Malware Analysis Report

2025-04-14 03:47

Sample ID 240612-xepbbswana
Target a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118
SHA256 9327c98c918a5fbe0234d055aa3c3322582d9d3bb64d51e18173a57e67aab99f
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

9327c98c918a5fbe0234d055aa3c3322582d9d3bb64d51e18173a57e67aab99f

Threat Level: No (potentially) malicious behavior was detected

The file a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 18:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 18:46

Reported

2024-06-12 18:48

Platform

win7-20240221-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A5DF791-28EC-11EF-9034-729E5AF85804} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0da23e3f8bcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000926094ea8f889b47951083f09e2853e3000000000200000000001066000000010000200000008dc87c810d61d48a4b47289dc09271e059729039891587e638ea6b9236dcc64a000000000e8000000002000020000000da9317e148064d2474f15c32c79c61e58f717b133bb211229ea4723bc5a9596f900000009cda0b0931cf125a806fbad7ec368329a2a254ac3a9abff111bc511a7c517654ee08e7480aa688d110e5109f0a0a59d18754cb6d5f86220358027b5dde4dfcdfa29a5421954d89275973602d71960adc7cbef568aa341d2dd3d7deb6d0f61bcd904ab955a94d3261b38477d963834698d6a0e058ec222baa3daf525e2b889b65052411fc57cb11b007961d1170e7d80840000000ded87bf816326ec953622ac89d835d809802277e9d1e7c8f69181238888cc8868b3c1858608a090b0f1cc55e7cd5ae8f509387941ccbfca8730fdc42320b0f31 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000926094ea8f889b47951083f09e2853e3000000000200000000001066000000010000200000005b55203832d4e115d00336849d3df4215bd09378c6c884cb8be7123f0bb9490b000000000e8000000002000020000000694e6d452b1600bb8019569cccec8452d20622e1362659fd95e1d8396c87248c20000000d0db18d6986548d49899c3de1ecb3e4cc543f6dc261e9d8050fc8deb52ab407740000000a9a4d05ea4d842192d746f708fb26edb5bd605da165a956e427e216abaca479a8405bb47482fba8996173314cc94d279f39ddc4989d177694e7e226438afdf49 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424379840" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ccfsa.org udp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.9:80 apps.identrust.com tcp
IE 2.18.24.24:80 apps.identrust.com tcp
IE 2.18.24.24:80 apps.identrust.com tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Tar192F.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab1930.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1ACE.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca93c3871fa0395e015c0fee1db534da
SHA1 5854742693562193eb519fc15617c7fb3e23ed9f
SHA256 273a7a4427e8d798e0b011bada6f7c5cda97a86d80ed10f46ee6fe58e4b12f45
SHA512 46bf3531e0b81ca492c76af6a6fef81f5e0bab0e373bb4c92bf6a8fcca20d9a3d42c1df75a3fd0d4b3ef064e4820570430ff042209c08e6811bf2c10a4c78dbd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\style[1].htm

MD5 5f12f7740a253c06bfcc2a5099d4e8b1
SHA1 edf2d48a6e25853e0f5e59d7f55915e444a92304
SHA256 9caf06a01c26f05dddffb912707ee35907e85cc624e0f9997bf496351e53aa95
SHA512 5e5be50582f4f852deec7e3d63885c83b19d5df233c93263389d2503b06be01a898c518c1a20cb42f77c483d15b330a5e0f3b3f70894c95b78f347732f884687

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c561cb5cd52bd64e00b243a8a42b88a4
SHA1 0f8c791200e9a9eb2f731e393f5ac9c07c840b8d
SHA256 890d760892676cf411d4df2f4bc7d05a034c34f1d9e13090c30be492f98a8c25
SHA512 5ed494d7de4bfc844a4aca4593db619d7fe5e0a9659d66b53ae7091cce217df3e47c3029681da20fd619aaeeaaf1f0a176ae739f946abfdfff2e872dc1c90635

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\sb-style[1].htm

MD5 5aa831008f6edae03505a6ff27ba4f97
SHA1 1721f9cd4a5a1474c1e28dbb3ee3145b985249e6
SHA256 c9408243e5d723552bf72dc1fcd4c6b1e18b3d2128abb4bbf3bb9c4096da8c36
SHA512 856d061074a3b6e1ce8b19a666e7e4396124e2ce7a7670e19fb5dc761ebb6f92a773c0e0377a8f263e971959882a165512800a66fbd288507c5d5ccdf8f2f72b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 385def694b37cbf8a72d082344d4cb87
SHA1 864bdb66277ec894a988e9e9aee59176274542c9
SHA256 359d0dd7bf51176b3015272fe5f70e148d29b48f3b02ecfc46b3c45f399429dd
SHA512 26a1357a10f5d9bb88c8264ff152452f1676e6794f4e41bdfa06898f56b3738bd04d4955e487a60ac0d357b4dbf74d6c2dd1fe6cc8d745a6e2817f2b8dd2c2ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4571e2874f54058f80c152c14cdaade5
SHA1 edbca4f24ba86cb5b98a95ed42ab6c17839bb480
SHA256 f20e35c3cac31c0f93db5047e22beefea1c5aaf78425b95bcfd91c39e23846b4
SHA512 04c76814ba13230e7e08dbbb3e14fbacfbd42a2d32c6901354fc36f88dcbdcb68fc76f01dc7e1dfcb10f796660b01afa14a54c8116bc7669df550ac1d55efac9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\jquery[2].htm

MD5 3cdb8cbacf697b0345f53812444e99de
SHA1 7dc862d4c30d1ad8f0873e43495b0348983aee23
SHA256 1a374244722a082d88466d7987206794adc89aef78540a8bb73c161d913c0401
SHA512 133302bece04be7913bd93dec67ac66452bc6e9fafe62ca7799b793086d7d7044f0d69555e5c0069c0e35a3bd8f3b93c647ef628fe23cb76f1e6b6223508600b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\themed-profiles[1].htm

MD5 4d4004e111a0d891337d184c593f5776
SHA1 f7f3ea4fdeba5fd00bbb6bf268590cd4cb3339eb
SHA256 54daddec2125dc15b27e13f6cf0a78b74920f152619c0e8a470c287cd9d402e7
SHA512 6bba29c02c402e9816d04b5ae5f544f4da8660e112d0e2c0af256cda6bb615b37e23bfe443f2b85630458450d38161d687a7aee14a787c0fad1110c5e213d361

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\main[1].htm

MD5 fda44910deb1a460be4ac5d56d61d837
SHA1 f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256 933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA512 57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\O32PJIPX.htm

MD5 f689e04549736ebd3853e9b64fe4e334
SHA1 04a4a387b37584451bb2a50e777096b1170bceaf
SHA256 e82a5e1e15e3995e056354bba5c072442dc3e7d1d4147bf97daa00fb83656905
SHA512 39a828a5b65e8d6c96d8096ce24ffef0d8be9007b49b8b695796d3d582c595ca52f4465a29f861c32ce447d6c7cc78eaea8caab55517b70e2d742eb4fcbe2dec

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\form[1].htm

MD5 f88dc6d057d6caf9bf0d46917850193d
SHA1 50a432f639ddcc65289d20039ab7a7b386d465c0
SHA256 9100398f70e6c1c658fa6be69f51599f9d8c35cc4b708dc011b14b2b57d6542c
SHA512 5cf25b3008888542c253fc9da74cb307063d3dad8697c6b030820315c46f023265c83467d9402e56356cb583bb5c54899a842b37ca7c504d05b5b48c16abd574

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\jquery-migrate.min[1].htm

MD5 2733a7d74cccf22246b8a40275c22f70
SHA1 171787f0b5ea6d3d8ffc1c51358313ee9c6269ea
SHA256 c3cf3d5706dabd6eb17946b8360bc439f04b2ab1ecd1b2f7f8320a85fda9d2b0
SHA512 f93e3652f1bef378aeffcb63e915bdfd592248788505af927ac3a6ec0f996093402bfde6b20f5c405845ad11339e81e529dad5e09bb34a3057fc28a7201f0159

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89022a8082e6a189cfa3bc7431613771
SHA1 3e9d3cbbfb8133b5c23a9b409b1d7c4479feb8ef
SHA256 f918d6e1a9636dc4873f60670a31a601df8944713692b01fd4f2fba14ed9f2eb
SHA512 a9d50756ed1042b1e818291a98d3c5119b21970ca93aa56631023d29bce6132f3be5b1525d108cf15e495104964baf28762d1869178e4be1377aca236a9423b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14ab95b623aa977fd9bd27e27926df53
SHA1 9acbbde52742f49fadc73ee97b6e8d6cbf6b2433
SHA256 c9f7bd8236cbb4d23d5789a1e88e975bc4f63834b329833d399493fed351580b
SHA512 906d59a5f8348dfa57e601dec2ee9a0285d86753a213f4d7730b8ca0f31dd3be6d05c588d55992881b7d6784e4466e8a9ded79b5761eb2b0e128091a6e026afa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6a3a5f06165518d37ca639b993395f9
SHA1 1f5667dc7df89d35aa9b4fd838c8c96ca1b9f07f
SHA256 6517a59590b72c448d3e9ae44e42c66ee9848cbcf8f927ef18f1cd156ab9d6dc
SHA512 c9513e34dbcec88b88a1732ceb046e9a54b9a3dc0681d73a30ff76d9018aa5602fe30d1a96ce18e1b26a54764f92cbbd7fe3489d27893c6ac13095a1868e0267

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 94b50587cf071946b43aa308d5dfb003
SHA1 03909bb96bd24d94237cf9cd2c46808d88b881dc
SHA256 e2038ee4d0b31d3c708144c92ac3a4c5286cbbfa0bea03fd1bc058bd9ea1e19e
SHA512 35badb53bf1b758cf6ac1cf0252e7e12a4ec4822492ebd9e463f5c67cba1dcabf347da8343224787915e9f064bbf96db80e542597fe83820c1112f798f6154bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7313f002f04db9d6245c104e03f38952
SHA1 7af5bc3863dbcbde61a6064e0a7174768fceeac7
SHA256 a6db597e55fc6815114278e14c95fd69e710090245511875ce1334246ceab17d
SHA512 3500030620cad525f8c4e2335d8980caabd19b95e676c7eac63b1f5b2a78f9151d3782bfcd08ddaf799df61820ed0f2bd252367aeb1cf7d07a3caeb63f7c6939

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 abe73cdcb3a4cd4c8f00cf8d5692807e
SHA1 a61ebbf1c2fcfcff0f5a069e3c6cfc70c7866b7f
SHA256 40468d149c6384b73c97c11d10c214512298fb88d256989e77c5ef280437935d
SHA512 acbc577f566778857e00448805732a7ad7d848b5bcae5f1607de9bc9692ad13988fe2a188e1eb046983c85431c2c57a476a636174dec60c224f05c4a7065a7de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c0516118afe20478e8a6205ccd7c0c2
SHA1 7fb1dfb52d522ebe966cb26766813b2d3356570d
SHA256 83cdaf537680a81f5647af2fd553ad9dd683c679a353a00b842beeeb6cc953a9
SHA512 3a16e7e519521095bd1012ae2437960d71f78bdc1ae44aa8de7581f01846b7c609437e719f08e85a8ea0398e872f167911ceed1a81aa5e992d9d9e362c708df0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5adf095a4a78b91d0382003ccef1c4c6
SHA1 f913cc8db18d68d4af281533981eb1614e970dd0
SHA256 b36d922e913e2d507b36842eb40ff8ce1b925bd48098abfbf4d0b1c7e9bbf2e2
SHA512 30d5e6c076a3d7d423f54f63fc9982e8304625decdf55f663e8634f1b75b8588f62b230b97685c74e2429998edccd03b766c2b37687f9e49060e7b902141afad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e65bdcbd69b44a46f0113a549759df7f
SHA1 3f3e9f41391e15c8e3fe5a41480f920ca14d4aea
SHA256 f705f05055865d3a483e34e4684d7798d999283ebc12217ec48f7c757c423e43
SHA512 ea7239b5cf5087fd6f6525e3157680fbba4bd4cb3144c8a44c0c126b409c82b6a73d61dda77eab3fe6590bf85b0f93cced11fc210bbb2edc81fd5de6170aeac4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dbf457bd8a691bcb15f9bd4bd870c880
SHA1 2099608e0e183a0852f8401a89f16206936ddd83
SHA256 3a8d2ea8e5890cf68ecc26c9e0f94c0b74eb1106b302c4c8e8f04acf45a80f70
SHA512 5880e76aa44d072fcbd90b1b236a093356ee65c466859952927611fb13867f0dbd2cc2dfa1769988b4e9b9e18538eaedaec2bd401f80871fa3f93b4246e3b83c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78049c3ec8526a499ce243480c500504
SHA1 4237b01ae3fdf93caaa86f39ed9f1964117e8d24
SHA256 7f2896a3099cc6b809ec4256d5f30c82614c50ed4189828f6294d87b5b4a1225
SHA512 4338791c5d717f754fbbb1587a3649743acabc41600830d77baa23e00608c4bc85c37c66b4709c697dc9e00a9d478200de5ca9e2da2ea6c7adae753d2a3ba056

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af0da45aecc121856f47efca33fb7f5a
SHA1 a8b108a6331c8d0ca97feecce4f5cba4f117b3ba
SHA256 0ae49be3ecd7ec531771608e1a6631cfa861199eb0eff231eca762451c610a0e
SHA512 2509ba9f6317a5b9b1a87f58202186561bf4214f20fcb28a2739f31b247c10571e8122a1261c71a6d324af58cc537701791ad47c51a4aefebc4fe918d9adf7ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ffea0a9994134f95f86c941dcfa7a2d
SHA1 b73c1d4218bc1b8f7138195a70f4610aa8ca9283
SHA256 a96b006a2b0f1c49939fab4907e5e5754ec2fad691e4bfdc6e75edf1713ad400
SHA512 594bc1c6fc8ea4f54feb40093c3b89ab2a5ddcf82866eedd66a38f9e40e26e0380f1f35fac8d780b9d88957975055b49016192373ac757a4e39f1df89e8d86f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 6a153f6108a0d60bfc40992452177223
SHA1 de990032882cfcb63a945141c9c77b2c2d31bf5d
SHA256 3765652ab1800ac293e717a96e28aa3dd4df9db90d5e58b553e5ce0d14f4b828
SHA512 57ed9c43f83493da10b2940245328fb5c90735fcea29599daa5dc2e7c3af88387fc4e6ce3f9dc2840a5f180ae58e71c6ba49b60a3159c9a506c56491a0586850

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba7a7fae1aa90e9636c1914bd3cd1e4e
SHA1 953901231d77af8b76bd4e898d0fc3aaa9d4e16b
SHA256 5216d6329098945cb344cbfd013a20b93cfd477ed8aa0e725953f592e2ef214d
SHA512 76a8691b3af157e3595201e017ef8817fd636f1bc3c6b8304734fdd0db623c7e52fa2bfae4b18a189cf36a080f5981a87a9701ddb41053f7a2a89b7f41cbe65b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53a1237a887aba3bf59c8c51c41dbc58
SHA1 c209a05b0928a7e6fc3bbc09b49a11f65567f374
SHA256 044b6098cf464aeaf5a45d711f1d2a05f3b4c1621bad82c8d428293f11a00cfa
SHA512 beae1ed8ecd61324951256bb03f8ea0a4fe34c1c6075f5081753fc580ebd803d6089409c5c2b8e4100dfecc5a672bb00ea9caa9330570c0b507afe3a57e92667

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6849a43598f5e14087407c8fa77dd38d
SHA1 21b0d50bae16fde7e58c781ddf0c23a07bd2418f
SHA256 32657f37f1cc801c887d6167c16dfd69928fb162aacf447494a32732fc80a606
SHA512 8532773e218b4bc29fc94b82f5c5c19a632fcf4584b2a86dce0d5e2d5a4eaaf7db408b1b15b5ed5463cb10f7d4cca90e7fd156174f729b0220949da65e48dd66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11270c38a92bec302649d272dce4f114
SHA1 97105e678c04e32677bf9ec63adc94e2d65fa811
SHA256 5c93e2e9611c9d61c9e99f46b24fdfe5807668d3834bf52b84cced6f8a6b8dca
SHA512 4735724371e933490416f683a0aac2d3c798f9c8bbddb35e78b5e89736ca5bb1e14d3046c4f032b646dcfed5dd1b742ee7792f9c8402345db07f64b74da5a6aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 741552bf7e8bf09a2ea9f4212e52cc5d
SHA1 2b6a7cd06891cb0aad3c14f953bdf85a2052406b
SHA256 3da33c9c876dc2079395e0b81040bce70af774d1a8b3e1a908f49151d16cda64
SHA512 952931f9b5b8b3fdefa4e8bf17858fe2f46d2c1c81f2b7024cfa6e99d95f81bb49a6e9cfab90a45c20d9e9e9e416b41a7fce72d19403e40a879a1bcf01344d25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 b9367bcf89a17aee46ee9613fc3162f5
SHA1 4bc8776a23dcdfaf374ea300ecb50e1e5851ea11
SHA256 aead6b314c0c4202cb750da32265e5c7bc05843dd08778ea95561406d647b95d
SHA512 5b026b21dea34104ebab360c4ba2e973a317d2e6b72381da9b158e41c6c0bf4510fb67c5414a4cee8be6cfd15042162aa580364c5999bb7e2954ae39086f0974

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a192d2b383494f28ab11c6f681a9b42
SHA1 4cc5a5bfec2e22d30af1d07f46e7fa7065343d9a
SHA256 4141d23d31c65d7ea0f8819f0223cdc0925b427a6abf9c4f596e78b084376ad9
SHA512 a94cd50ff1f11c804bcd4c55b1460bc592f5765b797d18ec187f4fe08fe5c6530f0bccb0dd388e78e48fffcd93195d6a5f5e2efbc70601ce5e10fd34c87b82a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74d0d5ce73d9855781c2de1a52cd5d70
SHA1 4ed64b65fd714bb09a18a27a5c77e3e9d4f79d91
SHA256 ddaaa2d65684ca218de992e3a2d32fa7f2aa50c0cbe9ea66c2e77fed95f06324
SHA512 b349d5f431eb82e130c4d0685989008446eda72e589a87bb0aee59cd7ecee5364ace5bd1c9ba67371247da58c422286206a6264079c10eaf54cf4338c21d364d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8421fcee338ba8ff7d3b59fca992f766
SHA1 6bf95e3c5718ad79842a7c8f08aa82615b459fe0
SHA256 5617bc7db4080005ad1df92864b8771304394550bc1494b855f268a2b37f3e42
SHA512 b9eabc24c17dcbf755159b5b7b6532ec16a4e9b62849f10c82c736f7245884a233c65de434462a556c686a8bc17087e26a92fd9542afa9ecd3db2713a277a57f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 18:46

Reported

2024-06-12 18:48

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3172 wrote to memory of 2988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 4496 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3172 wrote to memory of 928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1d04f0f2e17751d476714423a9dcc32_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1a2246f8,0x7ffd1a224708,0x7ffd1a224718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,11016379025206862824,3282141765055247335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ccfsa.org udp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:80 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 104.21.82.138:443 www.ccfsa.org tcp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.9:80 apps.identrust.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 138.82.21.104.in-addr.arpa udp
US 8.8.8.8:53 9.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 59.189.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

\??\pipe\LOCAL\crashpad_3172_LHHWDWAFWVSPUTGB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a10844f48b1e6de8d40cf6be2bd0cba1
SHA1 dd8f6367dda692e03153fcd4f448d911171607a1
SHA256 633bd5a02aa0eaeb2c4190235d0c410567f564759bba6bffede5bcd3fc5fd5be
SHA512 7ea4597d37d02d56f4a38fb6ba9a58d0338af3e03a31d888dfd0ed61e0b14a08079a2a5c048aacf5c1f6cbbf8a361c4d0d372349a5ae965c6132fa4f964222f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 21d92c94798459dfa466a0477d19a28c
SHA1 4c368c5177db04c67ce83e4af0d41ebc44f6a7a2
SHA256 5d34416bf5930d4a8a59ca791e0ee366fc17acb6b352c333c30c256819847861
SHA512 aa3274530be43cf63c79f95e773f6765955814fc52f63811b6cfb2e6e1f17d31eede28b9827971a7ce76419c67bd93dd7bc8e26896b4d38edecf10fd508e482f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d1d8047ca22d7341972b37ea7d57ace2
SHA1 92906439d950aad7c05d350d06329064dd8bb357
SHA256 85e44c54c8c15cb273583dfca13ef222b7e7279b9ddd19294831e3b391904193
SHA512 371b781e0f100dbf91db2d9522917635c0d70f737e758f09e0fe72a4510e384906fdc8dad41710fdbb58be2aebaa245f099dcc27960cf19c8498344e161a7d9a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 754a249c7aa64d0489aa94168d01448b
SHA1 66b375625e7dd24757863f97b9cc29695d18d393
SHA256 7d39b8b1a060e66961d6573f8adf7ac5faa320fc218634a00098a906d11b36d1
SHA512 74a75d695f6c4fdc04a9a24e7ebfe551287d33600c6845377adcd6337857c4a8a6e71e6b57752f4adcac39060631177a1dbe4b2801fe40963438c2f0baabb9e8