Analysis Overview
SHA256
8dfb0eedfef310d1d7078b14da531b1ea3903838e0f18363377725dc0b9e126c
Threat Level: No (potentially) malicious behavior was detected
The file a5d14784f2dfd2dd463c1c3df553bbcc_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 13:35
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 13:35
Reported
2024-06-13 13:38
Platform
win7-20240611-en
Max time kernel
137s
Max time network
144s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000bab61f20a2145957a04e5a85c4b6def501c450be49465670d1a505076af80fb7000000000e80000000020000200000006cb976032c601c245f5fd356d0ee38995ea978fdf43e3a2a33120ae3c2e4a0b820000000c16dbfc396da005e069ad708232aff7b6b935e3a8951992390b3dfc3637ac8c840000000f8913fe27922e81a7c7365dd28522e2b816cbe9c12de183fc9bc3d384f39270da3b944a1ce9bb208e57672d0d39629deac5e2280c9c615d8dc8009f4bea4b3e3 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D56921B1-2989-11EF-AC4C-424EC277AA72} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c2f1ac96bdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000004904b58ecb28cc1099857e2da113f3d39b3a553d3c6949bbb5e3d5d08030a5a8000000000e8000000002000020000000b47b12c06c69434656a724a9390d26d48bd745df80145550009c14f7dfd5e77890000000e8e293d3097d7a0bc0e42a9d65953fbbcc422bc4d8ea379e8df41198cf4a4e4295943de2f321e43b305f6f305bd4cea29331598f04447b3c177cf1d71096d202057ea195ec4640efc156674126a2e7388acf3a546d879160c375be36615bc28c77281984aa517bbe4c66c9d7db7445c6d1c8ea1cdd6679e8101af3ccbcba038d9acc96e6587b2462aebab769e643c54e40000000fd0d012ac1ddb4e40d376f1bd48c737e2e99617e32976206c6f61340998bd18359bf54d07bab0f2b262ab3bd36abb476e07996cb2f985a09923d7ae06accd9de | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424447614" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2852 wrote to memory of 3056 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2852 wrote to memory of 3056 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2852 wrote to memory of 3056 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2852 wrote to memory of 3056 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5d14784f2dfd2dd463c1c3df553bbcc_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | cdn.yottos.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 216.58.201.106:443 | ajax.googleapis.com | tcp |
| GB | 216.58.201.106:443 | ajax.googleapis.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cb85f3fcf86ef0de7ef258539cae87de |
| SHA1 | c73288fff07885a62f8c7033b348863ed3b8cad1 |
| SHA256 | 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f |
| SHA512 | dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 8103e815e464c7701b005a3cf3f1dfc2 |
| SHA1 | c24d46c46845f562f8f8dceeab6bfdec273b7f71 |
| SHA256 | 98a774fc1a9187d743241b27b7c1f523d94764e75058c16869bf9825a94c68fa |
| SHA512 | 98d0e1f8f30e87a8c38e17f34da3b665a736de36e3088636ff4109720cc29ad5aad8cfa15a940dc6b8c191d9e9357e97cb6242a87b6d71eeed79183492b11390 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | fd4ae329def287b7fdea8dbe4d0196c3 |
| SHA1 | 98e80a34f64799a5b896a5726414fe28a39a8bb1 |
| SHA256 | d80e9530c635dcb4e6549c1f17fa3ce0c23ba8cc0a81f1c16b4cbfd5ed0439df |
| SHA512 | 384cc41bdf2723470c49bf668a5760e7f41a399e499a43861b1d4d718283ab3a1b0f48e91faa9b0e285ec9ab14dbed37878226829334914bf18aa2be0bd2b51d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94
| MD5 | ac7232a956b6d76b1ac7e902dba4941c |
| SHA1 | af851f3f45f848ab67a144bf347eaaab75ef84d4 |
| SHA256 | 7f84f520d51bf3efc6d2e3ed76868ee9d75ba231fad167310eb03f4321e74641 |
| SHA512 | 72c3b1c2e95cf27ef350d02e2168268e97bc463e3e1d2b056fb5fe676fbfb421f6ca8b4d6fc3f75a347ab3e1a34127e2ec10203fb8b601e7fb2946278918c189 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f0e8d889dbbb3227ac3ba3e2f7df5404 |
| SHA1 | 299596e42ed9bc87fd1ff7c0682444940695d292 |
| SHA256 | 05d8b38e4cf5088f961ea9b3ddfc7b076de84fc9754e73b6f39df5921ed1719b |
| SHA512 | 03762dea82a93f0179481396b6d424adb0e5ee36b65d33bb26d2d695f1d51726a464540dccb5e428330566930c5c3d6037bccc01fea5d00233b445b4cf1fb876 |
C:\Users\Admin\AppData\Local\Temp\Cab8325.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar8412.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 80e542f5e5c47df73bee819b1afde0bd |
| SHA1 | e0bce90c7bb78fe66c9f5c6c1c4de67f560b09de |
| SHA256 | ea26498e4ca916c58c7881f9aac0ce7293d530ff2650fb5729ca70c2de9d026d |
| SHA512 | 03039d0bd11202fa60f71ffec9a32ad3436a8e09be58ee3850af11f57f7ecb8825eb478c046d2d8c31a57b3c6f916718f0e90acc906a7f50f2c1d29ef2c2ff33 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 546db1ed316d2650f9168dd7a971435c |
| SHA1 | f59f5cbf56f07b40f8a234b93e1b661b145d74a9 |
| SHA256 | 51206513f8e126642652ead0b1f2a36e6b9e21230aa4cc6684e6d06afbb85bfe |
| SHA512 | 2536a9e90f35e29c2bfd51d72f646b4b7bdb1a57a4515be38908a52c081853b6e85dc6847e76163d7b8248c3e9bc06713d8ed237c168859ba7641be5407443f2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 68272b2a01867eabc81a528014b7ea80 |
| SHA1 | eb5225a2abdf7550e00b499da99f43e2616436c2 |
| SHA256 | d25d691060c676ea1761c8d659188f8b7a067db8463a9f1e96b9a4def598db7a |
| SHA512 | e29f457e2cfdaeefad11d2f2b092bba0d63e612f004422a97ef30a2ad26348d1e1fe27a32942cdf45dd739846eb786fa3b031b856599b15727e2a51ae1b6da17 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b567a654932ab9b302da296d7a06b2eb |
| SHA1 | b653247cd589f90ef90cc5807621107432eb39cc |
| SHA256 | 524a0d93ea73f9bb3748f0c57886c206fbc48ec24d31691ac9767636b93ef974 |
| SHA512 | 13b1d3bb9369da2ad82a5188e7efb0d36f51f001ad304849f7c8d18e82236adc8fab56de9c0488eeffa2de9479febefc78e79108ad33821a68146874bda4212a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8ec66cf98053f32d37806663de87ac54 |
| SHA1 | bf5820ca518ab6f60668c0d75a49d49cd289936d |
| SHA256 | 99c7af6f78b707faa750c06c3d903d106a15f2a1659c08dfff728edd52b9ddac |
| SHA512 | 0a3d41e73bbd5275e100f0ffcaca8037dabb2cdb95631f92ed646fce57b26bbdfb87826bd101fc843d217fd44d11e51f947ca5727daf4b83a74257b260e27782 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 00d849d876443deb4e2639f2ba345bcb |
| SHA1 | 281283c0e4a9b9cfa4c7a47f9875ecb9ca064138 |
| SHA256 | 1552dbb03d61ad6c935cdc494a7c5ac8d5a51710c66b76d47509d8a19eac4f5b |
| SHA512 | 8730e865f2712a722aabecf933b2e256a6b517af8676c87c26507f76deaffa71fe23a89a1c00e38aeab033695905257a979fd62df6d9d8136cfb33249fc54484 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1402d32b3ca2940b17eee2521104a973 |
| SHA1 | 50b4f366d7dd2c7b8d4954697b4d38351c7c5c9f |
| SHA256 | 7f3ab6a73a0c075ad74db7ad728b208c4294f537a2b67ef4e4e040ecfd1168e8 |
| SHA512 | 1756e30eec8877961d4a1d4f3fc1ef5113331e8259012e0f71eca2ed3e91f42ce713e0a061ab4ef110f1ea0b965ec9ad8b5daa8d911262ef14d3ae21820455aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d8a18d06babc9fabdcde99d743dd45c4 |
| SHA1 | f2ff69c288edd7dd66e919727b95b720dded489c |
| SHA256 | 5909432490383d1d4c9d3a24aeea87cc31d9e13b7795b1c3b7f0015c10576f9d |
| SHA512 | 9f4d9122b58f410c649a9c4c8b735881fac670af44f9197b8af691087fcdf3d1c33aac2757e4d612ab7f72a4814a768fb8012a05be018ffadd198a93a41d92db |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 14937e0b2d4db4e7c64f4b2fb05ead02 |
| SHA1 | ff6317388006f2f70852be38dde9b10ef1126bf7 |
| SHA256 | 2bb9fa26cd2935e2ad0b46873ccfa899d498c735ad0afe722671ced1cfd1fc58 |
| SHA512 | b47ef4eb6cee8c7f10876c81c380088bd1b643d76112beb6bd41be996b817433b636c94daeb7007e99a2b30b813e848b79b591568eab0fd4dde1a4462cdd2520 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7cd9c6c453f627f496822451579d5a81 |
| SHA1 | 648e88c95fbc1e47c27f49496861fba5ad814c62 |
| SHA256 | 8b26276253e4daabd990b0c7d7025de2a87f3626bb8e4df11c9bfeca870fba3c |
| SHA512 | a05d1d4b87fdb12e36febabebe077f57053f20fa27e83379f01ea71b758283e1b96ad06b2c67476ebbd8fda41eeacfe3ec60dbfb6a3e83266e1c9f3634096373 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e400e7c8f54e9a1cb2e247ca168923ee |
| SHA1 | 8ff7b8c9b7e3b484eb92359db062ffe00d7bb9b2 |
| SHA256 | d1f1efb404318845c070a9aece6eaa1ea5c688d798d45a736e644a7b2857cc65 |
| SHA512 | 2cb64df3332261ad2cffaa6bc0a368a1cf4d090b4104c5ec13c57fa9edd8ec9f7f820a75f02bd3a8bf2d177673ad4759b606c226b0d0d1f13b7208fd72df6378 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d3b09ce1282b342492103319ee87b79c |
| SHA1 | ad79240022c8c8af87145e46c0d74f88576207d0 |
| SHA256 | c1567a62863d19107ba4ed0316221505fafce08d6f6ecb8fc0c10c71e243db09 |
| SHA512 | 6aedf1b7cb4fb0c1ce1e4550cd148625a28e6ec8bf3f04c3f5d5993d6b1de4a7bc82ae56087bec3b1b2ae0dcc077ac3f902439201a4ebcbb7f54c042799078dd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6c59ade0a852b26098f64256885042ff |
| SHA1 | 5360b71caef4a166d880afa5800da51c21af640b |
| SHA256 | ab5b15ae6a7d26d580f08378fae5e0fa05c8f2df3380ea1a2b74c5cf735fb0ed |
| SHA512 | e12c9df0956cdb649ec95031cd9c9a3370366dd14184315750b2903a5f3bff2f29ba0c375547080b38c74efb1f01539e6cb61a2ca368e5ded0a5f3b32f3eb08d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8b51804d03b6a353775ec61c553dda85 |
| SHA1 | d138cf351c0b4f4fe5e85c392e66c3ab897fdc5b |
| SHA256 | 9e96c1d027e959e7416090cdbd10e4518b100dda0b72e45126d92632b1fca6f3 |
| SHA512 | f368a5f7fe74c4126e463f677158173e56e32e6b9f640cf3d47a958c22b5316258b3ef5266d96abb9a685260461686e9619303234e206a3a40a4731a2223a349 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 86424297cc4bb64b91dafe13b6364cf5 |
| SHA1 | c3b1a662e11872685ef8e066d3a03540fa05e898 |
| SHA256 | b7c6dbc95b9712106c10e5f001ea19ecc5570d0de6921dbfad7fe36af4013743 |
| SHA512 | bf155e6c4f199375e9477f9cf1bb5046bef8d98e09e7e9c07bcbd5679cb47a498ee32a13be92fc75c6c1a6282f7af482c458d5a0949c7cae3dcce449f6a5c399 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0c0dfa56f79f26ff537785c03751fa5b |
| SHA1 | 4a3c3784ebc07fc7e10f57276e81fd4b8c058fed |
| SHA256 | 085ee2313b0d6bc9e2eb3864abb8c6b54b101c22a31d5f05b1989b17844fb576 |
| SHA512 | 8e9e32c727eaee041920a4aa5f51425637c5957c8dd110c047cb7047bfb6074e886a8569bc4bf572bf9160621cbe79f50d78c09a13612fd44ec8ad407499f0c4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 41c5277b9f3d3d2b25e4ea420fa8f5a3 |
| SHA1 | 31c7c58662dabd83b603dfa60538ee83ad0dfd19 |
| SHA256 | 1fa41e1d59783c3f7e737c6c408a83fbbd77007bb5f30af34b76aedb9700ef38 |
| SHA512 | bf48d7b517efef27f86100a24352bcfc47e71736b8a39a3856aed4b4fb55c63cb8e8b70eff0a76f42443c5bbbcc203c9f78b2f73d83e3bc034fbb5b13e0f7581 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 24a3213c01ea5ab4ae0082efdd5eaaa1 |
| SHA1 | 0bd556598edb697db798188d5e0b3b7833651035 |
| SHA256 | e1465a24df2429ed9c3610602bf5260f96e2455dc2d75a0f27a7ce26c55b072c |
| SHA512 | 584da02feb979d5a7cb4a6453464169a59010a1cdbca21496ed9b7583179d93e1c757f12c5ed791cf1a89a6e3a475bb1b90fe428c7226861c5299401801a46db |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 98bedd4dc704b5d217936c3398911967 |
| SHA1 | be3fa46df1f0074d1c31d95b1903cafd7f1bf1c0 |
| SHA256 | baa106e24c1aed988a7564b1fe1ccfb92de8a5e043254abc5dc72c542e70ddb7 |
| SHA512 | f9ebedde69a4eb8b9a246a88836b1d1a04179a98ad4e408725917bfb793763c0cb532de636f4bccdca121992607ca0e5d66b727745108279c6d985cc6868aec4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 24bdf398bb30dc70d4625f7d0891c22b |
| SHA1 | 153d831416727781ba8565074dc380d3283d0586 |
| SHA256 | 8043a2fbf81252df8a12afec4bf87e34f65923c5499274dc34a8d0e0a60bd8fe |
| SHA512 | 34fa534790c51a3d8c8b67d5b45d5b034c9451bfd5486937cf107e9f4cc6cc1f8e7d670b722ba9212da1ce0feb2bcb2c085111e21a79567501e631d77e19497a |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 13:35
Reported
2024-06-13 13:38
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
129s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5d14784f2dfd2dd463c1c3df553bbcc_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13259226684806623502,1568268043246995701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | s28.ucoz.net | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | counter.yadro.ru | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | cdn.yottos.com | udp |
| US | 8.8.8.8:53 | pl14318198.puserving.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
\??\pipe\LOCAL\crashpad_3940_XZRNXQFACZMMGXTD
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5d57d8f71e6503c7a24ea2dc746b4fb9 |
| SHA1 | cfd12207f85c142a9121e3170137f8f12b6a9159 |
| SHA256 | 0cdf2a54b811ba1910ae3d4ffaae04b0cc52f081b773d8d807870019d746bdde |
| SHA512 | 918590dfc4585b488563b8827b69b12d26098ed495b6fe52aed267e5d6e6ce7d5f037828652ec593ceaeba52bc28788560e11debb7e817fb19f2afa91123ec7d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e46ca62c2727eacca7a4018c910f9ff3 |
| SHA1 | a9e850aaf334076f7e185cf6f97231f7ab217a0e |
| SHA256 | ba24626f1f9bdbc351567c17e9710c37c36d0880b847472741b45a08b4a95164 |
| SHA512 | 614dd0b2f7a3663e60326bc353830f3cb5fbaa4e9dc879b597e341e41952efb1ccb09c89c4d175b2f1f625cc336873369e5ecfd4e8251b9f07ee7c468589c43c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c9018ed0f602b2611978ce3945f1a487 |
| SHA1 | 02e8646564eeaff6dcfb10218c4365f08759b3bf |
| SHA256 | 120e4473d3f063225ab108698d20196d895a4ed001a8975a2274ee83f45fca36 |
| SHA512 | b37653e78ff17865d5a7282af37051ab0638a66992458eca17fbaf184b8692a9ade509cb7c82ba424adedecaa134cbf441a462c8d97d62c10c68a918e456be31 |