Analysis Overview
SHA256
40b5f7f49315b564866fc15f1271b0e24009ca30c940ff1bae9cc9c585a0a893
Threat Level: Known bad
The file f1ca8a186c0fcae6f7641bb4fd95206a_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
SocGholish
Socgholish family
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Modifies Internet Explorer settings
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-15 02:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-15 02:05
Reported
2024-12-15 02:07
Platform
win7-20241010-en
Max time kernel
142s
Max time network
149s
Command Line
Signatures
SocGholish
Socgholish family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B9E6AC1-BA89-11EF-AAD8-6AD5CEAA988B} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440390196" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2248 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2248 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2248 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2248 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f1ca8a186c0fcae6f7641bb4fd95206a_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 8.8.8.8:53 | static.ak.connect.facebook.com | udp |
| US | 8.8.8.8:53 | ws.amazon.com | udp |
| US | 8.8.8.8:53 | i50.tinypic.com | udp |
| US | 8.8.8.8:53 | blogergadgets.googlecode.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | disqus.com | udp |
| US | 8.8.8.8:53 | www.google.com.pk | udp |
| US | 8.8.8.8:53 | twitterbuttons.sociableblog.com | udp |
| US | 8.8.8.8:53 | feedjit.com | udp |
| US | 8.8.8.8:53 | www.assoc-amazon.com | udp |
| US | 8.8.8.8:53 | resources.infolinks.com | udp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| FR | 216.58.214.169:80 | www.blogger.com | tcp |
| US | 151.101.66.137:80 | code.jquery.com | tcp |
| FR | 216.58.214.169:80 | www.blogger.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| US | 151.101.66.137:80 | code.jquery.com | tcp |
| FR | 142.250.179.74:80 | ajax.googleapis.com | tcp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| FR | 142.250.179.74:80 | ajax.googleapis.com | tcp |
| US | 108.179.243.36:80 | twitterbuttons.sociableblog.com | tcp |
| US | 108.179.243.36:80 | twitterbuttons.sociableblog.com | tcp |
| US | 151.101.0.134:80 | disqus.com | tcp |
| US | 151.101.0.134:80 | disqus.com | tcp |
| FR | 216.58.214.169:80 | www.blogger.com | tcp |
| FR | 216.58.214.67:80 | www.google.com.pk | tcp |
| FR | 216.58.214.169:80 | www.blogger.com | tcp |
| FR | 216.58.214.67:80 | www.google.com.pk | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 142.250.179.66:80 | pagead2.googlesyndication.com | tcp |
| US | 52.46.128.194:80 | www.assoc-amazon.com | tcp |
| US | 172.66.41.9:80 | resources.infolinks.com | tcp |
| FR | 142.250.179.66:80 | pagead2.googlesyndication.com | tcp |
| US | 52.46.128.194:80 | www.assoc-amazon.com | tcp |
| US | 172.66.41.9:80 | resources.infolinks.com | tcp |
| FR | 142.250.179.110:80 | www.google-analytics.com | tcp |
| FR | 142.250.179.110:80 | www.google-analytics.com | tcp |
| US | 8.8.8.8:53 | mrcracker.disqus.com | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| US | 199.232.196.134:443 | mrcracker.disqus.com | tcp |
| US | 199.232.196.134:443 | mrcracker.disqus.com | tcp |
| US | 8.8.8.8:53 | ws.amazon.com | udp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| IT | 157.240.203.35:80 | www.facebook.com | tcp |
| IT | 157.240.203.35:80 | www.facebook.com | tcp |
| IT | 157.240.203.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | rcm.amazon.com | udp |
| US | 8.8.8.8:53 | onlywire.com | udp |
| US | 54.227.175.83:80 | onlywire.com | tcp |
| US | 54.227.175.83:80 | onlywire.com | tcp |
| US | 54.227.175.83:443 | onlywire.com | tcp |
| US | 8.8.8.8:53 | rcm.amazon.com | udp |
| US | 8.8.8.8:53 | ocsp.r2m02.amazontrust.com | udp |
| DE | 18.245.65.219:80 | ocsp.r2m02.amazontrust.com | tcp |
| US | 52.46.128.194:80 | www.assoc-amazon.com | tcp |
| US | 52.46.128.194:80 | www.assoc-amazon.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 184.25.193.234:80 | www.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 81b4a95557994672c232ec258e1c2cbf |
| SHA1 | 815048fb94dac9838df103c98cbaaa24341b1f09 |
| SHA256 | 9b9977e075a78fad6a121dd0d13d06f74df875eeb90244608a79c3dd51006577 |
| SHA512 | edcdddbc70df32c92be0b2276c41c334128b6653b2eb1950c65c52fe0633b87f90874f52e1cb46a357fcd7032c055d8d6db59514a29a13014e577903bfd920fc |
C:\Users\Admin\AppData\Local\Temp\TarEB8C.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Temp\CabEB8B.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f0fddb17ac754d7b807396ba3b544e74 |
| SHA1 | 65c1452e826c5c32c9f89f2ed7ea99eeee424b1b |
| SHA256 | 3ae936b5ab9ea2e801c8206f4e79d63ae5bf6b92cfc52b5eeee4a712396daa3d |
| SHA512 | e8c7f9c51b352735477fb2ba9d711c83bc79407e32de6cd20ab1ca9c199b6d5d8a7860baf34b47a64e0bd322fad051f9e9cb5e8538e34c8a43f583a99af216fc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 040f99cd015905580a93d5f7edc8ca53 |
| SHA1 | ce9ee9e550536f707b5dd69143ac63395e179d03 |
| SHA256 | 615e03d7f16fc1193708816328e4b74951ab409f4110b3499482f8c8687bc22d |
| SHA512 | 03c8837e5c1072343b85cd5fd9c4ce18e0e9c97a00be6d3b200f5bf50be3f880b8d881d84e49d62b62475d46c2ed6d024c51930413a797f7ea21ca2f947d7b4d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 58739867468516a986ef5b9af14c2900 |
| SHA1 | c02cfc2df728e84f03372d01ebd1816083fe213d |
| SHA256 | b48837c5115259e12ce968cf25c8fe63d874514e346c4206b8ef6432a0e6648d |
| SHA512 | b5e8a1c80b9d8bcb8dfbf3ebda3b05b73fb865c2a9befe73bdcbaf8eef3c7321a5bda796231f805a8dd2489688d14bbfe690915daae1f8ec3ef42f8efe1a9220 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c5895aef6ab91ad8e9abcffc8719055c |
| SHA1 | b28a7092a6118cbe109896e802bfc8ca0c206143 |
| SHA256 | 2d23da1cc30be9116448145eaf85516e33bf52714a5365c5d99a43725f41d87e |
| SHA512 | b7d544a2431d9d2c8b99b5c03d6cfa01e7c876469d62a7b8fa048ef44c1ff15b7909bc0d321d76711f683d40ed6eb07e034ec093b5b6c5d89c56afd6e1568bae |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | af4ba8d634b43d4a804011491cec3d82 |
| SHA1 | e7b56c49530933f72d782d77ed1a778be8a177fb |
| SHA256 | 1b292823c1ce36833f167ac16fac5c49918dd6b949c5397d3b1916cde2f2d237 |
| SHA512 | af316b4345df326044fa9ea3af7f2b18a24be91df06f9cf0953e89cb8a089ffdf8671229ca2e6ca07c40248657a2a317f80a07f931e076fb07d56cb2b649c073 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 5f7223ac8c4653410fb8a722fc670dd3 |
| SHA1 | c2dc39f5129aa30d434257781f3134a7f441d71a |
| SHA256 | 32bcc68ea6e5eb9ad229dade4b6f8e8cee0397ad2195e65c359f912750df5db3 |
| SHA512 | c85456d22cf76db99d73cab70ffe39372c64578ed38fc87d2c6fec8d50b0f76026c1d99dc56b70a756d9355aaadc559ae73f6e0d3970c8e1aaaca019cbb1838a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 986851cc5593a2e817c0283ae8cece34 |
| SHA1 | 74e5d6ca73b050a74e6fdada28287bc074cf0349 |
| SHA256 | cbf31b3aeb1e1e5491835b35c23b206c119a83871c002c11d494e526004be42f |
| SHA512 | 6c8bfe959f07c4ad8e0ae15a845933716df0d8322718d4ac9c26f0752d4f7c70c1b9de71837bd92285b5d7d5c133b1b797c45d910a8fddf228f382f6a8cb5c22 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4321f7f9e2c7ee94923ca1486ba1a23e |
| SHA1 | 32af86e04d00718f10650a9238def2006472e863 |
| SHA256 | aa42fa7d7f7555314593e026f4872b8bf44990e7f06b0c4540815b4dc10d61c4 |
| SHA512 | 2fe511276bfbece08a6297e5d3f344b535fa55474d9a6ad4b8fad543b1ff31eae2ff539e59c6348132897d44b80f5ea58d4ea199ed7a1a68dac293c13a1b12c5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 017f267d92d151d8bb744a2f47dface6 |
| SHA1 | 8114fca2f6ba785c60d400c5c678566e99e16691 |
| SHA256 | fa46c9f343a4e4e10ebc8ab1c5e8aa3927f578f0f550d9729f7b95682ecf077c |
| SHA512 | 598728c067d4c8dcdd7f704ebc0cc32762a4e413defc5e6fb5b56034bd222d1049918bcb909102c81da9004f980c6b1f7257aafb999c902e84fdd1007ef14498 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2545842ed6c9ee633958fef5c17c483d |
| SHA1 | 0f38a628ee68afb950dc912560515c3e9f189207 |
| SHA256 | 751dd24303911b00fd894bcb587f54157b5823b15a7ac35c9005c4052e55b3cc |
| SHA512 | 5723007958a90e499139adf662e5f71d25609f8e1524dc69c42e7e9060dc6d99c095bbc45410499b5760e5e449a0daef93884badc02da141cd5454080985373b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 100611da4771f02474eaddadff5e4b56 |
| SHA1 | 4416221206dd4ae72b6860c2962c7acbdcb3f186 |
| SHA256 | 110dbe9d99b151ae91574fb4164cf125f8b73ba26f0ad1065d691f05b0a78017 |
| SHA512 | 97ed532167aaa2e12fa894bd1733cd618de18dada19aeaa3680fd28df2e45c3b143316045a025090f201d5ed6830155a66e1c8073072479c82537f2fc6abdb29 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | ae097c94e7c4411479591dd531a52cb6 |
| SHA1 | 970faef359cb63b7a19734f820f630997ee30fcd |
| SHA256 | 8f063a6be1e0f3c41d9581b47602b63a50ce669fdb296b315e9e63abb728f913 |
| SHA512 | 5490090ff501c2a1a2888b2fb3b6b562f0408a7da72830c3402bb04eb09c52a28f382e0b935d542e1cd6d4826e6e95d86bc12cf21b1267c3d5fcea5442890c43 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 20144ed90c70f8642e2a15a4e661abe6 |
| SHA1 | cd61d1f9a7826ff031fb13719248009da569c443 |
| SHA256 | f290ad0a213057692acf82c2a63f3619a713fbfdfaff3f5148ddff2c9a06d83c |
| SHA512 | 463d798600801b989bfc78ee55e3b623a4d5f030144c18ec1be04bf25225516d3216ef0e1cbeea25baf55fe946391e1d3a90da633676bdeae2ffaca08619d091 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 52364c8c8b403c30a7b2e7b272ad807a |
| SHA1 | 659dfb170de22828a2d10cdbade6de769588b520 |
| SHA256 | be930475e749ee80601c554fea8ac5b06560d71647617d979af8301b9399a135 |
| SHA512 | 658d464cf0cc33ac2109722564408ed7ccf9c3aee5a0a64c12e74b40ab098649fdda02647fd67198d2c9e0e925834d0c20b984a843b9ab39bd2e96eed88e433c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1c2ef40106c1f6bbd4818cec84dcec2a |
| SHA1 | 36a161bca3303dda065cc68b7c42d1b47cd6acb3 |
| SHA256 | 4bdfad62aa2fffd04485ffdb7e8387659b123ca1abcf06760a73369def2333c4 |
| SHA512 | fe46c33fae206a222da8508cb9d2817e9686f5725695af52372cf3fb5df66d234c718e8cfce2547396e9dabc2b6beff8b873bc8744d6be40cd750d9eaaa5883a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 64fcf186942d7ba931b782889414f2e7 |
| SHA1 | 83626de6edc06ea58b60c4f82a7629c270efb2db |
| SHA256 | e41ecf8b779e049656a0a4996714f0814e6276d6c158e165a8f0944b356edaae |
| SHA512 | 74db67ad57ac1fdda1c3dd87e25181bd7ead3a7acbe8a305dca921e200a2276e8daf0d1057fe7ec0d6b64cca64b81a1b62fdd121c0acbaca84519cd9abf71c0e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7701e060ee1df0cbd89414ff2bbe28db |
| SHA1 | 011d0e31a41861c7c7b4a1c0a18a77d18dbfb592 |
| SHA256 | 311a7df422f9ffdb739b9e74cabe948d765ea58de142bc1329d655894a9e4eaf |
| SHA512 | f5ce3d12dd7c7727583cb726fa7198f753ee78bef6e255dffa27c6586671910487986137756a7bd0b3c53a846d84c24d418cb6034cbe09e4a64214be850da70c |
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-15 02:05
Reported
2024-12-15 02:07
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f1ca8a186c0fcae6f7641bb4fd95206a_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce47c46f8,0x7ffce47c4708,0x7ffce47c4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9853794613643278346,12935019452222277117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| FR | 216.58.214.169:445 | www.blogger.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.178.138:80 | ajax.googleapis.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.178.138:80 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 151.101.130.137:80 | code.jquery.com | tcp |
| US | 151.101.130.137:80 | code.jquery.com | tcp |
| US | 8.8.8.8:53 | static.ak.connect.facebook.com | udp |
| US | 8.8.8.8:53 | 138.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.130.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ws.amazon.com | udp |
| US | 8.8.8.8:53 | blogergadgets.googlecode.com | udp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| US | 8.8.8.8:53 | disqus.com | udp |
| FR | 142.250.179.66:80 | pagead2.googlesyndication.com | tcp |
| US | 151.101.0.134:80 | disqus.com | tcp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | mrcracker.disqus.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 199.232.196.134:443 | mrcracker.disqus.com | tcp |
| US | 8.8.8.8:53 | 82.102.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.0.101.151.in-addr.arpa | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 8.8.8.8:53 | www.google.com.pk | udp |
| FR | 216.58.214.67:80 | www.google.com.pk | tcp |
| FR | 216.58.214.67:80 | www.google.com.pk | tcp |
| US | 8.8.8.8:53 | 134.196.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.179.139.118.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | feedjit.com | udp |
| US | 8.8.8.8:53 | resources.infolinks.com | udp |
| US | 151.101.0.134:443 | disqus.com | tcp |
| US | 8.8.8.8:53 | c.disquscdn.com | udp |
| US | 172.66.41.9:80 | resources.infolinks.com | tcp |
| US | 8.8.8.8:53 | www.assoc-amazon.com | udp |
| DE | 18.245.86.71:443 | c.disquscdn.com | tcp |
| US | 52.94.229.212:80 | www.assoc-amazon.com | tcp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| FR | 216.58.214.169:80 | img1.blogblog.com | tcp |
| US | 52.94.229.212:80 | www.assoc-amazon.com | tcp |
| US | 8.8.8.8:53 | i50.tinypic.com | udp |
| FR | 216.58.214.169:80 | img1.blogblog.com | tcp |
| US | 8.8.8.8:53 | 9.41.66.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.86.245.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | twitterbuttons.sociableblog.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 108.179.243.36:80 | twitterbuttons.sociableblog.com | tcp |
| US | 8.8.8.8:53 | 169.214.58.216.in-addr.arpa | udp |
| US | 108.179.243.36:80 | twitterbuttons.sociableblog.com | tcp |
| US | 8.8.8.8:53 | 36.243.179.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 128.66.9.65.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | translate.google.com | udp |
| FR | 142.250.179.78:443 | translate.google.com | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| FR | 142.250.179.110:80 | www.google-analytics.com | tcp |
| US | 8.8.8.8:53 | rcm.amazon.com | udp |
| US | 8.8.8.8:53 | onlywire.com | udp |
| US | 8.8.8.8:53 | 110.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| FR | 142.250.178.130:443 | googleads.g.doubleclick.net | tcp |
| FR | 142.250.179.78:445 | translate.google.com | tcp |
| GB | 157.240.214.35:80 | www.facebook.com | tcp |
| GB | 157.240.214.35:443 | www.facebook.com | tcp |
| US | 54.227.175.83:80 | onlywire.com | tcp |
| US | 8.8.8.8:53 | 130.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.214.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | translate.google.com | udp |
| FR | 142.250.179.78:139 | translate.google.com | tcp |
| US | 8.8.8.8:53 | 83.175.227.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
| FR | 172.217.18.194:445 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| FR | 142.250.179.66:139 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | d8rk54i4mohrb.cloudfront.net | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | d22073dea53e79d9b824f27ac5e9813e |
| SHA1 | 6d8a7281241248431a1571e6ddc55798b01fa961 |
| SHA256 | 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6 |
| SHA512 | 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413 |
\??\pipe\LOCAL\crashpad_4700_QJIBDENQZTSCIMKF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bffcefacce25cd03f3d5c9446ddb903d |
| SHA1 | 8923f84aa86db316d2f5c122fe3874bbe26f3bab |
| SHA256 | 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405 |
| SHA512 | 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8158d5f61a4035a9127a6efae18eaba3 |
| SHA1 | 80b356487275a559d7df2bea7f7061944b1ca450 |
| SHA256 | ece25b80425097931675a639c62821104b3edc2f5653bd870d89352321df0072 |
| SHA512 | bbc857ff3d93918e3cf655906845f37967c5d23aba63ffdef5f0d5437a1de53538d5226bd1c833d65b5b7c6cdfda4ea7b631f08134d9c8914757b097e613dc74 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 2b7f0e0ec59284762950d438d0e243f8 |
| SHA1 | 54c0b8bfbf1888ce9cb2e6126ff84fa90a21e029 |
| SHA256 | db93eb5af88a37d2e7743608a0d8115037cec92fe913afd83efea91206968fb8 |
| SHA512 | 6f9a420d152db438f7daf013d5bc3fe8b6d6a8820c9c8492bd7fe7a1afd6357a3647d8c3f534835b4969e96377391cbb4ef4c6843b5893f30a6192853265f58a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8b49e4422d912fe92d395b5df6d46bb7 |
| SHA1 | 5f2e6d4e405257e56d3c76c6b6e8f54df9996e7a |
| SHA256 | 4f019eb66d2be6cb3c4be21b6d4d426430a3939534bb16c9ef44776234f62e3c |
| SHA512 | 3fc79366f99f4fb900acff9ff7f7a0314aeddae419877cbe43fec73d68eedda1f820a0bd036bbcfa1417143c5640ad5d46f977298994fac580450632d21d09b7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | e10d5916de5a1a19210b56f26bdb2f1b |
| SHA1 | fa798fc84a33356ee7aab6a5f6c83c59a10c3576 |
| SHA256 | 7f3985e468df8d336a4ff6e95317d8106212f6ab418555d894fd7cabe3b1803e |
| SHA512 | ba5b74e620bacf001e9767b428b7766e4c72f42c1b77f0e8eae42be04baeabcff450e32bffb1c810f509379dbbce0c0f729a042cad272ab6189ce8f932ee0216 |