80000000020000200000004ebc41c172613e39f2fe8fd6791f8f5413726b19fb093d6133fab6a0ba97e5da2000000043efe78016af6c9d49a1f732da5c86b6d92a37b9e94a5d3506e4b4893fa1664d400000003b2fb71c8f22fd8f19d21e67b640a3739398627faac3ece689ffd3e19369f24181c68937d02ec4f33fd0632792afe30fa9073fc6beec83a7c7e6a04f39f623c6 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009937ead2a2e27e42aecc87b01b21cfa2000000000200000000001066000000010000200000009405289f93c4b3865be3563751bd43e37cac6beb1a28b00dc69466a48ffb1ef7000000000e8000000002000020000000ae977d2926532b87016d9399eca0dea8ca1ee36648263093a84ae779d3d2722290000000fe3f7ffce818c98ea35f8d00fcf5de2f9af8f60a44b4d62659eec214aadf8e133f4054a86fb34cc3548c2cdd2dd2d74d5d5ec697390f410c2a38f6881e23368801515308435bc5b1197c2a2312b0918b585dc6b5024eb98803a220940a53b02b20a1bbe3946eb5351314178789bca047b0c805fd629cdf60c9f6ee3a15edef5b2ffacbeaf31b465d1efc853527a81430400000000e3e5f92ab6e8e651295a594b6b1154f44df5ebba04048503030c5dbafeb1dce7d3bbbf1fca58b71701cda9dcc170a75a2081535043ee78ec7bfa2eef47e0342 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423194070" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34698D21-1E23-11EF-93E2-EEF45767FDFF} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1580 wrote to memory of 2476 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2476 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2476 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2476 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82a327c366199e2f8dd5449d2a92979e_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | asktheitguy.com.au | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab342B.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_8DBDB314F582CFB69D8C0359C37384D1
| MD5 | 0b1b93b840cd03d08599fb73f2ea70de |
| SHA1 | e53c4dff546f8cb02b485fe7ceedcb1a29e2c8d1 |
| SHA256 | 4278da055ed875020c94f2a8ce428a6e6973c8d1d395bf12bc04e2ef8764b152 |
| SHA512 | baae21b742c74600bba289b96b569118e69da68fe09abb8aaa447d3f6cc63d954833de245b9da62dc0032b1658dda295ad68358edcaf8ffe0c37bccc4273bd99 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1cd5e45601a9471f05bb17cdbcccc529 |
| SHA1 | df5f6808b78663e29aa8559000eb7bd4dcd98321 |
| SHA256 | 50d6dbed311f8e64082b486815b4fa1dd2c6e296449f5b41e321a0188939ecfc |
| SHA512 | 69ae83b6116c2bd3f67aae57fdfcd27c7519153e94e0f24174dacbe1e590e8a57455359e3aaad644de2252d23406a4311759a063184a95edf61ac79a3687287c |
C:\Users\Admin\AppData\Local\Temp\Tar4B26.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar4C19.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 60bf83639815a523e4492d7823694f91 |
| SHA1 | 0c05b19fd89de292d926640d2ecc3b4fa89531b9 |
| SHA256 | 0811475679bc3b1e0513216b4fc3b070985d62a9967a231a5778b4e57bd04d25 |
| SHA512 | 393a85cff158f367d93b423c05509d02180ffacc151faa232ffc6d8d7ead6ebe633141f7e6e9534c21aab978684b7284a576ddb455df3a94755cba179e1b9450 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8482688556f510e1c505ac18a9f38659 |
| SHA1 | df119a4381cd568763fae3b580743d80ae558765 |
| SHA256 | dfdd99a53c64529e43fc388a0c3c03c5b973fdf94e4c4be5e7bce4f97ba80948 |
| SHA512 | 37a7e8e684f71d77fc7434e9650f84814a6ad18f3e421c507a812c1f0f46ba9b8620c1878a6b81debf00dc520e9f2a96b10bd7280455f4479ac5e9a92fb1256a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e1ab584d217d4414773271ee860ac59b |
| SHA1 | 88730de6accbdcf5eafc529bdef5418f73738db9 |
| SHA256 | 2eefd1d8a30f746681f8962d09b065d288918aad5467ad5b6e6c00d5c551c9a6 |
| SHA512 | 56629f5cdac995730c26f146bcf088ff1bb4a15f17f96619086eeb65a50aac2f887297dd54f6d89895444420e8ed2d53d090f8de9083f99732ffe2822ea38dc7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a01af69f316ade9f9d88e41196310b87 |
| SHA1 | c87d690267f7974ab2f6c110ef00a6eeaeb1e924 |
| SHA256 | 3b04dba0b883033a8aaeaee44d8f5001145dca38be3294dd26eb6770bd61bfda |
| SHA512 | 6d601778a8e9943434990b46c3121d787b74e779905c0076eede1dcba923b7173ccb3d4bc6e5e1bc3205f613e1c77535ca8349774c01508afb81017cac3b72f5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a8c767808a06e4d5ab1f99dcdb1f6f16 |
| SHA1 | ad63da843efe94443817c67d2c66ceef5f9a8620 |
| SHA256 | c221c08b49c48901637f203be21fd9170a96bfd32cb469bc2e0c13138e0123f8 |
| SHA512 | 11817061cc3d0d620ff08320df875d61d052d4090924c123ae9470b4d1712d499797e72750e707b21e98c96fdd802d2a227cf09718db8ec57ed7d3ffb211d940 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 01f1c0ba1fe89b213fbf655d38b1aa10 |
| SHA1 | e1e6d9d8e18fe736f56802edc1c57c654b1a9c1e |
| SHA256 | 966e8e6b4ac282cb75301a581a9d729796b7b16019402797e85c0bc0c95df0b7 |
| SHA512 | d8e58cd506e8f1f2ffdd2d2be84e13413e4f4a8085fcee88f7b858ac65f61253c99e4282f8d34c1cfebf2cc4b7400bd0a6e04e315ea78e0b3ade146e3bed6283 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 31c82cffc8a65d792065837b7be96358 |
| SHA1 | 08dd464b8393e9c9eb038b567028bce6ddb4c6f4 |
| SHA256 | 8e61bc9773c00f3c1418111a19df0aec79e3b032fc5f720b7add1008fb39961a |
| SHA512 | 9b2dcdfadd94332154dbe58981d9072af367d7c61a2252387bbdad1f2b93b99147e4be5367ff56efb9533b89d60f846fbf7f90ab93b89394ac08cc7a9d4d61a3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6a451ffd404099ff73c27f9411097701 |
| SHA1 | b3fa020602d382b9bbed172ff6b58012e8595974 |
| SHA256 | e25db454d27707444db7cac9182cac42f30075d2779e30c4a99c9af8f840ec0f |
| SHA512 | e91d6b4b9bfb9892aeea2a55da8e114caabaaaaa967b6abbd2e398ff81d3301935e37b89db9f12037f415ae1ddae838441d3ed250d8daaacacd03ca0cc2921ea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7a48b9f261f06d4d3e730a58bcf80c08 |
| SHA1 | c43af14f1cb7ebff9049f316156c1cb146c128c0 |
| SHA256 | b6719b0ffead5507a6544f68b60a702a829c7c1a86d7a33eb61994245d54df74 |
| SHA512 | c8f07160b3a6434d226944a2575ee5bb9f75f3e2a464558d3b3db8cf12f48e6487ccdef72d10cfee78216496b834ec375321314a6d654b39f41517714d589694 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5874d249cdb2baf866a22acd6691b6aa |
| SHA1 | 3ba540328e279775c9fc8001b0c5a11b4d203185 |
| SHA256 | 38b2544424767667d803f65fa28944a8b995c08ca77f9cbf3d6302a1637d7cc2 |
| SHA512 | bc7499666a1a05014b71c8188e0c09ef3a57b57e139c29c417dcfdd55af1fa1fe7e594690f5b3ea6e7bb2274eba1b9dae4d50a5e1dc1e4663f8a07e22b168759 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | bbda0ea97f1e77d0d4956d49e425d12f |
| SHA1 | 8aee109649243db7c1945bab30d14139e19c3fe7 |
| SHA256 | ecb10a3f6c4e20ae909365a919f60d528d9e68d41a1081291c44c563274d3b55 |
| SHA512 | b7b508da28e9fec0bc567a75606fd4758cd361a108027c1c22b996e28d2c42e0658404306fe1100de075ff7d13ad5cef8a7d980d542f749776bbc49e1a2d758b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fd131b57db568ac2b52082c24fffe6af |
| SHA1 | f27e32135599e5ce1f87608de6c61d483dc86c18 |
| SHA256 | 01d2c39ecfbd68db1296c2ac1632c6ad3880f2bfa86cc1016c80212e77beaf32 |
| SHA512 | 90e1b23e1244a374af7bb189bd44b655322f318a352417b1d5d1de4541b153d4c0c8d4bbb29cb9f326ab4d5c06270c1de3c65a71a51e1b4341cea89832e1f8fc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 13c7e275dfd73e632388765e1c507bc6 |
| SHA1 | 961ffdb125cd00bdf0e8eac40fab6bfd33f571c5 |
| SHA256 | 937f94b59f42767e8eaf32d0a1588a7163b93717e6093ad6531acf0fe87a4f5d |
| SHA512 | 9a239c0d9466c660dea4a246e696cedbb019ada96d55f5fa975e4aafcc5cf092711744ac790b4ec104fc3810f38dce489ab26c4a92e7ad141b5afac4bf70a363 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | df2dc39cf34e7c99e1660474f9c29517 |
| SHA1 | 7d1555471b5db43d2c41ffff4847e1d41b01602d |
| SHA256 | 12e4b891a2afb6ec3dfcef16975a274b63dfdc30abe886793cc0f87700ab787d |
| SHA512 | 2c90535ee3db7d08173f5d5f6aa9517133b2d478bad31bda99f71ca2d0874dde16931c648bbd03562cbdd00f04f036f8d8d83749153f64ec74d73d0196fd67a8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8a0de0cbdebba657de7b5f78e1517486 |
| SHA1 | 94b94ea95757915752f132e477f6958379c21cf2 |
| SHA256 | ad1e47dedc01de8cba3e1d0d9fafdd4f20d56861ec08bfe1b3c850a04b01b1df |
| SHA512 | 5e634f636c44583a0900d93cbe92fb0a319db079844aeff627ab04a0eaf50ec9d318f1a08c446023204085f9e840b679fcb18353c222cc4139d1883ae99a5d0f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | bd977748f20f838f440016a05234278f |
| SHA1 | eb8c098c8391665e9ef47b4a45b187485468c1b2 |
| SHA256 | 0530fce5c61bfaf111897b99300755b7870ed9f0cf1bd6e6960e9f29f7961717 |
| SHA512 | 1f03a12e9bf77b5a5bbb400ae95964b65dd6d7290e2cefd29253627322ea224e3cc8cb624958e001c29e8f5fac23d25c524bca2814493201c453339511960926 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 859082d535f21b2c52824eb756bb16e8 |
| SHA1 | f2d538364957d2933d5ea31c3784560be2d7c6b9 |
| SHA256 | bf275a2ecfa8b73771134647856163aa8c0e06325c57eba869f3b394e5ab763c |
| SHA512 | 87a56503837da96ac0b67b4fb1708e5371af7131f5edfc23fcce13f34baacac7ea60032b5ba57cf841b574063896028510e1d3b86cf50ba068c7332ae249e195 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3c4ecf8ddde848b9e7e1310dd6e431c8 |
| SHA1 | c571ea557f9c582799cc5aa17543a709f9f7c20c |
| SHA256 | ade30e405b2e44c1d6bdff8a6d8e9a1cdfe7753914ebfb1064d77fc252a47349 |
| SHA512 | e92b7475ce2072dc57fdb4383de4c5179c5178b1db57e7443a0448efe57c88d0cf2bc11c79271666bf727a6801400617302c27c718aba6fcd1c65819ed3ef84c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 677590c63309cb4cde94efad4c550117 |
| SHA1 | 3c4ef048c99d120a07c4836f775465c309cc49bf |
| SHA256 | 229472c4cc0a1e9a1bef07c464eaa55fd803040c28442bfb147c960a8b09b69f |
| SHA512 | 60d7a84d4b251dd46223db52c2cdaa5d67c4019af11c23e4bfbff6734cabc8e941384d60570bb3e1a7126c3af88c578d018d538bc19456536907e8e65561d7e2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2da944fdef6fa9ba39164c9bc901a892 |
| SHA1 | 1a78ab0bbafded0ec4ea86fdff3fa490ad5d86c3 |
| SHA256 | cf27e2a79b96f48f455fbe9e920d189ee001184c47bb988f06ccd426e6c0d7ab |
| SHA512 | 403cbbe219b166ea7e7b8e3d833e5e1e7059fa927257763ae1712743f2462f242a21d86fe6fe339220ba6b3335470566524082787f3c42b99dffc4e73b08970a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3f40955374bcaa8d09b7ac4639c92546 |
| SHA1 | 42531953c0a3ff8e0d80c4f92078f99c68ae7bf0 |
| SHA256 | 1508b67948af3416048e6b2d3c3c6f9648601a2a7646234411f4bd6fff9de517 |
| SHA512 | 32148089b93697aab961496972e5f1331c28c65879162a59b2b9e4fc7ea00d050b8c02ef647637e27459e8b7ee83fa3fa6d8f5159b54f46b05dfb5016f973426 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c425e9d0e323347316f822eda383ef71 |
| SHA1 | bc7c849737e48cf805ced5888694f1fe2d6e11e1 |
| SHA256 | 4457c104ffa46df109d9a97f87ac3bd930922180b01f6e91fa142ae1456dc38c |
| SHA512 | a7f8477afd4acd71ba42b7de2379649f0c141b99c121057d8b3aea50de0accec3b8e651fdf55ee3e8c1e4e7b4871bbc7408c912d905d7d56af82cff1f9b4ce78 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-30 01:23
Reported
2024-05-30 01:25
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
140s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82a327c366199e2f8dd5449d2a92979e_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff851794718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,625669075444232546,17481385295600822851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | asktheitguy.com.au | udp |
| US | 8.8.8.8:53 | 42.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.251.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4158365912175436289496136e7912c2 |
| SHA1 | 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59 |
| SHA256 | 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1 |
| SHA512 | 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b |
\??\pipe\LOCAL\crashpad_2812_KAMUQQRYOOACZUGQ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ce4c898f8fc7601e2fbc252fdadb5115 |
| SHA1 | 01bf06badc5da353e539c7c07527d30dccc55a91 |
| SHA256 | bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa |
| SHA512 | 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 84facb34392f655c2795e041ca1d0489 |
| SHA1 | 5b9b9e95d9029298956083c996c3bd0252883321 |
| SHA256 | bcc2bc36ad7c71b88f12c0899ed688f7ac796545deca81391e656ae9f273fbe8 |
| SHA512 | 9962fa31d55501dcc8f697f3cce59576041ae6a80f5bc236c009f4a6c1bea73ee1965bec2b85c38ccea177c52cfeb0a311a5e2d404cb22fad5402f4fb4e6ccd5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 75e31e531f1a5794005ab82bb6fd7387 |
| SHA1 | 8b3e34f57ec12eadf871b3bb277a4c756db4691b |
| SHA256 | 15c21a53e675ecc5ea281376a29fede9b4ca8032aaeea916e9aab20b293da63f |
| SHA512 | f62caed8fc647e89a5e2e70f9cda170af8afa7ede3a8a42e9ab31983744ea2c1c444697eecce5b02c48f88db3d3a87eebf3716f9edc91fd1f527844481906c80 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5684d8ee2f6e37b070aa4a4954505270 |
| SHA1 | 19ca1097ee47c13a43b549a05af0b32ed456de4d |
| SHA256 | 79a1eb155117c500199ad9d3469b6ddbd7068897bd23dfd4d6f9ff7ec269aaee |
| SHA512 | 9e6a2959fe7f1d7986f74bfa0140491f803080a887e344eafa48a22dcf23f5ab17be5101d4eead72bca44afd26f22392bb57d2127507be29d12a1774b4cf9317 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | e0eb75a8778d875ddfbcc742eef68e89 |
| SHA1 | 23d654d4e2559696dfb322cf869c9d2a55a14019 |
| SHA256 | b69137210134d7541fe13b2c7eb93a3de8c06585fb4442644bd15355a2c822a1 |
| SHA512 | 5911bfc4aeeec03d580e2d860539981130a73e69689de25ae6aa3df8e4de9eed305a978364d7b5f1e4105fb3ff1912f1847e6edae18aef67d0424e6910acbef3 |