Analysis Overview
SHA256
a7688daeb54ff5a1263c72f81ae7d425134cdbbe82d7a2698e254ec8a41f3102
Threat Level: Likely benign
The file 13bac9c7ed7e9ee2747126984c1fcdb1_JaffaCakes118 was found to be: Likely benign.
Malicious Activity Summary
Detected potential entity reuse from brand microsoft.
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-04 17:21
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-04 17:21
Reported
2024-05-04 17:24
Platform
win7-20240221-en
Max time kernel
118s
Max time network
128s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000fd7181b067443e367bbc36a6f91357b9503c13bf44f18ef44f3b33ba54b87454000000000e8000000002000020000000339ddb7fa5b79b5eb63cc68a46e8fc55814e473835db5c01f596764f6b4be5bb200000008257bc189785fa77bb5bd8cd33f774481e416e08a1a26bd8dcf5791bab722ea040000000edc108ea2496763036ec29b29112504052c1e39627f0ab65db69a35a5e7fcd02bb203d7cc2ba946107ba837c454a9221da7824c6b937d94da292a029bd07cd04 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000095f3bc3cd7b391bd729a5e907a7eb4d465ea7c1f9dddbfbbff1f93396e2236a0000000000e8000000002000020000000b8aa1dd398b867cdb0ffb9be1c15f6e577c28a6ee815a5aa44ef1c63bf326085900000008e844d7d923da2a4423f50ffd9bfe181ef338b4415e8c35e5a8f723c4c72584ddb5e9d06454434957c836ed94be9be87bea6311508e022626c033e4bf65bf7d53bcb6b0191e30df937dbf0ab681e5b178588874708bd2a4195db6c3789547940a2b572f815b74c7da064e4ba7d81597fffe8c32b9f72f994455eb31aa44b07f05d1de51a194cc3e721ccb9652d232371400000004ebe3c4539a006f8e2970b33e314cb39764986d57e16c40d3fffedb97d8da1b8423345a5d45048321193ddb82d74314ace2f4f21d496b73cf433644f1d87236b | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ac23a0479eda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421005177" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA7A62F1-0A3A-11EF-93E2-EEF45767FDFF} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1580 wrote to memory of 2444 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2444 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2444 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1580 wrote to memory of 2444 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13bac9c7ed7e9ee2747126984c1fcdb1_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | secure.aadcdn.microsoftonline-p.com | udp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab3340.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\Tar3345.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\Tar3445.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\Local\Temp\Cab3430.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 68cdef81a0036e8cacb71f014512477f |
| SHA1 | cb1638053718acdd2af8bada8fdebf459643de27 |
| SHA256 | e62703add25b255b4c94da53f95b4cab003cd5f9a804f31264bac9594f336657 |
| SHA512 | 73df69fff706177f4dd0a62ca18cf48abec0f78ca06ba3ab744bd07e849ee93d3fa8ca3242d9b2575be1d879764c9c0c2a3e48cb9f117c137b6336e7ab39e8ed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3bddbd80fa28473167a1b2d586eeec29 |
| SHA1 | 32fdd411de3ee8b928c03b7a4154662367f9f632 |
| SHA256 | 7bec2870413f2c67b48220fa8ab92cc33b816665ea6e4aa2cd5da189ef548571 |
| SHA512 | 3cd6e6e72f175e4e3da73480b857661e1a03daa8777ee2532389c5fac2174888e143d67d2476b67591439f99c183e1d57cb04ca0317c5ba454e2bf3f047bf9c5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4eaecfa9df77f41dd643b89a2a7a235f |
| SHA1 | a92182135920a8e8fa7acaed204c275878d18fa4 |
| SHA256 | a6f8b275e75856f40bbc0b5e8dcad393588fa15ab7fd7ed74d2f34788eb36f84 |
| SHA512 | 8247b257c5ad138bd9755ec86545dc178a6c9d10a09cebe6fd198b67cddd1e1f0206cf4d074021f3f5408aca8e6fa8f508ea7e51011c31cc033ed41dc80f896e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e40b25e1abf27c2b21cd4fe8124bb610 |
| SHA1 | 58d94cca0e45456eded5e9e76e7e9fcd2f3be4a1 |
| SHA256 | 9df734e79a5f53af2e4cee73cb3a32112f27667fa56d94630d9253157cae54cd |
| SHA512 | bf5181305636b6c77779f25dfc264627bf73416c1396e4d44edec506cc524ba6608702cd1da3363e0a3a0efae79f543c44d4a4bf49ee1c6cdf906d40d2c5c14e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d0d710f363061f5f34b44c0493788be9 |
| SHA1 | 29f1d2776f325593e9f58b33bbac169df466b0d2 |
| SHA256 | bc9e67b2badd48389b2cb3351542c49e0817eb019d8659c24c0fc8725c09c5c9 |
| SHA512 | 1daa955132d7749f3915785825953bc2f655f722b6167fdb8bd05b14a0972eec97412da23d6b58e9495c4683ea586ccb2217df31f300bec2896fabcbe6c09e48 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 46f596770a476f51b190bbab2088df8d |
| SHA1 | 17d68837885f0501bc1c21553cabd4bf72a2f4f1 |
| SHA256 | b4920f92640d68b5bee243b789020fc92e69a6de5a341e0be6841c871abb3018 |
| SHA512 | 7085cfa06f6408eb41c1aebe2fae22a97cb1d1e083391c1c09e30e8e7a09c3ef31938a8fb4d796ba5b32782d92864dbbeb347d74b8811b391e53d69949841539 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7bf52855e26ebae45cfee4c68cad8ec3 |
| SHA1 | 3ae42f1677ea416455fca8303f61fab73878605a |
| SHA256 | dde2512ad6cd2815e3a57e9a1a716b54da1d026c6adf211765473c8f612d2671 |
| SHA512 | d19862ca0e023003b273bd713adcea85e3cd2c3437fbbd12693f01561fef9a987685c607835057d9f045786e2d3f88fc7c4440ce0bf11773aacd1e1ab84ca1a5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bb812a0023d5e61d1ab1c7238192ae5d |
| SHA1 | 15fcc9a039806806da1ba69db4e2f5c8c2c10e85 |
| SHA256 | 0a23ac7bb9bf15301007e997a667a0c5e4b7e63714f560c7f3affb235ffdac54 |
| SHA512 | edd5874d2ebceedf529e496df53e80a487922e13aafa1eff03228901433f94ee4bfffc8889a0a7d00b58fee69d0824097a480b858ff977a7f1119066f7e5b718 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 54e386d44cd8b8bc2fd9b8c9ff523746 |
| SHA1 | 9dba6bdac47ebf4c76ac1d86363507db5e271765 |
| SHA256 | 1a569e153eaa946cba1da02c531fbe30e0cac674d38623bf82d73d646df80450 |
| SHA512 | ad1c706f88057b2a2b59a79be810855379e40276882334cd12c4e4ca22cbc70d149e794ec66fb5790d29125b8998c9ae68f30c70a760f4b4d1bcd23a60899943 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f2eb360fd8b3ec5688fe452d92249ff1 |
| SHA1 | 084c24a95325614dddfb889a9a16e0a858d2dcdf |
| SHA256 | e045fb113aaa9c8505414164829214a245d68fe690a4e7d8e1e1c0ea6ae72158 |
| SHA512 | 516a13741c47d616f9ce3fdbd0b20d3693ad197a89960a4daa687659e1e6ffc5e604bb30fdb109ffb0c3d4131ede5099bdd29dd7c43553232ccaec728355082e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2a0d805445c6a98b1202348ca54930f6 |
| SHA1 | 3da34d92baaf5f5e2019069d9dc89cb88c5329aa |
| SHA256 | 9a216d8f829f6e6a5b24e1e2fa33bdc9ff987a3f14df4cbd0831b257aed0b63c |
| SHA512 | 92dd922f2076aaf40fc7a402c46f05f6a1300d8373f4132ac7ac70563cc7ce467d7b387e403f6be724633e4b705f16216bfaa72bf33ae3d1a7f6bcf3f115bddf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dc46f37553081b91c9a5f9568179d61b |
| SHA1 | e7aefe17e256bf51f2d619f252edc93a2b89dfb0 |
| SHA256 | 6c01a57eeca01dfb6081783ffc4581ecf8ab23c4631273bcb1274bda7d8a0751 |
| SHA512 | e7fe021ee12d492a06f63d02160d076e13dcf5aadf541dd9ea1c8c638865c1e10605610baef1f02c5ae492de6b5aa655c5db4cb2aeb2bf74b12a34d188d610d0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 23a379e71acecceedfaabeddd7993d65 |
| SHA1 | 02371929a3397700fce5c20fc7b57a97aa60a39b |
| SHA256 | e14ab8ba9dd74d01137c79c47d8086ffa0302226920cba89f08a54a5ac9c448c |
| SHA512 | fc46455f9172691fb35fc4f2a616267edb41aad4893ddc82d519237df536b13b803a5ae9b32514cf9c5e563f0fca1bdf596dd27469af9135821b55ab9304538c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 39673666e37fe8a9ab4f10f2f599f684 |
| SHA1 | b666f9f1c6a00233b70be92434acbc8fb85a07e4 |
| SHA256 | 9e847caf29ae0ef86a8cc943f026836ceb16a8a5ec5c4b4bac322c02f2471333 |
| SHA512 | 50115b184adef741a9795d49b1ee365bdbe59cd2a730142a7c8a080fcdc6dd5914e70ccc8900e051c845fb9a1cde2454c0567e2b2d2dadc29ae0ed7abc62a989 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 00c65ba741e23e723d7970a578a5fa1b |
| SHA1 | f12cc46705fb39db39807c60f143204e78df125c |
| SHA256 | 1ccf633846adc967261da3d06ef8b5bf05e7cb8604000e2b810e379e9cccc817 |
| SHA512 | c5411930fc9cc3b1eead6fa4ee5fb95e220cc2909d2a3b2e8f6d62b1bb39a038db4383630da0815115059ead4ea3a428e0cccb7ed52e0db45f824aa5007de9f0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0076037e59838ab191868e7378bb0fc0 |
| SHA1 | b1ab2aba9e618538399fc8f41a74eac523baa2d1 |
| SHA256 | 7106778a15ef6892dadd94edcdfd7b61b449c39ba27102e78f840b5329c6e4ae |
| SHA512 | c701a73ab586c492faddd99859a26b291c6e5008f6917c4ab4def63d53589d655b1db2be62e6520f87372950f3820996b13d8fb801ec70a26d34e254f14a0cb2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fc46f536793c902046a0f50b73cb6bb4 |
| SHA1 | f74912ccba8192c1aa7db32cbfec8722e9c65235 |
| SHA256 | 4340562a95ad097517e22e627a05d72952b775039eb2cbaab68f79f347424a3b |
| SHA512 | 0dd4c50c890d2f38a95f7b20765d3d542b557e248844764f956d79efe030f5c54b5f4f738ccd568bcbd8f68646734eaa67f1f06c7bdeb7fb0d0cf83362246c3f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 048294f84b8f53f5109cdf1163131491 |
| SHA1 | 992341ef07c4ce97054f0a9ef70595cff41c25fd |
| SHA256 | d0638364f857350870a35ef9f0efedb294b91b02c76ec3c1502e85e725c8a900 |
| SHA512 | d7f20d3923512d2b86614adb99d55102a2f8af1ff2ca849b500e9429c6b9e0adcf025bc7d6fcd30ef66e380b6b12893ac7834380cf3a576c3c925b1c096afccf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 29055318e64e0460b4c1f1d4928e8f20 |
| SHA1 | 7c907041ec7ceb2728acd13c451aa31c63f2342c |
| SHA256 | 70ed084aef202852c62ccafd5e47a1a0da50786714623a2987ec2a04ff12254c |
| SHA512 | 57f9835002130b3ae4a97a9e40fa03ba657923994656bb91be6d66776151811700c58fc7f33ac7f6f9f021cbf1a5d09b5acec6ae2b187ff6f472573ec666afe1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2621ad9885fbd38c548b44efd0a73c88 |
| SHA1 | 81a81b5f7794bd8eb25e9ff2e0457c61eeb108eb |
| SHA256 | 6afae12307af44d4a0d5b33753c952f76ab971fcceb9821ec8d4d196091b735b |
| SHA512 | 1ba645876216ddce6415abf4e2883c95d79f4c4e8e664d121c5a56f9037c51a950bed52da605aef1dd7651a9e2f8d85a2768e866e952bcc73d007379b1815452 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 41da94c63ff6497a08d7df29f134de4b |
| SHA1 | d3a0ed0680f22178e55080fb84ba8a8162a07370 |
| SHA256 | 4cf45c24249ac80bfb937a71a73812a0412531381a4c718f88f3c8a15ffffd35 |
| SHA512 | ad2b1e1d97028885a612f36b5301d05dccffa09743fca625e308122113430dd9e2cf6dd1a41f057955e556614c14d3a23fd6d16e1220dd0d3fcb930c41dd9683 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2f6483f701fcfa1ec148d29d3077d258 |
| SHA1 | 8a9af37268aaf390cf3cf6deec6ce22a6af35212 |
| SHA256 | e414847d0f467194032c9bd418f4f0e764a3891062248f99e01fad75e45d9493 |
| SHA512 | a14c4152808a86dd6b0eecf877bfe5f6ffa93c53a2e715e1561bb3e69f4587b21c81157fe3f4963a8c11eebe9cbec0cd9c2473377ba3c38112c3938f58b12cf1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8b0cdeea3d97b235b48ef55b8c0a3379 |
| SHA1 | 4e6dc309ceda7826091098ec68843c1920dd8e76 |
| SHA256 | e5212200c9a6aa81e58c4503d297b2187996ccce4c648b1cc1fc05059c832c9a |
| SHA512 | 77213e75ecdbd0c3fb4ce92ceb1453a3f541168399bd18a5760d7ac602a9328684b66d220fa202ace2424b0400b89639a8698f00f597cc61311937ab5117e9fd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1c38e047fdfafe433cf22236f020d85c |
| SHA1 | f8e80cf3e1d28e19c2e28fb2a831f5c3d913d739 |
| SHA256 | 28858234457ccb79e8b3b24493b7836ea8224015db6e631e31d544632c1aa524 |
| SHA512 | e29c0c56f8d789fe095569a15264ec975b1fc36e339a01adaaf63228c3fcc8a6efa668e39d6c1ff42338064d1db07b54f7066f1c5b38ef63ab9d0e01710601d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5f999fce48367494ab1a750a9d265e12 |
| SHA1 | 3bd8dad2133b1bea4e0510b2f92adde9294a1023 |
| SHA256 | 2baee62fb8cbe1a48aa5aa27c6430e7864f6addc0344a7312c194478ea120b80 |
| SHA512 | 59f5773051bd38017a6915f031e7248162503617708b8970fdc84d7c87bb45f77d0f5797ce4d30f979c520181fc2c3fd3bc7eb247af92efaa78f7eea1a330254 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 75a75d21c5d159b98aee0f0654aaf685 |
| SHA1 | 21f0ce16c42acb4ea151360c7153bf4b284c71c8 |
| SHA256 | d993a1b85d0c7e04cfa4e6279c89d4d3ecf3ca2ae355f679797eca87fd853ef5 |
| SHA512 | 9098967c23cee8b4cb89994d55d50135c32b15e8267d4b26cf5eca51e2124b26335c4fc1b2887ef0dc4c43e2ec9b6fd00c93b0b4988d89e71d8681195a3cb010 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 18b0fd45aadcf723fc5e9acf04c7a550 |
| SHA1 | f6129c4eab3634ff5febf95605c7068fce497766 |
| SHA256 | 2f3e91daca912567673c66270a316cc5468eaf6f52e0f10178a6b662eee18d6c |
| SHA512 | eb65c6b2332990afe56acaf72a521a720826b664d36e23d1775a53099df942ec623f5b7d25db0aa8d556d29a827e4de0281f2f13f16908624c2d009a1de64aa0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3f571ec4851106e176d77776bc165d5e |
| SHA1 | e763fd362cfe233304763e1281b5ff1a0c17597a |
| SHA256 | d361839018a061828630d12170f7cfc290fa25f8f6f11e86d88e94f35e2c6805 |
| SHA512 | 0c4b89ca8b953c285f11f9a3b6a5695bea47ba2cf01932b85bce9e67bcadcbbe4b8a045ea134a1577e3ec6b07230db08201ddea67d677bdb810d2be853050f71 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d45bb296b1f01dc5fcfbdeb0bbcd3a58 |
| SHA1 | 7679b2ce39bd1e7592eb15a2bf2a717972d98f9c |
| SHA256 | f75e361c2c744be69d2ba7d76ce2cca53395a54081e2ce172125c764c1cbc4cd |
| SHA512 | 7b4819206f42c0e7db6294afba3c164233d7bc2d7cfad45e795914f3dfceba25aaaf19dce986ed592e129be0043c1e7f7e907cea855e893fe750af754cfa313c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f306660ae3f18ba683424badc12c4f6e |
| SHA1 | 6c60d09f04de294401fc394d62dbc4f62b97b414 |
| SHA256 | 0d5c714eb6d80bef0bf664833a60a820bfa7fd202ac999764164389c017f1f94 |
| SHA512 | d9d8158e0846e58728b508d25a6e26f5913c4ab1cb29e7dcc10dc6bbe345892b16a8be1a77c7fdd684b1fbf9d86f072d7a733c8ec617fab136ecd549bd91d505 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 04ec842d1c51c4185d0fbf8b7e7821a3 |
| SHA1 | 5311608eab6e53a06507c9d2551263a9d72d47af |
| SHA256 | 97d41259465e9a04d671c474d3d70451fb32b09459b01ce9fb1449f9f81cc0f7 |
| SHA512 | bc0391d3957db1094ccf4ff4fe93347ed062e082bbba6470df8f26778960b8ec5eb858acab3a83d75a191250843cd8906be05e10d0068d5aee0adcb31b551859 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 112c820430003bd88c599298ebb2f4e4 |
| SHA1 | f2e668229e52f12d617011952426cdb1203b0336 |
| SHA256 | b61d3becee451cb2600c82a64f7a1ffe464dca089deed27732e55e75dbef184e |
| SHA512 | 71cd1bd686b9e07c62e0b74d86d07bec90bf89b2398eccd3bb2580d3b2ea640f1e33032b527ad97242e7cd41b6572f77a04f1a2d2e41567f01a5f88a248aba3e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 75ae8d4db23bb4dbeedc60d0bc367d5f |
| SHA1 | 6d2d1a59406535f1ad6e66b9d0eac4736ab1df89 |
| SHA256 | e5c8004a246f7b5a6127116ad009c37499c7ef516d138a3299d3f557cc531858 |
| SHA512 | 8c98596bd02460e87714f8a3bf2581f608122360de165461bbe222d6e3cf41b875eaef2052a64443733ce54b9ff9dcd1862e54fb36ae40eacc93f7882e3c2737 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bed594b26f7c18e9ec4d8dac0d8875cc |
| SHA1 | 055ed9af883f98eeb866abf16c7a45b71e3ef78c |
| SHA256 | f46baad87cbd424100669a3b2660d7a62ca549a810f441ba46cdbf88f4175906 |
| SHA512 | 7c92dbd8d49a712a9ffe4a9292debe384f2a58433726c5a116c1f6f5f8c9d0d61cf10729077e6a50f5223dca92d1080dcdc4eeabe1e702038de592c65fe00c85 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dac5ef3ebd8f2d11d481e35015832832 |
| SHA1 | 7be51c8ba970e0738a0cf55dd8360a0ede1d9279 |
| SHA256 | 4ac5bd08497a5d0d7c0020c02d47f0ff6af522b1ebc2bcae3ebadb8d3c096fd9 |
| SHA512 | b85844851963294d3c1da1f478fd1d334aa2e953d1ff38a95f5793b62dd268b089122872a08d70997242b6aaaf22d0ca3698c887b7df6fcd2314a0708c074068 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5ec90f741718626b4a6e7c08e8ad60b0 |
| SHA1 | fe84f3a6f20e455306f79d01d074210478c21172 |
| SHA256 | ab18d745e8c26196c33e3e61374bf267990d7d55a3ba3e0d6ccb2972da7f9272 |
| SHA512 | f983342203e5d5f0034d506744f152911547b3f3e69a84c1286fc15fc3e1b718f07ecea4a50ba0fa4a636092c271a11288a5a31e066a6c23d5db43e84ec31f81 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-04 17:21
Reported
2024-05-04 17:24
Platform
win10v2004-20240419-en
Max time kernel
145s
Max time network
131s
Command Line
Signatures
Detected potential entity reuse from brand microsoft.
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13bac9c7ed7e9ee2747126984c1fcdb1_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdbec46f8,0x7ffcdbec4708,0x7ffcdbec4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1404563913300452398,7872101545923152047,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | secure.aadcdn.microsoftonline-p.com | udp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 13.107.246.64:443 | secure.aadcdn.microsoftonline-p.com | tcp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.246.107.13.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.71.91.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 1cbd0e9a14155b7f5d4f542d09a83153 |
| SHA1 | 27a442a921921d69743a8e4b76ff0b66016c4b76 |
| SHA256 | 243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c |
| SHA512 | 17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d |
\??\pipe\LOCAL\crashpad_4676_HPOIRVQPACSCKTIO
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4e96ed67859d0bafd47d805a71041f49 |
| SHA1 | 7806c54ae29a6c8d01dcbc78e5525ddde321b16b |
| SHA256 | bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d |
| SHA512 | 432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | fb60097a0db44bdbba8afe5876bf9b89 |
| SHA1 | e3a4d70552a79981586216b63c82023e0d67ae99 |
| SHA256 | dce2fcc6e99a980097429a74d4e3bafc4616f585821b22a465a9f94d2da6e5c1 |
| SHA512 | b39ac6f562f7a6d8e4912900c791eb288f04a40accf26c8beea8eec7c39c4ce52f286a98bc86d88ee073f4d6f3094099cf592a7c9f2df4363ff7a66567e59713 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 8b3c37915de12be509ae9843fa0119b9 |
| SHA1 | 6be31a1dd12587eb89eef09e63a02c4627722226 |
| SHA256 | 140cf76e8939ed474fbd98f28a7d4208ae48a42fdfa36b8363e6fe0d727cb69d |
| SHA512 | fc83cc7b972c98671302a3b9d88e3bef608d1b8007f32209ce75df3c25befd1ef65e06bfc4b972e270d21c426f55a9c976eec3b06c6862dfc24be85b832393fc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | afdbf5b758501f4e1550eeedb3737acd |
| SHA1 | 768cb98296e3c6baca1074657085666d7d9e0f16 |
| SHA256 | 9e992c58dc3a650471425361fb13dd5a6a2f7df17d381ddddfa17b5b54ca4515 |
| SHA512 | 244e9c1b07d253fe43c6dfab5d7fa81abfbb24b1413ac4c8f99c4116cb4d566b971f19b4895036156459c9d35cd4787966767d3fd3d8304b50264611e3e861d3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | fcee382bbe8fa3ba1c0705a5771d9f23 |
| SHA1 | d43d609ce584096a16cbb988852977116447a48d |
| SHA256 | 19b50e39232d3b1cc07f5c1f4b2dae3e3a4523282000e6e10b8504c140c88aa2 |
| SHA512 | 944008f34987273b74e4302feb16b79afd5ee4662deaf43d8f7a6002d412b67d9640b40b6ed6a77e50b4b4c7cfc6eecbca9b792b553164001251bbb0788cc537 |