Analysis Overview
SHA256
84e0325fb92f10bcf2c05b06e61e7af5abb2be590d54f79a914c2d5f365e45b8
Threat Level: No (potentially) malicious behavior was detected
The file a1bd35bb6aa12d2931e7fe36c9dfa4df_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-12 18:28
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-12 18:28
Reported
2024-06-12 18:30
Platform
win7-20240220-en
Max time kernel
134s
Max time network
127s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b94158f6bcda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe4d3d2786138545a0547b3f56b1706f000000000200000000001066000000010000200000005f4ee8135d04d7c3d940cb67b8c01401e0ffa00d5e3d501a80f4f3ed0b10406d000000000e8000000002000020000000e20158653a33eeb3baf13784face37689a4f56224e40d4c4a444695fd294b7df90000000e10d3ca35a32e9a1524a472cc25572dabd0ee6a9f3b0cadce187ac01e28e71603688b1cf3770a8c7f7f45c3590744dc67e27304ed3887ccf07be51a999589d15e43207ea41ec7b5c8c468c039440680263ae6e92ad55de2e5a4e8aeedf92730270ab695e4b64d45e96188b5181e2d7eda1432a4fe2bcfbc1d9d8af0f7230f57b71447560c941536075f3c25ce13ea4d34000000075f18e67d2ce6d6cc68d75e661e7749a0c5d6f8aa3fd3166af670ad623e44eebe52e322d49011b29f2266ec670b3de29dc5f33af185ad8948f40594648ca151c | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{830B5641-28E9-11EF-A499-62A279F6AF31} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe4d3d2786138545a0547b3f56b1706f000000000200000000001066000000010000200000009f52a94a201c7765566e64c7d0581f192c5aacebd0ceec4d0fe97f3e45141803000000000e8000000002000020000000357a49570f19691ccabbafe781afebe7d3a7a58da216a8e4a99f1cea2858e8ec20000000591ec4ef7e1925ea68c84d71b7caea86d53804c3c8d8a657a7e1b84321e5f6d3400000002035aecc971711926d5f5a61558a76803305f8e33fdb9afb01d1bd1bd73cc54d9e1b0f14041efe0a25ca8d07cdc2ee9a3196280339e8b644659fa1e0bdda391a | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424378754" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2000 wrote to memory of 2496 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2000 wrote to memory of 2496 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2000 wrote to memory of 2496 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2000 wrote to memory of 2496 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1bd35bb6aa12d2931e7fe36c9dfa4df_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | s.gravatar.com | udp |
| US | 8.8.8.8:53 | stats.wordpress.com | udp |
| US | 8.8.8.8:53 | gossipandglam.com | udp |
| US | 8.8.8.8:53 | s0.wp.com | udp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| US | 192.0.77.32:80 | s0.wp.com | tcp |
| GB | 142.250.179.226:80 | pagead2.googlesyndication.com | tcp |
| US | 192.0.78.26:80 | stats.wordpress.com | tcp |
| US | 192.0.73.2:80 | s.gravatar.com | tcp |
| US | 192.0.77.32:80 | s0.wp.com | tcp |
| GB | 142.250.179.226:80 | pagead2.googlesyndication.com | tcp |
| US | 192.0.78.26:80 | stats.wordpress.com | tcp |
| US | 192.0.73.2:80 | s.gravatar.com | tcp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 3.33.130.190:80 | gossipandglam.com | tcp |
| US | 192.0.78.26:443 | stats.wordpress.com | tcp |
| US | 192.0.73.2:443 | s.gravatar.com | tcp |
| US | 8.8.8.8:53 | tpc.googlesyndication.com | udp |
| GB | 172.217.16.225:443 | tpc.googlesyndication.com | tcp |
| GB | 172.217.16.225:443 | tpc.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | fe0.google.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab13F0.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\jquery-ui-1.7.2.custom.min[1].htm
| MD5 | e89f75f918dbdcee28604d4e09dd71d7 |
| SHA1 | f9d9055e9878723a12063b47d4a1a5f58c3eb1e9 |
| SHA256 | 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023 |
| SHA512 | 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0 |
C:\Users\Admin\AppData\Local\Temp\Cab151A.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1aab366f0063c72bdab1d86eb4225525 |
| SHA1 | 1bed17b14d9911884c3ea3fac2b73ec9ee6dbaff |
| SHA256 | 5e351d6886a7ec3ce2acd45d27eafe9c35d3b5d2c654218d21f1366ff9e7d754 |
| SHA512 | 226eefef4085033e02ee848248e84f901c0dd65d10c24053476a9398215d156e6fbb17cf98c5cc37c88b15baaf0f5cb58f3918afb8e6c07f981023dd5a3a9d4c |
C:\Users\Admin\AppData\Local\Temp\Tar157D.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8e8310a80d73cf2f373930e5ff6e74c6 |
| SHA1 | cf50937abd92a3eb33e3d828ffb038a03ee8060c |
| SHA256 | 2e43f1a032e1fd848500681c107ffdba6e5d448ae43b6664801d6508776225a3 |
| SHA512 | fe7aee697564323634e6c48c5b5c41071e7d60ab99d8d9db0a90f4a3f2e5a088e0d36e40097378151e4311b4b289c059c466c5c70977ca474496f945e93fe77d |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\wpgroho[1].htm
| MD5 | ef21a6c89e0ef6494c444efca3379958 |
| SHA1 | 17f858b0fc12bccc7322e0db50372d46296a8de8 |
| SHA256 | edc67947daf0397fe1be61af67a658bd073af0704933d3a0912be635926ad957 |
| SHA512 | b7f70cae116c04368b0997326b52dc1234e71ed8055ebd312afcfc8fdf5b6fabcf572e4dc7d2befd21198c476e608166dea7a85376ad5b4fc535fe81e69a82f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fcd2e5d49df89cb031c136d453a12104 |
| SHA1 | 6c5858ecfe02da79261ce0abe9225cb565bb2f62 |
| SHA256 | 67b42a53f762b4d83b52a231cf9d85931472b1d36fc269946a83cb76ac2c0714 |
| SHA512 | 6a98ab7029a60706a8ae538ac212223a37bb443aa62147fb3016428d68bf502c653a834b2464ea626a4f9b67886c765d726ffdec333a0db05d723af3f664818a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 28571905baa3914bcea3e663fc5a173b |
| SHA1 | 8c20e686aa2480204add97543e9674ac5fae8bfe |
| SHA256 | e4f0682d4e1d680e80990947ec5601071bf750b7ff061e11814f92e4d9fa578a |
| SHA512 | 8cf2fccbfd515a0fc49b8fa528304693b87a234d94bdca75b7e06ea3982ffed5c04ede6b4695853a8cbb7e22bbd031f8a72c49d2ccf30bfad67b9a40dc67d706 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 66bb7dfda165e95c4964e5368cb459f5 |
| SHA1 | 8afbf364d480da6266875507d5cedc783c858a0a |
| SHA256 | 7f223f9ba14d174a7ed5fae273c8e3803bd2b27977dc2bb59504d1c7227d920b |
| SHA512 | d4a361f0589283f933cd15968b59fb40c2e2748916e80202f7fe9754a86d7fb3cdc07096412111640c41677dd36d6c311d22639ed7cd2bfa3b04f5147b7b1428 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ea4737573d12a75364950dc7d724a672 |
| SHA1 | 2a5d9099927e9a7ae5984da32e9f8d2597bdf885 |
| SHA256 | 8fec7b2631e7a8b958f6da50fed0e1c4bc824dc071f5ba69152ecbb3ea155123 |
| SHA512 | ac47d5ecc2f949272dbc6025515c71f13b7c801734733b66814ec98eba9264e47c69dc94572e5eabf36677d63e13fdb7734bf3fdaa2fe99b9c53b638fab78c3a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3d6fb678c764713ae54b5f5b305e44d3 |
| SHA1 | 14f98cbae011f9d64f79e1ecd23a16bda4e92697 |
| SHA256 | 5050c3431dc64f8930d066f2772482a1f0b6b7025b1a0913530cf1ce3223713e |
| SHA512 | 62a5222f42b73b1f9751b58af110b70a47a6bc4bbafacf8452d9e304ca76769233871a88b6987645bd2ae7dfce7ce53ed160600cb18259d20b6cf0abe55cfe22 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3adcda2658f022eb5bb6774dba10d85e |
| SHA1 | 206d385ea1f4ba1d3a6c799eb5a889a78eb5d39e |
| SHA256 | 728144901e9577e8ae02b621384ed12c467cc6a4718615202b10e4a598f97d15 |
| SHA512 | 64b9030a5964619ca1979ca68b253d2faa022e1da3cd54b75def15067db3376788f68a6d95c65cc103208bdf01b6f6267116c42587d31d2ed0fa442483d37497 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 72565e18670bfd8090f6827f47262ed4 |
| SHA1 | 84497a7e05a0061a57aa8d89f591cd742040f7dc |
| SHA256 | 2ac631e9cfb3c43626b5891a125e378dd8d6571ffc3ab4c7f6fa6b7123ba3ee0 |
| SHA512 | dc762d09aa3ee07062e3109375f98d6c2dae26936d9d296653b46550af94625a1e2c6baf9431ecfd9b9002ed883b7d4cb59cd0415c6d0542dd11687227f868f6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 45773f44958af1ab3c8aa67bc96a1036 |
| SHA1 | 2166d6d4a9fddba9011dbed2e04ebab3e2a1b4b0 |
| SHA256 | 1a90ac01287ea2c7f0cc3d8e045071808435c7e59f94e8c752beb5b8b8702fcb |
| SHA512 | f0578d2c5962a31390c6d19313e2c8b6606bb9717cf40d91f1fe075003ebebbcd330c9ffdd8d416d42afd4f841ee7607ed6d184a7330144abccaabcce6c8c0dd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2ac580983338aec62a0bce166746e019 |
| SHA1 | af6c74a7eb06bba8be3e3d6c1fc2374f9cbcff0c |
| SHA256 | 11fa5e67b8bdc39d2a88f7b43fc921c9469fd5646fc97a60d93864a2b9433303 |
| SHA512 | b552a20e07269cfc31c1d0610b941abf88adb93a27fe152d88aea8861d32b4c080042e81cc1fb99e08034c78206e9852c8e73270bdecada8bc9875436ca264e8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c6f9ceee259081f7ecffd148afb1918b |
| SHA1 | ba6f42aaf048dc091c87c812b8d2dbc155df99bd |
| SHA256 | d6e4d2caf83f901344cc26551e709dbe63e3f47690d911027724cc3cf5c66603 |
| SHA512 | 1f407c79eb6a9a4f224b1bcb692bbcdce58bc2266befde042790167df6e43061f0b4e72b593c4bd0ec77d488b7e24b5714ca0a0f2a9b623d03bcb7a66ce8cef9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1dc3d1be7dddb4d0b17f52c5f3ce985c |
| SHA1 | f699fd5ae01001f6c368ae66e42b2301b820ae29 |
| SHA256 | 76184a1ed827469c1b6772a2415aef6d1234d5f4ecbf58a39df1c65baec28f74 |
| SHA512 | c4c59126e6a72bfc7d9a4abcfd78b271af29cbfbb7c977e30047a2f7e3b318eb41485988b3ca88015ba132811d0a603ea87b69f0805295ad925ec798ffa20045 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | db8fc59865925f9cb498b55379c30da6 |
| SHA1 | fa038405c85ac2f6b547515a3ffb530fd4f4c8a8 |
| SHA256 | d22dc67f49ddd493ca286edfec017b7fbca5ef3932061cfda9486a420d4f1ed8 |
| SHA512 | b42cfd098827ccee9e4eafdfdc6cc21b09cf7365f34c07560045d6870754613a7e4d2870a87bcd162caf026bd337fb76dea1ba8184da1119b034cdb04da0a905 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 359a916946bb711235fc84588bf796a9 |
| SHA1 | 82bb1e9f88107d887ce58fc8f1111b8e36b454a5 |
| SHA256 | 1fc024bd59c63ba9b36deacbb85ee6bdd0c5400fbcd02e4f847013d26b7205ca |
| SHA512 | c2e0443598402ec5173ce2287ebd50301824c3d70d3dba0e486ccb7c96b49b044c655418592e98ac13e66ab884d1e3c376bbc28b83cfcf07a382803da28b2fdc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2dd7cedff1a4e2e335b4453d1d35bd2c |
| SHA1 | 37cd349d5d4f15051240765cf745463bcd60fde4 |
| SHA256 | 3d4ff0f304d54758c76a2b06661c56a63639d2af675e854a0d69de5bdee350d3 |
| SHA512 | 3f182cf1e75042245c3e581b8cb89125d6375691ac013a2624408a18487535e6822fc2f5138b25188f33bf0c56e7e17b2907d58c31d296c811f2448a7f4cbc69 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 98cfe516d6d4263a7ac32505242c8f69 |
| SHA1 | be521811a7301ba4d5604728e97ab81b6c40d503 |
| SHA256 | 5a4cb87f36b490ade03e6fed7a4214190132bc3b7b4b2e67bb82f3cb62bcc90e |
| SHA512 | 85278a7c3bb3e2947ce59af7adbaa66cb6a71c1a1c05a8eca6258e3adbfce5ff7fccedcea7d6cacd3a15b2a63ea310ca8b435caa8a0761a46f6bb37c96ad39fd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 70494e493ab742fcbd7d97e1aa319eae |
| SHA1 | 6847f8e0d683252b86f362076eadcc0379ef11b1 |
| SHA256 | 108481cbf2375161c812e148cda4049640b5614305e4198f7b24bc885f346324 |
| SHA512 | 3d624e497619c8efeede1d55d508e4a2899847cd218b04071e2141f8497430185c63f4e6988a3009f88cea6eda15a740ef4d266249c14b89790138ce8dec1c42 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 378099818965154d0d449cb8de0ec4c0 |
| SHA1 | faa39724e478a23380bc2fb4300339e3d460016f |
| SHA256 | 71c8e1b749391beeef71344460f7d08190e6d5bb0702193f4bf2c2ce2fe1ab93 |
| SHA512 | 9e2e1cc39ae447cb3f8e408145ba7abfe2e64f1c729e60fa75d97f0fe2b46624200732ceac8e7c6a6561c936d02fe3ab46d348976fbedeaa76cdcc349f376b33 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 42be8baae43f2788290d8fc47dca9736 |
| SHA1 | fb59e638028a7de97abdaeb01c85a81c099dae1f |
| SHA256 | ae4b9fd20c89a82ae29fa5dc2eb0d5d6c38b41544428e24d9a7be3046b64a442 |
| SHA512 | dc7f8f4be04992b60526fd46dfccc6bd78d1f93d1762f2ac9623afb91b4732719dcbfd9ed285d16ea12af18cfd04754340d2a9f5381141c7b2cda7466a7bd9f7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c97fc55fd17a23692735118235d62f96 |
| SHA1 | 35c6e5ae0c758c777d9d0941f7060d828c4e7f0a |
| SHA256 | 64b4724c004a65ec781dc663171484a5e7c00ed62c29fc70098a5bd4b07d5fb7 |
| SHA512 | 27afba976588b3898d416763e7bb0ebb407bd8ab86c1a52f1ab5a43bb0411fde70eb120204db05790982fdc10901ef8a221b60bf133aaab36479943180791517 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 64a15d50bcdaa72bb2cc4c9df8889571 |
| SHA1 | 1544f4c594a02292b7ed283ab8dadde0f4779d1d |
| SHA256 | b155b0e4f30e66961259001cb77f6a69522a6ffd78c17c40434c2153dcf8fe58 |
| SHA512 | 40119ee1312718f16d6f07817a80dea325278db5f544ef6e62ef3ea6851a0743df3437f234f0736f556061d3fcff769aeb7600a764b43cebdc150804099363cf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fcdedc2cdf676752f5a3af623d84a32d |
| SHA1 | 6d9fc9b30e6513cc66ec72221fe6655e7c316ded |
| SHA256 | fb08baaf0dc22fee7db549dd2394e256fae73f892a3750249b752f2cdbfe70ca |
| SHA512 | e614f42ce130edcceab55a9783f8395e36d5810ebddf1c442178dcf838a4fe5bad679aa0565b1336b9f3497fab96a65ac72516e80bcea759c4de9647b52beb6d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d857aca28c0744ca6c3868969251b289 |
| SHA1 | d3d549d0ab6c8a4b9bf022f96459daf77d8de961 |
| SHA256 | 8e9f71a45871d395a54ed9a59d671a2179540e1f8812fba62502b5ed0590ebfd |
| SHA512 | 57bb70a011f216cf1f9046db498b7faf172f9cd4675901ef156330900303832863b0f8c36954525874e48c1005c590a6b21e3f1e3a30ae5aba3d176ed1d70ab7 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-12 18:28
Reported
2024-06-12 18:30
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1bd35bb6aa12d2931e7fe36c9dfa4df_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ace946f8,0x7ff8ace94708,0x7ff8ace94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4241234790362059230,11118837322217135342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4312 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gossipandglam.com | udp |
| US | 8.8.8.8:53 | s0.wp.com | udp |
| US | 8.8.8.8:53 | s.gravatar.com | udp |
| US | 8.8.8.8:53 | stats.wordpress.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | gossipandglam.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4158365912175436289496136e7912c2 |
| SHA1 | 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59 |
| SHA256 | 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1 |
| SHA512 | 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b |
\??\pipe\LOCAL\crashpad_2020_URSROEVNSWIPCJYA
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ce4c898f8fc7601e2fbc252fdadb5115 |
| SHA1 | 01bf06badc5da353e539c7c07527d30dccc55a91 |
| SHA256 | bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa |
| SHA512 | 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 89db98b49418d649e17c0e2f175336fa |
| SHA1 | eea3c30907e0c6d6696b1e9780ab49306819d081 |
| SHA256 | 3cf48083ba2403004a433e6ada1863c08860967697f10137afef1e42e1cb4f3a |
| SHA512 | 5fd2b43ef737df175c42c112448d73ef16bec5c96beb3663653e1818fef864b847f746e7cb5a8c9bf895e7e16e8ec23bc3c23bb667990040cc7e376148e6da86 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 20a61004107617ea9938e1d19cc77cb3 |
| SHA1 | 9f16ef9409e0c6b81f3f8d5a6bc14b07b287d665 |
| SHA256 | fe36d36df83446f4e879afb02a165be4202199d8ce7e592a2e78552a6eb057ac |
| SHA512 | 74e9b30ea578bc3c267e7d8793fc6505e15fbf9ccf31eeb29f0fd05415cc1c196f2b2cff96f547a9dbb2383b8de111ee17a4a98fd2d173a052fefad96a63f8de |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f588059845815c1e94c6b0058540e80b |
| SHA1 | 42b4e77e346dac4388c56c37b3b405ba4aacd860 |
| SHA256 | 04aa28cc8a8dd43522c4543bc3896243baff1aa51de3db753c8654388f2ccd1c |
| SHA512 | 4afa75066b7abfc4a60cbd2f0d76c80a1d5a898c02dfea222a38af7bc16ebe453348df9a86eba31d690be07632a3cfee0576c1c624ae17e551d6ca5b6aeded51 |