Analysis Overview
SHA256
dec9d6321589b9920ecf386b33e855d212710b17f55e2b54787c091fd76b8221
Threat Level: No (potentially) malicious behavior was detected
The file 9106b5d4af68463058b2f98f9d9b3600_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 07:56
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 07:56
Reported
2024-06-03 07:58
Platform
win7-20240508-en
Max time kernel
133s
Max time network
126s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563240" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000067a2c32a62d219d52f82a634de25b2b849f24319218086e6e3c6b8deeeec7f14000000000e800000000200002000000042119d17e1ebc2d52589e5c2f0e4f517ee705a738476dfdf926b8cd5eacec238900000004d5d70af98d6f7af5c06b0a308cb3a90ab9c65ad2b8f8e1cabd875dfe310006f4ceb3549ae32465cb6a49b9c35128df777c17322ea06a3e32b1e6f0c6a1b16f9aeab0c97a07c88c4ebdc223e05833162d94274b2b654bb4e8b7ed43a16e303e51d7b6c103ad22dccb44d6f4cc15f20038de5ffdef132b20b828b8e2786fba6b312071596ed99c721a7b54d6113b3df6c4000000043d735af8e4d2bb87930710a92538014e04e30c46e033a51f92c31731eec799dc2f61185dcaf6c324ba377c85f888566f86ba6f6d48cdf24fe432ec221777f02 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF6F1211-217E-11EF-8B04-EAF6CDD7B231} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303273948bb5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002f4684306183168c98d544597b4b34a402a2d171b86847c68f6f8845f6c47b16000000000e8000000002000020000000d90f7dd0a605fe6884fdafb16392394060276df785a6445eb5b2b6c70fbf171220000000cdd83421b506a01f5265aab8dd449952cccbedab0ad33136e1012a521ad96b7b400000001a83cc8130c5ca4e1ee1b12c4e6d51b95ce517a76dbb069ad0ce198c6aaa7425024b3650b8eec55ffb12e48faef9378a262a9acb3b76974c1e29dc4ba24da885 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2368 wrote to memory of 2560 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2368 wrote to memory of 2560 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2368 wrote to memory of 2560 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2368 wrote to memory of 2560 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9106b5d4af68463058b2f98f9d9b3600_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | wprp.zemanta.com | udp |
| US | 8.8.8.8:53 | 0.gravatar.com | udp |
| US | 8.8.8.8:53 | karya.ir | udp |
| US | 192.0.73.2:80 | 0.gravatar.com | tcp |
| US | 192.0.73.2:80 | 0.gravatar.com | tcp |
| US | 192.0.73.2:443 | 0.gravatar.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | www.gv-benchmarking.de | udp |
| US | 8.8.8.8:53 | www.krismarine.com | udp |
| US | 8.8.8.8:53 | www.krismarine.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar3441.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 91c58890a30613e53fb56cf3fb0f5150 |
| SHA1 | 58d5635260dd036ba2b480a4b6adb45d2a717cac |
| SHA256 | 46f1f8048901f1e35a38c79d6639a29c2d42a970601e94466abb9986915572e1 |
| SHA512 | b5ee4bf12a14d8d8ba68b5097fe3a71725afe09fc4d1125da4eb338b438eb95d8a3505347425ebf7af7c126166b8a48ffcd7dc6feb5c82078af7a993314b6000 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a636a07cdfa14c60f5ff137bcd98295d |
| SHA1 | 4d5316232f343871b4b1247f0d2f8a513966dffa |
| SHA256 | 368d2d5893f2de59cb92ce06269e36fbd29cc4543783c9380681035f0d177b84 |
| SHA512 | 7fb0e6a55e342dee6a810b39fd7f7be2844e3712d88ff8cf8a7a60c226ef292d23e7895bf445190fd92d826c20cae0bdfcb3e0b59648e9f448920dafef6aeab3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cc58b02004f3356ea07b95d491a77274 |
| SHA1 | bd7269937df52ba12be1b96ba4520a66c0c3d1ae |
| SHA256 | b8fd09a756eb878b5f6463176bba5efda0d215000756a19c1f9399420baa11f7 |
| SHA512 | e64d915c27c2408c8e4bfd5a4630e486ff20618674c0da9a5b1067f463d363f087ec04cd1f0796f026e7bc901457b63b4fbb5f07ab83b342560e7c508c402d28 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5e40155dde43ae801c15b77774f00ca8 |
| SHA1 | 1da51f80b66f03b5846775e81b406393bb27ed8e |
| SHA256 | 50b5efc5f7156a039044d39499a075bea8459243bcb53395eca45ec1105b8a70 |
| SHA512 | 397dc3abbe8e6f089f00dda0f2d2c79266bb9b26649ab5feab7558d24161b2e563a1c85816ce0ba274fd8030a921dadbaca6ad3bff4ba4ff62020cd4f72f2e77 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ed8c0e444cd972a8cf2093d89452e257 |
| SHA1 | 5c49c46150c550dd202feec4e1913607f0cce4b3 |
| SHA256 | af639de567eb0d3a89eb4e8669a63e73f6776b5939811085c1a31552005e2e12 |
| SHA512 | b9db41346fde7d022f0fb53933e4e32f4c6ed0b564c02e9a0877dbcb6d6f4fcd4ef758c2f53a41f937b9ef29df5233b669e129331738e84969d4f98ab1f9398e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c4e0fe7addbb75749e53ada3ebc0202e |
| SHA1 | 8533e1c8bd987210479f1c2a72d6bfff79ea893c |
| SHA256 | 401a6a23cba361392a1786faad968ea8511a2a2d3614ebb7067ef4ea73daabb6 |
| SHA512 | ba3466e86564618f9edc3573047593b10b5d45533ca6301d20737b5451823805827a96ee9cf7a75f4ff41058e97d32b85ab44e5246622250d40d7bea9d5aa6ef |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c48efb71df18cffc987cdfe37c86344d |
| SHA1 | cd50bbd00f81a08b4aeae39c61a7861589c050b4 |
| SHA256 | 9a4fb87cc35a3958102bcaa5daa641f185c7c843f6036773e81c16de331215b8 |
| SHA512 | 12e234069aed08a6bad62c51ddda74fa3eb29f667c0deb4bcbdaa3baf86e722236abbb272f027270714a9b1fd9c5066d2735a1bab854c6fbd5959a1097bba80b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a78f81e92631e2b18fda8e5b0ac2dfd2 |
| SHA1 | 314b0b922afcecd507386616589ed273887e3084 |
| SHA256 | f9e8b5911955b044067b2f17834ad3e5990863984e998efed2f19d724b29d8b5 |
| SHA512 | 43839b09b7445b83cb70326cdd848f042288cac00651354d07fce4124ae8d61a0c8a3b816f007cd1ba81b92897073eedd7e530aee4e0a75a6d49b7957dd1b341 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fa9f7ff6349217bfb0a163ff08147c5c |
| SHA1 | 986bc74c406e7f85d6cd47f76a6ff223bdfa2a98 |
| SHA256 | 40394963698888ad2edceef14befacb112eb7d788153f101861faa376177e4ec |
| SHA512 | be4435b8a1d7f89a016d8e41c6a81d17104f4007ac2ab2340cebd8e4ee1331bd8e3e95e9dd51930b42805943dffcab2af3728c2ea0f931506032bd44b62cb019 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 54b6390ab735b273e4b4a2e5df310b90 |
| SHA1 | 50e548418305bd4177b3c7c5b41990960651b3b0 |
| SHA256 | 01bfa28c7fd3a2bff9a2f3ac8dbccbef91f53ce57d992de8cb942f368c2082b7 |
| SHA512 | 7cf4d8c761fcbcd61268a221d0805825bdca921c94a2a2bebab4b6b0c1e84f755def2d39eea95e1787ed2e6ce0454f357059ed0210d03b9f031b4ae51ecc6ddf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | db68e8b78ea3272b3f62d128e2d86a99 |
| SHA1 | 64b9173a3c05eedaf8363f9a93e35634ae6c37a3 |
| SHA256 | ca6822bba3fc1bdd3fbb572538cb030c8f864206b6a46770c24de53b9e6e279e |
| SHA512 | 3bca1bc1e4ec690a49e443ba94bc3d69682e3af673fc38fa3df7d31a61dbcaae82bca7108cd64af8821971ed8e30f08fa7f539fb17f23ad5b76ec50ad50e75d5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 88d305b30aaa25da5d2087c03b0c1b46 |
| SHA1 | ebf9a177c9a725525af18d5a51d5eab2ecd855e1 |
| SHA256 | 63e7b642d37517cb21925e660ca648a6be0b0e44f14ab0cbcb88d5d6f484b5bd |
| SHA512 | 9898e43a49380e40797257ec845c766317d919704528864078bbabda27f1c52aa99872b71e3fb1c9b9db89be18587e9e0d3f1a9293cb56b8b977475aa1644581 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ad435ebcab43bcee2910d635b55596bf |
| SHA1 | d99268c4f2f8acdd989abf49bfe8040b57209d2a |
| SHA256 | 2814f96dc733b16d43232780f087e0e681193cfb05678a7604ee21495ee90498 |
| SHA512 | 80d0104c14539dca05fb550c2abc3661774ddab6f3affa0343876b567d892f28948c480d181f2383e0e1480bb997197df4b826d8b527b0f74d0aa9a511e5c88e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 997b3f19fb5d863df3858d9f384d4b97 |
| SHA1 | 121f3ca0bd63707a2d867956424b9662241ff15d |
| SHA256 | 7e6a1287d3f782e6dd0660252573abc096fb28c8d9c1bb0f83f122fb57330559 |
| SHA512 | f64b818724209ac9fa404d2f58a3ad1074f2c583f29f3993a040647818a4e2c6bbde3229d63abb809f12e2c806188b4b9688585f6b4a092abce39f0787b020e1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0ec3cb107b4fb1c985daa70d729a4021 |
| SHA1 | 3f6ff23951a2714bc871c4c793ed460a9748913c |
| SHA256 | 5b9aa0ba3ab4ea8f33cccc8826a7ce8817e2b7247bf1637aac0dcde3e7dfce7b |
| SHA512 | 29bddc1fb7e8ef569e6ca6c26a6b5fb47d5efb9f87a96f25538d9fed81c9932d7994bbf6ea3bc2726f1f4001aad97dc3d5a61194216be5e7ae71f52f11fc1c73 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fc0b166d1fed494beb904e043c49ac78 |
| SHA1 | 2315e4a1ab5482b86d9a3a2105534bfba1f388a5 |
| SHA256 | 823faf0613e54e80e1491def48de12dab609ee0147cdab48602bfde10474cee2 |
| SHA512 | 44d7f576a66c1721a8ebd840b4de8d59f9ea51d792057e4b03aded3eb12eaada80dd35e8c36bfd0ec498fda625c1b5e53b492668891bde304bb7fefb025e592c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | de961b1d6770df8a7a0c6f0edb2bb279 |
| SHA1 | 1f5eadbff075e8bc88d85465b2bfd63757bbf66d |
| SHA256 | 0e6644514074fa53590fbb601a349262c88f02b9d19bfe90b6648e5bef044093 |
| SHA512 | 1016ee2426d53f60f3ecf454167008bff3c018a58b9a983169117cad86ddea8ac25fb5894d4f41d9aecb39167de81d78276d6a679e695303c093fa2453ca96ec |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f6f2836b7c9d0dbdb61da95a4111ae21 |
| SHA1 | 9b1a6cacaddfc001ac4a5df15a364196b1e49d0b |
| SHA256 | f3cd1ceb1a994ab8e3c7de77d7b955a5b4af2c89bc01746410eb46539a448dd8 |
| SHA512 | 2432c2383a4c2c4a930009e94f757589ff2a6ef9e7ce907f8ba8929b30fdefbe53dbda68fccf302d7e44319b6376d1e4c4d74026b077afbacde87c9823afcdb2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2573eab937c01c9143ac17f675fe133b |
| SHA1 | 32d7d05b8c3ad628fed381bfea2e61c5d2c1cdb7 |
| SHA256 | b3b2d40039a18ac9c9fba09b1c7d2b7565113b3e7353a31a01f615db673201cb |
| SHA512 | 5aede87e54a2eaa5c6d641f5e69b9cb0e2772e560e575b1ea41ba38c7a93cd9ca5e0b04dc37317e090e7f3e02df90ca541a6716233542525e35d659e1ed25c0b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bc21567d038dc8802fb7e91aefaa8b90 |
| SHA1 | f72d35f80cdabcfcff6134c06f9b2720bb66d1a8 |
| SHA256 | d88f78daff838a79b97ea615d7aaba4bb27ad22910e85c901d76152da8e94d3d |
| SHA512 | 948b91530e2be7bbb3a0f3e22f66cbe111eb5e20965d7f5f472a7a713e0fef465994f91952d242b6cb0210d371cc7e49e0a5c9f17272e2c02ecd0c854c99a32e |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 07:56
Reported
2024-06-03 07:58
Platform
win10v2004-20240426-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9106b5d4af68463058b2f98f9d9b3600_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3919057730462156219,544741704790808393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3884 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | karya.ir | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 104.18.10.207:445 | maxcdn.bootstrapcdn.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.99.81.185.in-addr.arpa | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 104.18.11.207:445 | maxcdn.bootstrapcdn.com | tcp |
| US | 104.18.10.207:139 | maxcdn.bootstrapcdn.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | wprp.zemanta.com | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | 0.gravatar.com | udp |
| US | 192.0.73.2:80 | 0.gravatar.com | tcp |
| US | 192.0.73.2:443 | 0.gravatar.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | 2.73.0.192.in-addr.arpa | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mailerlite.com | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 104.18.37.66:445 | mailerlite.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 172.64.150.190:445 | mailerlite.com | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 8.8.8.8:53 | mailerlite.com | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| IR | 185.81.99.69:80 | karya.ir | tcp |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 8b167567021ccb1a9fdf073fa9112ef0 |
| SHA1 | 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898 |
| SHA256 | 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513 |
| SHA512 | 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54 |
\??\pipe\LOCAL\crashpad_3308_QWNWMVQIGDRSGIFJ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 537815e7cc5c694912ac0308147852e4 |
| SHA1 | 2ccdd9d9dc637db5462fe8119c0df261146c363c |
| SHA256 | b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f |
| SHA512 | 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f3c4357e0e623f33a24f9b54dec2b739 |
| SHA1 | 28613accc17ce60058f515b8e36e84d5959df610 |
| SHA256 | 0cafd2da2a15168be96172adf6497d63816cde9d089432a228e81b2d81e3a8e9 |
| SHA512 | 6c17d2e0fc60f038c5dd4bd19525997e074a63f8e02f579415386d4338190e23e563b5e011db20b91982cadfff2ee52932e88e3d9b93490cd2ed4dd08e010272 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | f06947e37acd0e69e47c9e8e2fb9708b |
| SHA1 | 23d2da32537a20a8f910d1ab23a7370fd00eedc5 |
| SHA256 | e9f660ec054b0e6780013d0191b2fc4b318e3b9c83da949601aefcb13d63851d |
| SHA512 | 9722a409c373d08a44bcafc276794cf0d805c3aeeb1025f44783a92a8484f9540d1716203554f42b9d1c878b812377699ba9b4b70151af5cb52ae6bad499c4aa |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2c4a3f3765f9a61ab856e4960a04cbce |
| SHA1 | fbac2f3e52b1d302712f9e8b4bb9f55fbd50cad4 |
| SHA256 | c8c7bae5f26796b26569a40aefc62a0f2be4f29f2a1d56452c80330ec5e424e1 |
| SHA512 | c33086042f37aaab45f086cd8312d74880f9ee1499c42ea64b45eac28e5849f96da930afe75294c9ef68a6d2c30f68ab96b1492ff4ad69b5d383f3b332db53d6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 96fbba27b0dcbc0bcc34c2420064acb4 |
| SHA1 | 42afbc7246111291bab6b7ff324afd6e55807471 |
| SHA256 | 126377b8e06af0d8dda5d89e4d8dcacd45940bdb75939fb1745c072f15d3d428 |
| SHA512 | df49897c64a40a39a58aebfed0cd82b12901b50f1738058769c019010e3814749e4b861a8ca4ffc23cf29a71126c9e40b73f4a69b814b27481b1afb9b4b78c71 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 4e6156be729a4f65681a10847e3fbf09 |
| SHA1 | e033f0e00b5d0dbde58a987a4383d4d99bf7a981 |
| SHA256 | a97fb78f7350d3dde3804344efb6c1af5d481ff259d8c485e8cf8c4851ef87b0 |
| SHA512 | 9767982ea89f85cf77879d14e11d1baf5ea0b0da1fe499a5897f30c966f4cd94368d93bd20cb3a2dd0ffa74c8957a6fd7fffe917f33c221edacf24b0be13e0d1 |