Analysis Overview
SHA256
320465b593086379c1a05ed88b7d27c9149667cbf310162a7d4cf6495d62b139
Threat Level: No (potentially) malicious behavior was detected
The file 910a00dccf4fd6c05f30e7e8499e1617_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 08:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 08:01
Reported
2024-06-03 08:04
Platform
win7-20240508-en
Max time kernel
119s
Max time network
126s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d5a49765998087d210ccdcc67700e498bcf1715c0d3db9a5c9cb8ec19fd5f8a8000000000e8000000002000020000000995034ad9b38e8761f18c35d47bd584287247c4e1feae06c3767a83a6ab9b2039000000016c27b78db5e1d0602ef8c130871c0c2a7f3fc8e53de5b701753ab0fa5b4c03d8a9c04b75726aed01a25e5c0873ddb3f251d338c76672aada58fd04dafcda8421b9dfc3d4b117528af96cd4889bf0bc383b08f06a0e0be0d600078736997cac67aa453c957e08f062494c7eb0b1ce9173e0baa9b4c582570fcbdf65496913e191027509f17fb19ead3e2e81dae3851be4000000029e11a5f130adc45199fe15abd75c64a08d0d8b8b54f9b1719483c5e7379e00d76d2058e88c3f509f516ad5c078fa17e3aea57f4ac35b52749d687946ba65a58 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FF1C911-217F-11EF-AD44-52AF0AAB4D51} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563563" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f056bd648cb5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000079d4d44a1f18d1f3704b9b3a51017ff24e6d2758bc4dc247e9065f75527baac4000000000e800000000200002000000068a2e7b1721f05093c7691d502f61d62de5e607f8355ed08ec486255372a7420200000006c48f7b6138684f81552613010b80c3364208b835c6b78546e2ebb1cf24b050840000000eb268393af9795a39ea2e087d02395b49ad16dd1c6a2a93d4433afecfd583b25094eee516066bb3ddf0d9a522697033f2f4b3e031e5b650e03a98b6ba79fcf9f | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1720 wrote to memory of 2276 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1720 wrote to memory of 2276 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1720 wrote to memory of 2276 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1720 wrote to memory of 2276 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\910a00dccf4fd6c05f30e7e8499e1617_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lovetorrent.net | udp |
| US | 8.8.8.8:53 | domaha.website | udp |
| US | 8.8.8.8:53 | coinhive.com | udp |
| US | 104.21.57.186:443 | coinhive.com | tcp |
| US | 104.21.57.186:443 | coinhive.com | tcp |
| NL | 85.208.185.30:443 | lovetorrent.net | tcp |
| NL | 85.208.185.30:443 | lovetorrent.net | tcp |
| US | 8.8.8.8:53 | www.homeporno.tv | udp |
| NL | 109.206.163.210:443 | www.homeporno.tv | tcp |
| NL | 109.206.163.210:443 | www.homeporno.tv | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ff3bc92252e7dd3fe00138677978b31e |
| SHA1 | c61ac16778c43fc5728bf86625224db70a7d15e7 |
| SHA256 | 5a013c0f57ba3b3b63dc6c6408e7430de49747f084778faacc2c3ba869f70204 |
| SHA512 | d7e7c0a885361ee4660853d6b3781ac6d69cb10c68420ad628723c1591a414d060716342f061d2306bb7ac741867d7887cfa1cff69b64928bf10ae55d3d9e6ba |
C:\Users\Admin\AppData\Local\Temp\CabA8A0.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\TarA8A1.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\TarA925.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1ff440e321645567669a4d2262634aab |
| SHA1 | 53c1121554912ad5cb8ebc2681afee7961820d70 |
| SHA256 | 91ef53413e03c6fbb2972f7dae3f486368d62fe08de6e91ced9964b59f880265 |
| SHA512 | 63f9bb50e4f3610ab33e042212d8f0690028d897cd7525b303fd1ed11deee3267e9102458936d4ab661dcd3b08fc975beecb409237e64a6bc34c650bc65e57f8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 94d32f983479dbcd80161f7fa0b21075 |
| SHA1 | c306728400d983a3efa7eb166c32a9aa89df9829 |
| SHA256 | dcc476135032bc2322d9acd9275a550082be8225dac78703e0f3b3f5a44ec45b |
| SHA512 | 0c6e56eed0bd4e509bf27ce1ba1a83a488a825f80632f7b500b6538013728246cdcb00386b83ca3234875e2064863443e001afcd4821576a990502669bdcf122 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b3aa060a5feb862b9dc28306b8ba22e5 |
| SHA1 | 97c083d6b1621cbd7e48e29ed32b7508f2a096a8 |
| SHA256 | a44984cb0f309d951163d476bdbe6b55fd6663528de6030b2b4491047711be07 |
| SHA512 | 95821fb14fe41a583a9ab3faec886fb5a6e56889bb5f9c48a60b5511c66937d77099cafe320639f4ed963c2246e6582c6964ca3d10ca82a38fac99534fc05eff |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 19ecdeaa4983f96acb8157c6f21981e9 |
| SHA1 | 65693a9e58a0a7bbdd635207ec59cd30fe972877 |
| SHA256 | c8b87085f11366145b7863b3d5b811253ede8040e4b4490267c6a2bb2acc285c |
| SHA512 | 504623636fcafbb1d2908f14c479d5ab8cf00843a3470f8393282e087b92aadeae39515cbcea95ce62de9f0470ac9d21696e0f27f20dd7e7ff347008005a9d6e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d895543b213e58a771f0ef75ecc61fa3 |
| SHA1 | 78f3a85989261c2c5fd6ca952e2e019d63d3e333 |
| SHA256 | 7c8cd6432eff94b1a19f6cf1dff232fffc45666e3ee7cd497b7f3f1965fd74ab |
| SHA512 | 134cbe1ea0ff6b316fd20574f8aeee51d3a821894640db53c5b043e425a986ef8a9cbe1826ee9a1534a19193f0282757826110a921c96e86371a2792f8d974c0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7faea18332d476d9ccf76b1be6895ca9 |
| SHA1 | ef6d0b9b7b2c8ea8a2b461ba71d9578925e88a5c |
| SHA256 | 488c412e5536d1b94cf38b44cdda5d1c93fb94fe51a4fcbb1f7697b729ba83d6 |
| SHA512 | 3d7308f187951ce7c3e7323c28136d10be6d72a0654100d6942501e2171c154db4d979b50d3c5108a57efd8d0cbd89b822dec95a80fbd45fa10d746a44490dee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c41724d8f747b95bcfc88e025f8395c5 |
| SHA1 | 7f7dc2149d4c6c6c88af766396fd034c9bd7112f |
| SHA256 | 374562db8fc6ed124d4e7398e9c00164505bcfe885030754a4a88781d06667f8 |
| SHA512 | 7b0e9a654e08a7d2be7ace7f3c32ea0008a83de247ed770c6ccd3f3e6547e65bd9e778a29494cf47bfa2e70ccbc9666cd27898c580c44033062b8e7e848774da |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fcda700076d74382f8d177c4632cf8ba |
| SHA1 | 5cfe37aa2804347f090bd07d5992f0f7ad0013e7 |
| SHA256 | c2f013c6dae95717b30b64520303ac38f9539b8bbb84d1b767ba0999519c3a8d |
| SHA512 | 4cf9ac9b9c9ce0b763c5eef07ffbb8d5c964b84e5888d454104a9a88664444648fd8fd4b1eae635ef5901b36bd9a09e369dd734aa4287aff9e28614f8b8cfcfc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8e58955f7f10926a9c7fb45bb52d7ee1 |
| SHA1 | dc1ceb0c50a003a017acb8f21c9aa6ae65077248 |
| SHA256 | 50bf2b70a55ec3795b644763189d58c08a24b88eeac9bf50915d7ddcd8f11284 |
| SHA512 | 18b19dde2d37445a3cce2784ba21a83ff41367a27d9ab7b386905d2a4e711bcab4abfee9cd8203da869ea454f98ede462ffb6455bd8a80e91f955567ca191074 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2606ad7db7f546b9b85257f699fa1617 |
| SHA1 | ae72ee19a626f3acb1c859e9e06f75cb6e569b0f |
| SHA256 | 21bc3fe410bc40fa609cbbde5a115b07165ad90b2ddcd3debe2f0fd6ebad792e |
| SHA512 | d50efecba64fe72dce38e3950405f7c960e7086082327cfd0f46bde6bc8d9f46cd2e245a7fe7f63a31a0f373648b4f82b3ff8d7487fa9ebaed862b771240bb4f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 458ce11d3aa29feab29401fb85faba58 |
| SHA1 | 99ff4392f49409a2abdb60939c6661837d4e803d |
| SHA256 | a68831989a2648a3ce27eb5ba60464a2574ba66abd8c558746c77a514a219edd |
| SHA512 | 837953b9a9853395d02371ab31188ee2515e169e7ad692f1dd62660da04339e4e6f286656ee461577c9880130d3b35fc9c4d92f28d5274ad2b05eff8cc91bddd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d203eaa258dac42fe6c80160912cc4ef |
| SHA1 | 61c062210312e0a13d69bda0896d7c26fb4aa67e |
| SHA256 | b45ef22ca0744e3e1a79e59b22f2873042c71b862827729f9b4c080b52cbf6af |
| SHA512 | 2666678bf0a9a2ed53e069b69d3705b9aa60ac720d438eb561e1389ac58a1670117334fd06b68fd017e59c1de156eb1db7a4d3e0143a21cad1a54aa47511d1f4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 869e2ef51cc9ee5eff388e9da23190a4 |
| SHA1 | c8390a3996ca7046d9cf5b2fa24b6aabdba41411 |
| SHA256 | 67e93d8c2320e29c98bc77f8792102c140415e6e91816ddf35bd99e1c560f67b |
| SHA512 | c7a8e92a2a7141374da7988107408a5578b79a822e9d6100007795f3a9db76901e851b9e212b0bc5377a5c53186cf4c9e85411ecee9e62a287dd5f30e2af0ee5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3400d8fd981ac260b3eb5540d4623329 |
| SHA1 | f5032a8fd4c0f19cf6093d175ab387222a2d1f6c |
| SHA256 | 6de13d0325c68dbcc8809db5061f62946c5a0c26f03923b6fc62948bf3a00726 |
| SHA512 | 474bfec31feb2fd97bc0daa6808b42ddfae107adf8d6561cd4000243b3f6069f729090a0837df5338d468f2a3b244a5616da43b5985b589083a4205462ac5eb9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a0a857d1a2d4b4a0122882b25590fc47 |
| SHA1 | 646d363668cb098f08a1bac3360a8ecff872c3a7 |
| SHA256 | 37e2208667b8d6bd85921d81bf1e8156af8ea2d21a4d8f07d1bce61a2928fac9 |
| SHA512 | 2f24223c9d20b3c4358ec3babddb38ad35c9b03a92b90b4af0d8520935a804172d146123616a6f3952c3239e949ff0406b906aae320d872fe573dd7d792396de |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c88808d270d182dedcaee903aae71763 |
| SHA1 | bcb74a7ec00a726dea6480ca00bfafbe1a0c8963 |
| SHA256 | 5af7bd050b9f9936f950680009229e1c4fac2ba8459ba0b1220d940c7781130c |
| SHA512 | 64345d19ae801b89a39808143533b9a7c9527987e5c3ccc9cc71540003b9f73d13f99fff80ab160c4fbb0af896e6288f4303558ec920ead00f4c175ce0b738e8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2a3b49b1c36d064ca09a466347afa29b |
| SHA1 | 623360ab37b77137d85eb9f7f66d56bc0267e4ab |
| SHA256 | 9fdf37fc507d1c0927a5757bb1d6abfc477b39e1372702d4b34355d17214bfb0 |
| SHA512 | fe996f576f8fbc146ea69b1e767883114323b3d9d499fb05768f8ed1d24ed745171fcf00c12935311f37a4ddd05990c14a4ca361bc1ea0b757baa1ae041ffc04 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 79a91120b5d514096291e8035c6a042a |
| SHA1 | eec78f7a7a56e7f823c7c99aec4c5f12ffbcf343 |
| SHA256 | 1a17ed760a52d5c92eaf26c8dd5d2ab4e3868b8f0e645ff91bd28b66f92b7b5d |
| SHA512 | 4427c48016fe4a14933b9bce46ac54f9d317851b9df04fab8e52f94a46d288434ed3ca6bbb997d5e798c0903c533d5597c7f13eae65325e745163c7c412be439 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 50d2de0fa897be46329ae26ed9989136 |
| SHA1 | ae6bfedd73d8a868f113dbe78302aa6964f894f4 |
| SHA256 | 1f2a06cc340fd9d560c50001e67a5d52efcf90bc2f47fe79aa456a51a3d8ee74 |
| SHA512 | dbd5ae4f674dc474cc978c7cad9708943e5f3ad95a71f0c8b46e8be6ca5922ed211773d2067b3bc3c7af1aa84cb7e4c89d9aca0599be4133838a25149b60758b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 08:01
Reported
2024-06-03 08:04
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
128s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\910a00dccf4fd6c05f30e7e8499e1617_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bf346f8,0x7ffa7bf34708,0x7ffa7bf34718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15703842364277662078,10428228086819939605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lovetorrent.net | udp |
| US | 8.8.8.8:53 | domaha.website | udp |
| US | 8.8.8.8:53 | cdn.sendpulse.com | udp |
| NL | 85.208.185.30:443 | lovetorrent.net | tcp |
| GB | 89.187.167.3:445 | cdn.sendpulse.com | tcp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.185.208.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| GB | 195.181.164.20:445 | cdn.sendpulse.com | tcp |
| US | 8.8.8.8:53 | cdn.sendpulse.com | udp |
| GB | 89.187.167.6:139 | cdn.sendpulse.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.146:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.amzuu.com | udp |
| US | 8.8.8.8:53 | www.homeporno.tv | udp |
| NL | 109.206.163.210:443 | www.homeporno.tv | tcp |
| FR | 163.172.168.88:445 | cdn.amzuu.com | tcp |
| US | 8.8.8.8:53 | 210.163.206.109.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.amzuu.com | udp |
| US | 8.8.8.8:53 | counter.yadro.ru | udp |
| RU | 88.212.201.198:445 | counter.yadro.ru | tcp |
| RU | 88.212.201.204:445 | counter.yadro.ru | tcp |
| RU | 88.212.202.52:445 | counter.yadro.ru | tcp |
| US | 8.8.8.8:53 | counter.yadro.ru | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 87f7abeb82600e1e640b843ad50fe0a1 |
| SHA1 | 045bbada3f23fc59941bf7d0210fb160cb78ae87 |
| SHA256 | b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262 |
| SHA512 | ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618 |
\??\pipe\LOCAL\crashpad_1712_FJLYATIZUCMWADXM
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f61fa5143fe872d1d8f1e9f8dc6544f9 |
| SHA1 | df44bab94d7388fb38c63085ec4db80cfc5eb009 |
| SHA256 | 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64 |
| SHA512 | 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 96325c726e8316e22bbf84a1ebbdb405 |
| SHA1 | ae84c1d0041aba04bca623c3efc0f7902d19b1d2 |
| SHA256 | c5ab362e9229057227b68eea9f994707eeee7a0ed50a846a3560f854cccdc9c2 |
| SHA512 | 66dd31a6e73194ddef66855c62c2666ea8c9efdea6ec78fc58282eda32623b4ada5d05bae45efe2dea233d35acb1a673bf31505b0eca706ec2f77f8e27af934a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 37798eea1dabeeb21c00fcd4eaf9dca5 |
| SHA1 | 963af563385b26adbec3d946d630134679bac9d9 |
| SHA256 | bdf6981dc7be5ce49d3ba3ab9bc7f1ee84be6623fda3d3a1918af1b2d3d0fd56 |
| SHA512 | 2ba2f31ed499b53fc70176578c0f95ed8d5470ec5a1263de75e02f71dc2d6dd137b829e5e07daf4a19dde5c792f707f00a762cb41ff805154577437a22bf41cf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6d1120e8bc3bcbdffadf8791fd1c5f7a |
| SHA1 | 77c0df2bae2dedd77da9be0d2670851661c5cd5f |
| SHA256 | b7db5b014e925ac8fbddf219063a568514dc9d80f81b3b9aeab6527d65ea691d |
| SHA512 | a0d24839cfefefcdd4ac05e06658e61a8496d94a538f39fbc1e277b3b238adf9fcb51cfd5d14d62b84eabc0c46e828eb76ce0a6221d11b65eabe0c8249b2d3f9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0909139333cf9610a88cd0d970e8881a |
| SHA1 | e7af9921723aa1b5975406d6d273646a636ffee6 |
| SHA256 | 15fb7ce6a72c4be5793172aa6fae3b9236970823b4c131a74271a7d4581cc1e6 |
| SHA512 | 89162513f729df166229bef2691d3bc758e433e65daaab96ac29654fe8be568c4f6904bf842a7d9fc51dfb6ca717814c4b509089db370de56f74605f9e5377bd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 45d13479fae0b75a4b4b685527634c71 |
| SHA1 | ba52568884cb9c23e334c2298518dbb8e4243d1e |
| SHA256 | cf053a079591b70e0c934f0b90fb87026d65e11d799b59b7b20ddab486766bd0 |
| SHA512 | 738dd8df1db61b1dc1a65395f9ed853b767fd24485ba9897bc6b30b213c80d713c69a721583030a99872d4bcdb80a43039c828cc194993fcd8bf8c420453d32a |