Analysis Overview
SHA256
0e1af61a01702b6db3ccfe139c918dfa21da9a086328ac00e1ef9bfc0869a5eb
Threat Level: No (potentially) malicious behavior was detected
The file 8c67c07a076a60ebf808528f6b96620d_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-02 01:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-02 01:05
Reported
2024-06-02 01:08
Platform
win7-20240221-en
Max time kernel
141s
Max time network
150s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E2A5D21-207C-11EF-9F07-6E6327E9C5D7} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423452230" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403b733389b4da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e3404daba58207478daffd0828ddaacf0000000002000000000010660000000100002000000086360014776a93552784eb08bc4ede91b9e8773912c9180e7e8d819d44f64ca1000000000e80000000020000200000000845d039cf203eca284558e017c535a52909dded647b307712358577fc45f6ea90000000ec5bab5908c772d6facf1af49b735e518c72266756c04ae75803a7cd09ba0a1e0fa8e9e820b1279fe95d913e671947d74672e3e0e1baff82af39305ce66cc2758f5988f3777b089cb3feb69f60c1244f2384189b8bc6d8e7e6ca76b5a2edb7abce04ef635509ec901260315392d256db394f46baaf2e2bef298044fc36b06337558e49365013e4499b6c1f6efbde9f8b40000000522473a03180d856f1fd4f227a60008a699cd08cb6b2dc89e5a11d185710235002f7dde54a15852a0d8b021fe05a74159984423312c65599654ccf702f60cc4c | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e3404daba58207478daffd0828ddaacf000000000200000000001066000000010000200000005d23e7fa97294c0196e5e1a91143cc7faf55b0f4a95cfffb1c4d352e19d99581000000000e80000000020000200000008a1f6d84da80c049b1eb1e75bb72ffc0ef40d58546dba64c78d8d82de61b014a2000000099a78c2b4c8befc1057c7bea21948daaf90f45a400e2db930e69fbd67aec36244000000054ba0f384bfbc08109fec963aa886cf359fe7c9f7d06e7b3b3963301fad4cc93021a77f81995fbd6854e930191e2cb1691b7ebb92f7ba76ade5b60ac1ec59e28 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2084 wrote to memory of 1988 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2084 wrote to memory of 1988 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2084 wrote to memory of 1988 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2084 wrote to memory of 1988 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.anddev.org | udp |
| US | 8.8.8.8:53 | api.flattr.com | udp |
| US | 8.8.8.8:53 | www.recovery-iphone.com | udp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| US | 104.26.10.251:80 | api.flattr.com | tcp |
| US | 104.26.10.251:80 | api.flattr.com | tcp |
| GB | 142.250.187.194:80 | pagead2.googlesyndication.com | tcp |
| GB | 142.250.187.194:80 | pagead2.googlesyndication.com | tcp |
| US | 50.87.30.95:80 | www.recovery-iphone.com | tcp |
| US | 50.87.30.95:80 | www.recovery-iphone.com | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| US | 8.8.8.8:53 | anddev.org | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | recovery-iphone.com | udp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 104.26.10.251:443 | api.flattr.com | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 8.8.8.8:53 | images.wondershare.com | udp |
| US | 8.8.8.8:53 | www.cucusoft.com | udp |
| US | 8.8.8.8:53 | www.softwarebbs.com | udp |
| US | 8.8.8.8:53 | www.imacsoft.com | udp |
| US | 104.26.10.251:443 | api.flattr.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 13.248.169.48:80 | www.softwarebbs.com | tcp |
| US | 13.248.169.48:80 | www.softwarebbs.com | tcp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 104.26.10.251:443 | api.flattr.com | tcp |
| US | 8.8.8.8:53 | www.ipodtocomputercopy.com | udp |
| US | 8.8.8.8:53 | www.backuptrans.com | udp |
| US | 8.8.8.8:53 | dvd-video-soft.com | udp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| NL | 23.63.101.153:80 | apps.identrust.com | tcp |
| NL | 23.63.101.153:80 | apps.identrust.com | tcp |
| NL | 23.63.101.152:80 | apps.identrust.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 8.8.8.8:53 | www.z0download.com | udp |
| US | 8.8.8.8:53 | www.video-converter-mac.org | udp |
| US | 8.8.8.8:53 | coin-hive.com | udp |
| GB | 216.58.213.14:80 | www.google-analytics.com | tcp |
| GB | 216.58.213.14:80 | www.google-analytics.com | tcp |
| US | 104.21.61.200:443 | coin-hive.com | tcp |
| US | 104.21.61.200:443 | coin-hive.com | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| US | 8.8.8.8:53 | coinhive.com | udp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 172.67.165.117:443 | coinhive.com | tcp |
| US | 172.67.165.117:443 | coinhive.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| BE | 2.17.107.16:80 | images.wondershare.com | tcp |
| BE | 2.17.107.16:80 | images.wondershare.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab433A.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
| MD5 | d4ae187b4574036c2d76b6df8a8c1a30 |
| SHA1 | b06f409fa14bab33cbaf4a37811b8740b624d9e5 |
| SHA256 | a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7 |
| SHA512 | 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fec0f7a9c5c29376477f9b3fbeedba0e |
| SHA1 | b982da0137e52b3bcdcbb545361f8b871ad8c31e |
| SHA256 | e16a6f0ce098eaaa2fa3eaef57ee6689ea7b6affdbd06d2b343c3b76bb836fd3 |
| SHA512 | d6ecac1f1055a65495130d1c8176ccc872666f21f10d413e570196eaae427669b655c7de569e060313ceece4121ee7c3ffb8cb2b56ee965d30b9df92b890564a |
C:\Users\Admin\AppData\Local\Temp\Tar434C.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
| MD5 | d76c6e92b01b7d05de443bf5ab31683b |
| SHA1 | 2672aa8fa49c60784cdb5109b9992de0ff779dcc |
| SHA256 | 83647c394e407f01fc71020dda4371c6a1131d03ec64ea8c9f08e32444d527a9 |
| SHA512 | ef22384c53f42aa4b50eed0f08c3fa08e6f2de2c6be978ac79c2477210f601f9ba758388e9c1583b811c454440c8b7d943d660539bbd461a18c7732f0c540cb5 |
C:\Users\Admin\AppData\Local\Temp\Cab441E.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar4433.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 02c8b9627ab088c29a3b6d4fe9da9e54 |
| SHA1 | 56b30a2c606ad8c07fd61d844792284ce6768b12 |
| SHA256 | 31dceff193b6fd0ccf56a00e7e66315642ede5f5baad4eac9b74f05d866f57ca |
| SHA512 | 59ca6855e4591167691f94245ed6c88289665256dd22690e93062030819e6ae85908d293007a6c42ac3b3c58eb41295f0240b5947512e859be629bc316056174 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9ff494d57666a2c98bf615ad769cd242 |
| SHA1 | 3c4ef3943e1455c2a6957ec49fe8f126463eb604 |
| SHA256 | 58777ce8e2cbd1a48b508c79343fa01baaa26813faad8265851afb19aa40e31b |
| SHA512 | 0683feec093a4f566645d1b84a09d85a5028cc963f331984446bdea353793e25964379e9af4ef87b6b5624e7b04326926fa8deae8f2e24e2a2a4755941a79f09 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 29533702f6815572b8947be757ae2d0e |
| SHA1 | ef65aa9beb08c354df5cba9e4dea949b9e5a78f9 |
| SHA256 | fac1dfe84a6c943e8b6abcf92c59028451fc9917e9b96a5825f714bfead2f183 |
| SHA512 | 6f0cc8aea6c9d19667b2a2119b2ff625f64fb9fa6e16c67f5c10e4b6e86caad15d5d9842342fbad51f8685eae108d4ecfa4a69ae30a4199cf64c995e06bfda7d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fc23b55b4233ae5ab84eaf3a6ddfbffc |
| SHA1 | c08d81cfff0628b855a7bf6654d9f4a1a9975665 |
| SHA256 | 11cb830406fab2228d094a51e6916a365421d2ac85ab3512b4b13849945aaffe |
| SHA512 | d5c2c5af9d166915b14e9c2adcade6b81e79d96500edd3926344c48878cf31e9408e19d352d338ad8771f8ff73bfe6e98e9e2c8c74312e08fc6d8b796ada0266 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bf76c5c3c4c8650401c0dbeec0eedfa7 |
| SHA1 | d3c7d9dff3f5aaf9349fcf61514e6646f3ab5ec8 |
| SHA256 | 9e89dc84e6e0209816bbcc4bf33191296b59cca87471a6c374aaec98d4cad323 |
| SHA512 | ba4ebdd3fee9bf161283fa4eed698c1def5c25c3335252e1fef05fb5372bd3e0c54478289f5868319594dd330691cca0876eedd5a7541e8177a6df15cdebc450 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD
| MD5 | 285ec909c4ab0d2d57f5086b225799aa |
| SHA1 | d89e3bd43d5d909b47a18977aa9d5ce36cee184c |
| SHA256 | 68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b |
| SHA512 | 4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD
| MD5 | b8a75ac492b250f75d37c151815e2a0c |
| SHA1 | a259a27ce964ac359b074fac03f98ad03a5d7ed5 |
| SHA256 | f016cc5e8df7bfdf33a2a38ac8b2a69dd22c1a65a61042c0b5a2c43ee4d4bcbe |
| SHA512 | 7cf37843d6de6841300080fc223bd6c54ebeebfd426525c8f1c31c58756b95d8b2417d6a4959163509355e2b79d21e81f169516a29a1380cc5dcfec384d7506e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 87da5f024ea196f7589b0db321d27b51 |
| SHA1 | 36f0da1c87b0c6784f39e8228ecf0319115b37d9 |
| SHA256 | a056f9db05b702546af6527eaa06348f793e49d1eb4e0597106c15ce69f2ff0d |
| SHA512 | c6d63e35570a8314f9ef4a8a7b725b4605f34646edbe1578d814313eb03896aea54f6c0c6aa5ed607ac4f2b5d86e9b5b5e5a6ccd7f5d5ce2d424c27cfad07392 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | e94607da5a44e54c8b9d46e651052332 |
| SHA1 | 7abb3eb6caf1bf6a7f3514412da302e8bf99004c |
| SHA256 | 59ffac1c6db8a172400af2da6a7c811956d83f205b689405e91345431f334101 |
| SHA512 | 230809f6f07c7d89fe82d8aed9f9d9421a4a1f7e4746f6e163c59c65e65ed3401be971d01e4853fa153d918bec8c2e649b3cd2d07e797888998866082722bfbc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 5c40e641e342bba75878cc173f86675e |
| SHA1 | 728bf0b1627a5af35f7c18e6fc5c6ac4bc2bc0f5 |
| SHA256 | 8a6f54e9311f9cc9a9ee21ff699b9686cc2e2b5121c0e1fe7457e17fb59c8117 |
| SHA512 | 930ae2a7d276cbf12dd1e26b3ad35e744898c1274c45472b63f713fe99d4494885c802f7888109240e731f809d341d63e04cc7ab32858653577ee108fc795e12 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 781930520b7f37fd5cf494ca1bd3e214 |
| SHA1 | 50e141ca1188bc0b1f60e6795be64463c6f1123f |
| SHA256 | bf9d620d19158e7433b1d0a75044b8721a560e94c4d1ab67d53c8a85108ac4bb |
| SHA512 | b88ce4c6351c96a3d257e37ecc542d3bb7da6d0a94b0ea3cc875c125c424fa0f4d58605ac255ce03e9ef6144e00a35e3e572a5f1833a1737392f54e1c6a30161 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bf86154cbce92245b9fd422295c0b238 |
| SHA1 | 60087883075af9a533bdc00d27bfcf9e6ddae24d |
| SHA256 | fd53a04e8b884798b34f2c06b9dc450e3658a30ca5dacc5398a9cc679af49322 |
| SHA512 | 8d2cf231bf32a82fcf87726a29fdc2098008cff2647a0f0a011c00cc6a06133ff1283114d48fff3c8d9896a7cb7b662ca72be42e4a09fa30eac30a158dbe0574 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 72323c81b82c4828efff57ec76c15944 |
| SHA1 | 1d16f60771b8ad4972bfd016f4767969e276bccd |
| SHA256 | 70291e812b30b39f6105266e9d00f31fb2c329b3b7f4c6dc92f4853f95da8155 |
| SHA512 | 0d920e31d60720ab26747f9b42a81a052a8ec69899510a2e67098b11e58b6680c3205747db098f04335e8aea9d8122981e01ffdd1fb03e1d170f3cbee116208b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f109e9f679b7e2150b9df75f70b5af07 |
| SHA1 | 62eac24284ec3a93742e36f1f72f18c9cea7872f |
| SHA256 | 7c458b7daa79447f4eaa4b75c99ae1f7d347397905081ca3e3d4f6307c48776e |
| SHA512 | d6504afb788a3957a0aa9553e5b1d4872cbcca8383d20a21e5a281a4f0021cb82f2af8318c8fbe657158c9631bb872c80824a600999c3d8c4b4f38a0cc0fe557 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2805b4beb8733dc838b81cfb1597cd02 |
| SHA1 | c2beedffceaafd1ac2d80f60501bd8c048761725 |
| SHA256 | 2c4a082e4a65682283145d9207d41cf05245a9949ef71640fd63265774ff62a2 |
| SHA512 | 41f63cda500311f05c2d6ca617a60edd0d6880f2980334375eb6f987517c48e4ce29f9ff2533ba5e71917f6da21ba4c66349f9a5ead19a3e2594910bab03bc97 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 80b9af3041fbfda860e4f813c16908c9 |
| SHA1 | 8274caa9f33ab2c4166991e63850fa8a1a05c1e6 |
| SHA256 | b195f8a279ca2a3d96ce4e1a0865087175a07905b296e7095b9afbfd5774ba3b |
| SHA512 | 571d07b9cd45344f0494a6bae18cfa1b5713236c19a2d32793576376dd4b0afd697189dabf64c878ad910364b3731cdab565246a941d75ce17afba9883e1349e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 33adf85eee51dfd1d75d6f722f970b7c |
| SHA1 | d861bf9aee1e76755af0cc1e9abe0c2e848335dd |
| SHA256 | 0c0ce7656d5300c8fd1c94c8d2cf5187617813e00db79cffeb37087d1e4978d3 |
| SHA512 | bfd64d1c017a94c9627684392d0a830d33f4f9a40df5663054a30bc3641d1aefa7179438abab351f523be66825a416da8088dce2ac94d352e8e9f7e576d4f4c0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 53e32c4b9d870e248c2012fc6f0888ae |
| SHA1 | d9f512292f45ea969cc006b3a909721112dd5474 |
| SHA256 | d65287a40d28ec75c143df2887742290561bbd39b3afbd1159e42de644b02069 |
| SHA512 | b355ef5bfc1c4b5bb7cedaaf547a415dca27d46559892d8504f3edea54f00140ad3ad21fde8abb62863c21216304c066b32ca4c6cc81a7232266c0940090ba4c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 57b94b50a76bbabf331180e9b328a714 |
| SHA1 | 0fd8327113bbb79bb92e1020c805d4956eae8dd3 |
| SHA256 | afc453f0714ef1dcba754e7af3e4bc3e4d9e2ae9b7a1a17436cc39c7eaa02840 |
| SHA512 | 89c431661d6e3869db1969503d20a58cb49f34034a34e247e2ad0797edff40587fac2d20818ec0e82aded8e7f930b595a3b52e4f063c79ba99c5feeebb83aa2c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 91676b325995a7336867bb2d56e5f586 |
| SHA1 | 220a06d89cc3cfa063dc8892eed68a7aaf0ace52 |
| SHA256 | fb7aa718fa51c933c2b961634c1d1a32b45e83ce9c15a795532802696be7b9aa |
| SHA512 | a75738aeed995e0a528fdaec8b62697d2d2fc9a42af60dccacb98fcd00923e78d71adea2f858a0e3df41f52bb112a37606e6ed422f015d90ecad57aa728260a7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f121b554a3282e75a74f87c4757c53de |
| SHA1 | 5299bf9225038842b379c58988f3a2057a71de3a |
| SHA256 | 25e43cb0e406fc46e4838f5ba435a8bacf361220e44654faa9e6f28ce71bd9d1 |
| SHA512 | 1bc2f08ca04f7b8e777fa90a02d6d192ad808cccb69a87ade372b3f1e90ff6850ff1429598d716c7e3fedbad4f6525524c2309ae2fb60b610c4f398ebb5586c1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d6244b42568302dd38ce6a0731b3fb4c |
| SHA1 | e1037b9b67f1b29e697e0410446e4846c2b68bb7 |
| SHA256 | e349e2c05c83ffec2c24c32de0011ae922e6419f1fb29fe0f9f8eda4fd36ee85 |
| SHA512 | f0f9db975321d5463c22462f4bdae5029327acb2d4302327ff67de59204cb0004aeb2efd9975580e24e70da36edb9ef521ac696822a34159eff4321e5a228e65 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 54c5d4abf5b0fc74c6501286129576da |
| SHA1 | 6f7af979d030943de755edb309b9a0ab14786b75 |
| SHA256 | 83d58f59f7453b95d1cbb5085e019a0c09b25727b7d8d09bf146bc27c8a4a215 |
| SHA512 | 9c49616dd974a8de63015ea5db2d9667a4877765f07488bfc73a3ec61eab72f1142c8c1e5669edf1ad67c5738cb429525be193eb10d1cdd88bda2fe21882d653 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2035079ae509db784a6e54790e030119 |
| SHA1 | bb4c525ea6b6044fb8f1de1e7544264b5e684048 |
| SHA256 | f3d232fe983491091e0c81940da0449b51024c4365596f58d29cc1f6c937d6db |
| SHA512 | 58300ffbe90fbfd5f83458df3a26d12f2ae3a5afd0a345a70143de666f6ba92ff3e2866100ab31c1b83fc9e87a0c7b94b950ea83e70d101d189d098891e99491 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1ce55d47ee556b1af2617ef920766435 |
| SHA1 | abeb0d6d4f7408d78652d1ac9e85d4e5bfd31e4d |
| SHA256 | 29de2a59c8b0ab4432fd5442baf66a5f1765ed9454a0825cc08c8642089e3b20 |
| SHA512 | d66105aed108da5ab1092e36d70b7c7294af23e2aee79f537635f342999255832f64eedcd1544b58e6a54f9580a62631aaa81510eb2bbf444c72f64a643b39d1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 704dbdb155951164759d9eb456c9bd9e |
| SHA1 | b4d0be22587f97a29a6c3d47cf5552868bd43eb5 |
| SHA256 | 0302ee19638dd501b491c3c3bce0c7264c77dbc6b98b5b4eb068582b79aa76b4 |
| SHA512 | 9bf3dfbde196f9e0c37bcd2d5b83c6a0d60455aa71f04f84165246770755426f00780a75c0fcf93036f670ea2108b3f89d431407bdf95616ea3990c3db0b3384 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8105753064f699cffe97a2a3e55f1ad1 |
| SHA1 | ab1b47edc8dfd15273875e04daafb1d206c86ade |
| SHA256 | cdb0deabae07cd1042fb191fc6b9bd22e213c11c0efe893c625684671bb555d2 |
| SHA512 | 147ada8556d3c7caf5458f3dcbf7a6b3578d7ab304d4349ebafb2d2c77bd63a3521d91a82d00f30651242f78a59edb2a101b6d6460829934ee9c5deee1c7c303 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c21389ab3f7da9affd7f423bd009f843 |
| SHA1 | fb53609bcbb30fcec1b41fd5024bd866ae3517bf |
| SHA256 | daea4280f770791615c96f9849b58e208d8a99f5c0d5fee26711a6add0e9e2cf |
| SHA512 | e7f31a243aaf857e26b23e5e430af71a44259f5cd967a2e025d5b213de94aa10966fd2ad78606c589409c3403b92b658bc6eabc1996ed8c44ee0be554ff2f4bf |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-02 01:05
Reported
2024-06-02 01:08
Platform
win10v2004-20240426-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96de446f8,0x7ff96de44708,0x7ff96de44718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.anddev.org | udp |
| US | 8.8.8.8:53 | api.flattr.com | udp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| JP | 160.16.125.228:80 | www.anddev.org | tcp |
| US | 104.26.10.251:80 | api.flattr.com | tcp |
| US | 104.26.10.251:443 | api.flattr.com | tcp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 251.10.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.125.16.160.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | anddev.org | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | www.recovery-iphone.com | udp |
| GB | 142.250.187.226:80 | pagead2.googlesyndication.com | tcp |
| US | 50.87.30.95:80 | www.recovery-iphone.com | tcp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| GB | 142.250.178.2:443 | googleads.g.doubleclick.net | tcp |
| US | 8.8.8.8:53 | recovery-iphone.com | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 8.8.8.8:53 | 95.30.87.50.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.178.250.142.in-addr.arpa | udp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 8.8.8.8:53 | images.wondershare.com | udp |
| BE | 2.17.107.26:80 | images.wondershare.com | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | 26.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.cucusoft.com | udp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 107.180.0.180:80 | www.cucusoft.com | tcp |
| US | 8.8.8.8:53 | www.softwarebbs.com | udp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | www.imacsoft.com | udp |
| US | 50.87.30.95:80 | recovery-iphone.com | tcp |
| US | 13.248.169.48:80 | www.softwarebbs.com | tcp |
| US | 13.248.169.48:80 | www.softwarebbs.com | tcp |
| US | 13.248.169.48:80 | www.softwarebbs.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 104.21.23.97:80 | www.imacsoft.com | tcp |
| US | 8.8.8.8:53 | dvd-video-soft.com | udp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 8.8.8.8:53 | www.ipodtocomputercopy.com | udp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 104.21.23.97:443 | www.imacsoft.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | www.backuptrans.com | udp |
| NL | 23.63.101.153:80 | apps.identrust.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 8.8.8.8:53 | 97.23.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.78.56.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.101.63.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.169.248.13.in-addr.arpa | udp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:80 | www.backuptrans.com | tcp |
| US | 8.8.8.8:53 | www.z0download.com | udp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 45.56.78.61:443 | www.backuptrans.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 8.8.8.8:53 | 77.73.87.50.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.149.64.172.in-addr.arpa | udp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:80 | www.z0download.com | tcp |
| US | 8.8.8.8:53 | www.video-converter-mac.org | udp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 50.87.73.77:443 | www.z0download.com | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 8.8.8.8:53 | z0download.com | udp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 8.8.8.8:53 | 20.249.91.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| US | 64.91.249.20:80 | www.video-converter-mac.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| GB | 216.58.213.14:80 | www.google-analytics.com | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| JP | 160.16.125.228:80 | anddev.org | tcp |
| US | 8.8.8.8:53 | 14.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tpc.googlesyndication.com | udp |
| GB | 172.217.16.225:443 | tpc.googlesyndication.com | tcp |
| GB | 172.217.16.225:443 | tpc.googlesyndication.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 225.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ea98e583ad99df195d29aa066204ab56 |
| SHA1 | f89398664af0179641aa0138b337097b617cb2db |
| SHA256 | a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6 |
| SHA512 | e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f |
\??\pipe\LOCAL\crashpad_4940_LEHXIZGQSJMRLASL
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4f7152bc5a1a715ef481e37d1c791959 |
| SHA1 | c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7 |
| SHA256 | 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc |
| SHA512 | 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 655c666014ee5afe9984301014ab8fde |
| SHA1 | dc80fab8763b5b56e51505214e5c99acf382da6b |
| SHA256 | ce47abf1a03852c5ca4d1821be04bccdb96068cbae4d0cd90490b29bf7055f44 |
| SHA512 | 43f880ceee56b24a88f92e56658f62b195a2aa28f2e8d8b2f38df7aeb326f94f489504c93612bacb00dcc24700e76bef8e70c7b11c4318a3054236758a8d62fb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 903ebccb05dfdc4ca5fa6c69e7a3b070 |
| SHA1 | 6a08f1dcf9010cd3dacd5775e34b7e8073eaf687 |
| SHA256 | 884ecbfb7ba2680979f66831dd89d94e66cd4685cf27d7e468c71454000bdd1d |
| SHA512 | 9a0add78c829cbc6cef5238718d3497b7fb3222ff29af933b3a3786ff30eefb1688fe16ddb8a3ad565c78458abf1af2d6d637f020ba02e387d25a31545f67244 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8ac9f2ca432178c0bb1db1aa824c0b91 |
| SHA1 | b9dde632e07fc6e7105b46525f19566e2f9bfcdb |
| SHA256 | 0d4a36878ecfe72b11321803d79c5e84b0e2d4c9af560a4184d25a3ff18b4283 |
| SHA512 | db93ba759451b8f1430d3838f60702839155b302aba764f74df9c79df4a88749d64888b3d9b770c616728c0c3632f94387d9d833515dd56c6489894567c34f5d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 807419ca9a4734feaf8d8563a003b048 |
| SHA1 | a723c7d60a65886ffa068711f1e900ccc85922a6 |
| SHA256 | aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631 |
| SHA512 | f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bc2e2655c048c674ad97e142a22c4726 |
| SHA1 | 615e735bf8aec124a59c77527ab38bd5f183dca5 |
| SHA256 | 1d092da968d0a581e43d61f03db8a99613f291b23d36d568d5daf7d379f5f543 |
| SHA512 | f19fb777633947d0a167fd57e7b0806e99b23c772d6560619650a640325d574443932563a92f0aa3fbbde5d454cefc3779115d035b2ab530638e590cd8d6b240 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 0cf5ddf2674e6d50e9604fc1f364e37f |
| SHA1 | 328d94d60b1af249957164bb6c1d31f3a7554e8b |
| SHA256 | f876a4d2bd5d3ca00b3f5770f631e49e45d61fe13c54730dd497664e4d5ecb07 |
| SHA512 | c18597103577cdf2ccadb9ed560c5420cfb491f3fe43883c30c2072e01e656bc240e8387d841905dd2b7ee78504d764150e24d154fbee504bfea4b8ec847ff91 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a596.TMP
| MD5 | 4c6c89f38b0efdb642c4f8d8576139c4 |
| SHA1 | b84b13dc4564f47419027ac8562d7e2e572dab97 |
| SHA256 | a1c7bbf5db06c707ea25e5121a9b3059ad03210c08fa5b46006088a9dc022f1f |
| SHA512 | 2c3fcaa7fd1a8dda5fe4cb791d09d6c78710245e8bb685bda4d7a91f3694c10edfc400ce46071275ba7d3b717ea206be45dc4da33a99151595ad5ff49301fc6b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8722caf9d688daec0aa61d3764a4c76f |
| SHA1 | 29c5910d31b1f88c8f9f580ea132daf037af66e0 |
| SHA256 | 445523b8afb278b019882ac11cd060c2128d920e1fd78c7790e956a43a743401 |
| SHA512 | c1247ab8980c6f283496ec4349280e29d54a3ed3c8c64af7ba274ea94857e7e3ff80cb57239bd630b0d4f59732c455f8eb84e8482e5398a1a9e6632d19abbbb9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 25152b1a5c839835c2af4764bae6b546 |
| SHA1 | 0152f8ab845fcb8686fdb71906e0b790db4a58e1 |
| SHA256 | 1e23a90703b0fec2c4778178ae831adf19b61cb0d810c503f2220133cb801983 |
| SHA512 | 71da9e889a2a608721def577174a94df9fc7704741432e449a246990a2c251dc1d7e4668fca2f1b4be2a4477dbc62717d90b30d9f6539ee5e921efd91116b78a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 4e63ba653de9c65c0eec3517efd85188 |
| SHA1 | 1dc81a4640396c0aed7bf83bf0bc9d7164a55c46 |
| SHA256 | c7e8b103e8d8ab31805a9f6a244472f8e856a6ff0d786800683fb5a633f651a1 |
| SHA512 | f9196e22a20395e2c7984ce3d22b44ab731d052941625f2f12a550a7bac2642b71b81c7f91bfeaf36f2d2d5e7482706be028c1e9e21b3fe600600daa28bfd322 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 0e4211bd81fe950d351a572bb1f91b25 |
| SHA1 | 9855fa8174583b70995126c461b6b519dfe36ced |
| SHA256 | 6f2b0780b5e9e7ce74bf8a285160abdd94b99c8168e711543e7d4c85db7dd9bb |
| SHA512 | 3a16d9af64e5c7db3b2efe95f6b736cb3dbb6555575ffcc7cb3631b3bcaa3969ee581ac68a32b9475c2783dda81ab1a56131cf3c8e2e6a8603726d420c096326 |