Analysis Overview
SHA256
382d618631277f0603c2b9ea1e8f7b3c71453e059721f9f6225eb6f9d6965a12
Threat Level: No (potentially) malicious behavior was detected
The file a5d612cf458f177023ecc903d361cb02_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 13:40
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 13:40
Reported
2024-06-13 13:43
Platform
win7-20240611-en
Max time kernel
142s
Max time network
146s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424447910" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000b6b1f595a008989f32bc18277fb2380c3ed245fd0c181fbb2840eda74bc1d24000000000e80000000020000200000008dee0c2a6762b059a2736d024847eff9312809bdf35a8a7a0d01ea39cdc58993200000002966c4d3b871cb2687ae80814c79e1d1632fb3617337def8f44ce79973e75011400000007e4fb0f8a7c3e904beacf39a4376638e5bc961f18a54e6bcc8ff5d7ea98f76f85bc119c41b88740ab47c06623b39ae57df3127064cc22820540063d495a666b7 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000003f56c75a1c063578e16d9609333027d9d2a58f9e60e5f168cbf0e5af3723248000000000e800000000200002000000062914cef49edea82df179bd86be5b658abda167c9bfd15cd45ca8babc38ddd489000000018ddb46bee6133dcb468baaf5b9f99fa761da4b1030ba1d0be42cb1c37349384359e3d220f48a5028a6e952f543eacaeabb384d9b016fa7fee667df8b69208014c1b72dae3de192d5d974fc9d9c2d1896e61afe655f33af73262cca3ff1e1693c6fa3b8e8f4e25bfeabf8f4bed0198f2e2b4f32fc03fe54b55952370fd3e01902b81ab6dd890b8d4b425ac17c0988aec40000000f73be493b1bf59f8d4d650ed41cd2c34c8b806c1758c1123c3f90c8b46d9743185dc165c3e1cb8f3735df0ccae60667701fcc52e81ad59a28593f15bf562de8b | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8710F5A1-298A-11EF-AAC6-46C1B5BE3FA8} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7069a25c97bdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1932 wrote to memory of 2696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1932 wrote to memory of 2696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1932 wrote to memory of 2696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1932 wrote to memory of 2696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5d612cf458f177023ecc903d361cb02_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | yauzasoft.ru | udp |
| US | 8.8.8.8:53 | dtest.tarhelyem.hu | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| RU | 90.156.201.103:80 | yauzasoft.ru | tcp |
| RU | 90.156.201.103:80 | yauzasoft.ru | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | dtest.tarhelyem.hu | tcp |
| US | 8.8.8.8:53 | www.tarhelyem.hu | udp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| HU | 212.52.166.113:80 | www.tarhelyem.hu | tcp |
| US | 8.8.8.8:53 | tarhelyem.hu | udp |
| US | 8.8.8.8:53 | javaterm.com | udp |
| HU | 212.52.166.113:443 | tarhelyem.hu | tcp |
| HU | 212.52.166.113:443 | tarhelyem.hu | tcp |
| HU | 212.52.166.113:443 | tarhelyem.hu | tcp |
| HU | 212.52.166.113:443 | tarhelyem.hu | tcp |
| NL | 185.107.56.202:80 | javaterm.com | tcp |
| NL | 185.107.56.202:80 | javaterm.com | tcp |
| US | 8.8.8.8:53 | ww1.javaterm.com | udp |
| US | 199.59.243.226:80 | ww1.javaterm.com | tcp |
| US | 199.59.243.226:80 | ww1.javaterm.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8a5a45bb952f65ec335cf78d8b4fac8e |
| SHA1 | 25247218c1d326b9b03d354796775d6c22111e49 |
| SHA256 | 23052c2e86a0de3c59528d563f5c89590653f87f187987efc25050faee35cff2 |
| SHA512 | fa4ee9553cb56fa4f001a4a3bd49468673aa36f46d16adb1f39b0f02dd270d6110e90d7d2a25f8a78aa3fb52cfa1d99a94c7b206e560301d77ab19e5aed94ff6 |
C:\Users\Admin\AppData\Local\Temp\Cab764C.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar765C.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f8d7740598a545aafb491360a74ac3ac |
| SHA1 | a59684e8f543056e135d8ee2ae1d4b7f56910183 |
| SHA256 | 1074887d1fdba1a99e8e138aa4b553372d5471b2612b7657097a002eea01072d |
| SHA512 | e83709c60e7363dfd61b3445a8febd93a05e0d17943b66649aa35d16930d202a6559c1e05ac65359d4ea921dee955f8425a7434376921ae3c41f458c9b70441f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7a38f2fe050fd660ad19d9a7b7513e4c |
| SHA1 | b45c77af6ad546cf6906d4d8cffe907f368396db |
| SHA256 | d27b00cfc483d30039e4033ae9c23f9568af701840f4aad9a1d0a98cd427aca4 |
| SHA512 | d0187f44720f96a4d5bd54a760aac696253b48025c4111a5555b88e7ccc9f9d9d0b5a3a8665cc28199006132740507e67964b291ae40c3e1e30ec3293466bb5c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 56836847b16911dc0f7da6796eecdd79 |
| SHA1 | 0077712ca16aced4d05d2b91a2183050f60adde7 |
| SHA256 | 10255c2b5287951df99063f6c69d0c21edff74986fcc4039624cb7f1fd88b78e |
| SHA512 | a93d55ffe20e4b567153c8515c9bcad1a3f8cb160987c061cf18d2016d24a7de14c577cb422a0369abd0d6a44c47f1a8666ac702fbf4cf40909f3dac047fc13a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5751b478225bf7a179bd9d25865f85b7 |
| SHA1 | 0ee8d578e5a3345f9200344a6903344cc8c831c1 |
| SHA256 | a2048a2a1743f55ae8400c50616b59678449fecd81d052b60c0cf9965498f06d |
| SHA512 | 346d672dff2a2700051892c41820cde3dc33c6da0331440b8cf4f28ae5ac48701dec643055ca36437d912c58a406e9f3597a54b6face6f32a3b1e67f42971dcf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dc0eb7c1284947d1167af4d5ba13e8ca |
| SHA1 | 7c97431a9f77a2c3456caf8e915f027ff259684a |
| SHA256 | 5d8cee74a214f670686e4bc99ea1c47c748f072c8a796da0a3bbd74c645e9c0d |
| SHA512 | 6f80a0d4254e1dd568888e33f67ca0ad5bd60258dd45c8f70b2cb374dc7aa8f3172e496a960da53d1702c2188ff4f0127238f9725159ad17306a59ceacdd1f69 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 14dffdd57447deed1c18aa92d8a2f319 |
| SHA1 | b16c7dc940b357a7915337fda94a61738e0e4d40 |
| SHA256 | 389d54561ecf6932bf88caae8e33a174e65710be54a837f7eff3a218588ed12b |
| SHA512 | b325805bddff2760908e744aeab611186f312db81b8b41ed1ba5323fe5ace4f2cd8c4e990414dca352b4597604b88031bc5d5809365fce5c14e4d88fbe0519bf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4790048f39264b32ea7d506590bd835a |
| SHA1 | 1460a9485b15f5273d3ec35f59d5a5fc3f31a0bd |
| SHA256 | 70ef7255275425eff787c97522265f13da997da3c2086396372c33694bba5352 |
| SHA512 | b5a5e2b43d5234f81bcb45fe7d4f7b7bd443d807029f59494a11975393527f6f1ed390fb89dfb2324b1163f21f139008a766e0af72cd9877d0d8e05f764dc957 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2ae269ddd6e634e38ada13f93ed3565d |
| SHA1 | e001f2d00d036f9e236e42866dba92e24aaebc54 |
| SHA256 | f8c04e2512762154a72c0eb8581bd702d203affdb9d230742a6a5f5c13d0be47 |
| SHA512 | 5e7d1dc946ae89744a02d192142b41cde9bdb1d8c0597fc846166425064708ac1f528c15cfaac0feb3733721f562417f008ed3e5fbfd6cb73310d50d4d9c159f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b8413533a9ff22609866e70c853c63fa |
| SHA1 | a3f69923e7bf1d21bd8f0ff93635e4a74d959036 |
| SHA256 | 83214b9def397f018ad83a71b26410b1de238f4ae9e9d3860c0355f53a34fdc8 |
| SHA512 | d083df31f302150d794750be42cae131734048ffcf36c040f70b3c5b1bbb4471f90557aab9d5c6c4ae040d1d306d69fbef97d6211059e8b6cd3270cb89455f11 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 42ab0b90f996e5413e573baf0c28f2ff |
| SHA1 | aad4c3a9a6b2786848202af88cf435546bbdb724 |
| SHA256 | 09f14180dc4af0eddeab1a25dfb9ec2ee6572328a52c889c2bf6cd041dd883fa |
| SHA512 | 39734abd430c932c7cd60a4aa755479347430cfb27f230f47de3ce83795a487d67680fa74d6e000614c1a5614827040f194a6cba2d4727849eed43ead7e1b5b0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a79d29e4a99096432bf8b9907994057e |
| SHA1 | cc43ecba4147bcf57d89820731992e139e7e6343 |
| SHA256 | 03ecbad7b0fadb4ff4874ba3ec4ebaf662820507f63a93df155d91e3ee18e5e7 |
| SHA512 | e4bde72443a150bdbad84c8c9f09c14a04eb95703e55509452557fa7a72c8739750b6f0383ba03e0d0c3f3c70b1881e72de3af9af9ccfa3e901938cd5856d570 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4b0cfe8dd5ce741a123ef1898077a361 |
| SHA1 | 80a708eebcbbefdd4011d9e034e4de9ed63e551e |
| SHA256 | facfbd95f22a71d3d4842299b2a081e5cdfb712e1f3808eb338d4c501d24b1e3 |
| SHA512 | 7c21b622fc23550ed0bbfbff595fdf20de5515397c20c7b884170251904b2337d73e376de9db9ab3d90d6c6ade0110a165e052807b163c1580620d1d612a3c65 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c8322894531cc400d29b1f1bf09c8674 |
| SHA1 | 50c459805827c8c5748bae1c382b781a48829996 |
| SHA256 | 57bac0033d2e5719d1dca0e64dc55f85f9c6a3fcf61fd6cc11cb2a90b79b9595 |
| SHA512 | 0e6bd2cbc3a8ee804889645419626f0039c8ca5368535449e77c4c16b659f6f42cb715dee6249a5ba58f04f719806715b9568d690ffda5dc030ce1a263e19846 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 28d2215e3c09bcf8da82e661bca77d66 |
| SHA1 | bb23d4eaeabf21f9a3d5cbb7d4d7b6cddc818bed |
| SHA256 | 5fe5ec7150ec6b8604e0b83498ab5153fc3d03c12f60ca76c6d9120ffa6eaefb |
| SHA512 | 47556576df0e2f1f44da718c59987b89b65c767b5fb5e5a5f8f6c13993fb49e96084a484c746612664d894eba0635dc5ab7a8a6103139e31bfc0a7e0cd83cd1b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 23e66ac939678bcdebdece3420b9b0e4 |
| SHA1 | 144031c25b1d8bd6e510e2f445922b4f14c0214d |
| SHA256 | bdebc2574e55ac9a04be97799e8e0db9ade976897f9b85c6c7d1f0c3bcf07f6f |
| SHA512 | 34620c57f7d17a51435028b6295a63f6d855c47487269d7d3cc2684884e18fadfbb39ef18b8f209fad58d0fa81cbaede4940db8caad3eff28015fcc5d9233268 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6d97387ea50e3c09e4e447d20b642d09 |
| SHA1 | 530f10cf81fe4c49cb3e8d52d4954b279536265a |
| SHA256 | 65d3b4700178f569e69b0caa986ed26f370fa2921f0ae16fd2905bb76c89632e |
| SHA512 | accee0abe2b3ac8d22f67ac5d8bfdd4fb509158cd0823b552840081659be035a5747bdad357473876cb79af40cee5c93f2e2b27e782b2972ac9e66bb9d8e1437 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1b20877f23bdaeb30bc7b85c71033056 |
| SHA1 | cb277cc52570dcd0918539d64d07a7d0b9984063 |
| SHA256 | 629cb54147bcbdc667d3d1dfd785b85b10f5fddb4121757e99d37d021a1c3a54 |
| SHA512 | e65d24eaebbd4c3d6df87b66504965faa2004a557187f2d15275f881eb285d777029f2fd01c87b4b64979831999f90bef36f2762a2e4ea1c86c674bba7ea0225 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1a4306e5e033f7a1f48021393fbeace2 |
| SHA1 | 80c078d273fe34bce4b9a655169e3338eff24f12 |
| SHA256 | 7924e0bda747136df0b6695fb4c969c5265a5d6a476d18f5aa55f03dfc721e99 |
| SHA512 | f4085fe3792e4d9688e202f453cbee6e576ce560c99cd1383bb8c0f466468ebfee13b3b701fb87b7e6cc4765cda76d04963659b4b907ffc5813befbe26f4da5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f64227193746c0bc352f0255506d639d |
| SHA1 | 720ee214ddce3c751880483f3b7c0457f7ee3d36 |
| SHA256 | b548ae63df1f95d7cc3e059c1d4963f71edb85713f883414c557ff955e468307 |
| SHA512 | 53909e8973cf783844a13b6b19a0a7134b4827c859d385a7b8bdfde0b9f789b5e55c39e3d3f7eb4bafcc5fecac271c44ac623eb5328950e321ebc56f6d152956 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 13:40
Reported
2024-06-13 13:43
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
159s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5d612cf458f177023ecc903d361cb02_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3736 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3736 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10362565856921151673,3207726263468245235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | yauzasoft.ru | udp |
| US | 8.8.8.8:53 | dtest.tarhelyem.hu | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | dtest.tarhelyem.hu | udp |
| US | 8.8.8.8:53 | javaterm.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | dtest.tarhelyem.hu | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.4.4:53 | google.com | udp |
| US | 8.8.8.8:53 | 4.4.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | javaterm.com | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | javaterm.com | udp |
| US | 8.8.8.8:53 | javaterm.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 87f7abeb82600e1e640b843ad50fe0a1 |
| SHA1 | 045bbada3f23fc59941bf7d0210fb160cb78ae87 |
| SHA256 | b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262 |
| SHA512 | ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618 |
\??\pipe\LOCAL\crashpad_3672_XSYBAZPHULOFRLKX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f61fa5143fe872d1d8f1e9f8dc6544f9 |
| SHA1 | df44bab94d7388fb38c63085ec4db80cfc5eb009 |
| SHA256 | 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64 |
| SHA512 | 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 46ca2e1677577271550baa4719b7c578 |
| SHA1 | 35c273839268c69f8e934212e479dd62b0783d27 |
| SHA256 | 0f2009dcd03d50a72b4d540b89251950b7b6ad9cf64b2f3e14ed149127c94371 |
| SHA512 | 51b1510bc784afc84d976edf7faee825f1ffd3b53b275a0504e0cb80f22a30fdd876cb9b8649d46b208d8c698854d81542970f89b122e770d039a48c36c692c0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | a10c664bb993ca509ba29ed22cb0e073 |
| SHA1 | cf9ace41d0e126715d68ff82e438d903a52a241d |
| SHA256 | 636e476f3942f405982e41a94d36c2225aa6ce2f3e9c263b31d7beeff0be7e3b |
| SHA512 | bc55acaf16aa4b79247db8887af6337f5fa3d0ab707e9f40667f8d8226c3413caecb0eb05254b2a8a8ab6211d98d5b2029dd79a99ca075a8b7ac91e066312276 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 707ed8e91fa6b467ccfdf6a44ed9b373 |
| SHA1 | 2c2f8face115c15bbe52d3f1ed05ef6f4951202a |
| SHA256 | 08e32f4d3ee619524f0a4c079e1999d472ccc997d0535e4712dd83fb754723c2 |
| SHA512 | badc53b0b1b9733915488b04e1b0eb56d2a073a9ea24abd1cb036ac62f21461f8ddf73694abb304741031307e52397bfcf3d1b649af9802bad4e8c5f1772b0a0 |