Analysis Overview
SHA256
eb01735dabb2c1624588bc02e7cda4472de396f6965f3ea72a84ad02d8fd3563
Threat Level: No (potentially) malicious behavior was detected
The file 8ba37518e4822c55b43f4bfaaae9e5e4_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-01 20:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-01 20:12
Reported
2024-06-01 20:14
Platform
win7-20240508-en
Max time kernel
144s
Max time network
144s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423434614" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000025d9f44670b5965eb580f16cb7543695a585493208b17db5c996461e2d7ef445000000000e80000000020000200000008241525cf0f5545e1085f22b82164afeb7a5a9931d595f6f175e5febab441f1520000000b6feb6bf5090c86ba0f1b8bb5a6eaab5cfaa03cc3b486a20e4ce6e37fa2ef80740000000a7178eea11e54740dd14661027a8d314f4a3e90c5424a4837ade1428dfb2f7a7079da984fef5acf5f67c2d6b439bb9ab350ac1c048d77e33768606d579c7d9f4 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f028053260b4da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000509da930c3712ee4180b877cf496e114743f49c626603a40ba69302f8891c841000000000e8000000002000020000000610c5366f3dab4b5bfb061d67286d87609f78f0db7101d9e0c3b334c2e88da87900000000fed9401a85c3b4cc9d5b4e59b3bd2e1a795dc4e488cebf21b176382cd351a585a187eefa0617e2aafce41fdbaafa570c5cd7410fcd7f221c09cbf8bcdcd1b6878a92a9007bf84cb58009d5fa28fc6e80aa531e24b30c3de7c3eda48f420fa0c1f190ebc87c388538a0ec814c7a31115836e4d0988bc638d6eec9b4238bb9e5ce4bfbf74c2c49a9b8d1694ce74c3d3184000000086c8a21e69fa76f56eb38960e39b9f86f88f23ea9e66e3751c04eb287f815fe31968a173ff35e55d1974ebd3291f069b5034c2ff1e67ba816f1e5c38e40baf6b | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44624501-2053-11EF-A7E9-D684AC6A5058} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2220 wrote to memory of 820 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2220 wrote to memory of 820 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2220 wrote to memory of 820 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2220 wrote to memory of 820 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ba37518e4822c55b43f4bfaaae9e5e4_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | episodes.lady-superclipsz.net | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | gbpre05223.no.sapo.pt | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | t2.gstatic.com | udp |
| US | 8.8.8.8:53 | t1.gstatic.com | udp |
| US | 8.8.8.8:53 | t0.gstatic.com | udp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.180.4:80 | t0.gstatic.com | tcp |
| GB | 142.250.180.4:80 | t0.gstatic.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.187.196:80 | t2.gstatic.com | tcp |
| GB | 142.250.187.196:80 | t2.gstatic.com | tcp |
| GB | 216.58.201.100:80 | t1.gstatic.com | tcp |
| GB | 216.58.201.100:80 | t1.gstatic.com | tcp |
| GB | 172.217.169.42:80 | ajax.googleapis.com | tcp |
| GB | 172.217.169.42:80 | ajax.googleapis.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| PT | 213.13.145.4:80 | gbpre05223.no.sapo.pt | tcp |
| PT | 213.13.145.4:80 | gbpre05223.no.sapo.pt | tcp |
| US | 8.8.8.8:53 | adserver.juicyads.com | udp |
| NL | 185.94.237.64:80 | adserver.juicyads.com | tcp |
| NL | 185.94.237.64:80 | adserver.juicyads.com | tcp |
| NL | 185.94.237.64:80 | adserver.juicyads.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | ads.juicyads.me | udp |
| GB | 89.187.167.8:80 | ads.juicyads.me | tcp |
| GB | 89.187.167.8:80 | ads.juicyads.me | tcp |
| GB | 89.187.167.8:80 | ads.juicyads.me | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| PT | 213.13.145.4:80 | gbpre05223.no.sapo.pt | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 367be39f0f0bd10ee528276085ebdf48 |
| SHA1 | bd2d8f3b91e3d0e5dcca4c0734f27ca4b0f257ce |
| SHA256 | 6568d4a4c638ae3fec4d5bef16d7f5378195466005a7d7de3667b501878e566c |
| SHA512 | 1e33cbeabbf89c1d5f5320be70459a27b2b4fdbbb4e5bd8fdcd4f4dea5b5b7761e49ca4cc72dd0a33423e4ce15353495eeef01472c7cb005c9d9dd4ea9d4a606 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 8ab53885506251c8c111f12d4a4a325d |
| SHA1 | e672c219cd08ff554bdfdde195367f1002649800 |
| SHA256 | 05b48fd158449a490610f1f4ef33b6f3c315add4b02335b9a6d9ffe6ed88bb13 |
| SHA512 | 533d2867ba7461b9992ec56bf0f8818e0ab0a8ff76b26ed7bab7f75a2eedb6cfb9c3d09e41a0ecbc381f328f8530207d3b32e5387c147b3fb5543c6797fa43e6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | 465ba8ef209393f0e7a34c3c973e0bfd |
| SHA1 | 99691395cfadfea46a9cc2df2e39203b8d7beb7e |
| SHA256 | c76db75ae51585913e4c81d23a20d8c81a3d91215dddb8c07cc74d849314a9e1 |
| SHA512 | 0ae345f353f9714068b9ce3f6d9bfc82362005d55d2102e751a8bbf5a37964660d60c5161c7632195da21eba5715260c9150048529457a8bc5039502c8927625 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
| MD5 | ebe9fff245c12f154e546da1ad738f90 |
| SHA1 | 633d7e9d0afedd2e9c6a5c2503ed176191aa8ea9 |
| SHA256 | 83ad8e030a9b9a79f55dba98cb05e2ddbd586e53432bfdb7e6960bd5fce53268 |
| SHA512 | 0859f186aeb61119dfd40633e9110157e3a125a01cefbb4e326615fe6d9fd1abbb1e42cf3d98865920d5bf9c6e92fe4c056a8249492581334f7c63446b5e8179 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\platform_gapi.iframes.style.common[1].js
| MD5 | 682c26af19b240f98d2cb951721fa54d |
| SHA1 | 18e58b652c7f82a55ab4b1910693686049e25d62 |
| SHA256 | 96428f0f585a874c185d560538ad83ebfad0365d760fcf9fcefe80add9e3c980 |
| SHA512 | 078aeef086271b7f9cf0f6e3a1e7908d7e38465a1a7a4de6f2a785147e9130551a2995e80600824da9341d58e5425d4505518e90eea9ffe1c64f4f41825a9660 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\cb=gapi[1].js
| MD5 | f9255a0dec7524a9a3e867a9f878a68b |
| SHA1 | 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b |
| SHA256 | d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d |
| SHA512 | d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8c2226b88515d881ec498d9ba40e5361 |
| SHA1 | 15fc01c1c2c2a81322757b19b5d8e3d181d4b1e6 |
| SHA256 | f5797d84c6d5e740a0b24e0b77af9e74d5db758a32d76921693e84e8249b09b6 |
| SHA512 | 9d46036e0212bafae37df88f884d7f75dc943dec97de16793f00fc47afdfae7952235acc99c2bc5ce5eb97e79d31d00c899644952377a4e0eb00816f4b24801f |
C:\Users\Admin\AppData\Local\Temp\CabD911.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\TarD914.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\TarD9F5.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8a11af092ad8f87a57df124964deee6b |
| SHA1 | 228c0ea3c4e281b6cb14e5f7d725894cbfd54412 |
| SHA256 | 85393022b8c07cebe25cc99360b208ad71c6627153158039c41d44ee822bf306 |
| SHA512 | a9ce3b2c94fe1948510218a7a6d81c5350022573ad3b2968f607cc7d88d1bec2f2754db2a2f06752b1c96fecec4e04a4eeb4980e1895061894ae444913c14e81 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ae7c46ac1d6ed67246ce861d280862a1 |
| SHA1 | f2eb8a7de59867fd865860b3589907b32fb091c8 |
| SHA256 | e2217c7c330dc8cba6c2d877d1d07024e24624ca513f13c4d485ec096497c488 |
| SHA512 | 1a13969fab6c551e0a1bb8b8c496b6642590abdaf30e8f15d6beca5e611fb648bd1631e886ccbe0d8233ebc3d412cfc2a575d939fb13b3dd31fae9b22d83fdf8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 07ef09531ce8bb5a7214144754002e12 |
| SHA1 | 15037df83ce913ff773eeb4411aa7850370fc85a |
| SHA256 | adebe3cbb0c689134ebefc7e287ab472f198243e09da7ddfec1dd4907604d1da |
| SHA512 | 7932713982e2d255964f4d68d7ddc5a99170b4cd31f389ce51ef77426949e563119d7e4b3d344469fa5eacd451b3976f40f6e088591d9339c7f913e379be3e37 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5358522e5e6718103cbb4d2a1022a7e0 |
| SHA1 | c0dc526e7dda16398b8bd5a3664d99203964edeb |
| SHA256 | 7cc8a0379c63b68353643f353ac883d38780bd55d53b0f93ec3ea0a3a5a49ad7 |
| SHA512 | e78408e2b2925837b74b4f4fa068e977d5affef61f72d86ce555e7ef8e9844fa63cd306eae475a405a7902fa96588ef3bad9477292ec797049f38b1957047d9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c12550ce06553d08892a27a2c8ab574e |
| SHA1 | 6ed2b641086ffadcc489a222b265367e3ecc756e |
| SHA256 | 4e6314752e89288e2ade230de2dd390dee706e966aea8395746ccb9a0b1e451a |
| SHA512 | f457397b4563ac8e27840531626f9130c774002ba2d38835efbd63b55c2ff104e81e538f488fdb7ef3d6c154472828e927ba00e78a0282350e990c988098e7c6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e9531e2a29be29e76f82ea2256e66af7 |
| SHA1 | c50b1055145f67731a21d80a1902730b06b0e514 |
| SHA256 | 2a9614303282d9e1c49735c8724c8dbd8e572c74acfe71ff6c8dfac9eeaea274 |
| SHA512 | ee5bb7e5292344cc0b814734ed889ad95a66ebdf241538103e98c7e5a9b3551471c2ef57fccac0c418e30da365eed6b3e9b18c78806c27db5ea3c74b661e7af2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b6003c35e93d0d65068792b98abb4312 |
| SHA1 | 941191defc8e59ee084c25d341e024044fd83d43 |
| SHA256 | 32fb255336c7de0e18d78dee467443181d5262015241f40867456147052fe83b |
| SHA512 | ecc05fa35b6f66827fa5f2b8d7eaf16e00e8aa295d6f7e9a1da9857ca312239cd783d8bbe093bce89e086b760ccdd38719adc8415f637eac5b6c0d154ec46772 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f79d2daabc2c439af9565a65d73fb27d |
| SHA1 | 4462fc47f4f5abe2faea96fec5f04fd1ba776bb3 |
| SHA256 | 2664303f9ab6e482a28f081c904778b0cdcfd5b8ea4be6a91ef175bf8ef113bb |
| SHA512 | cd705781dec7c3ef8f0ed1a95e39b01e04e23da232ab6b2f3f4ecdf737b0b38f717d709061be743e50b3ecdc9681def95248b1bf52ca6c2eb1af3c5662c29195 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d0be98dc5d0b99a62cdd461f8b9bc03a |
| SHA1 | 27040fe76614e9f976e370660913794810b458b2 |
| SHA256 | 7acd015b84167e247150aa40eb3a1d319cbf4204c543896ba7e52a88defbfc5b |
| SHA512 | 2e2a88776142e577b4be96632084238be7e7439d2d9683150bdcc3c0b8fa97140d973821ec6b3b09f4cc17712a129a9354d55be5414c8c7e00f9b26319a12308 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c504390ba5e3fe85ba63f4951feab3fe |
| SHA1 | 6c0606813e1c9df83451bb982a9ecc748b822042 |
| SHA256 | 266d84aa229f6976f8d5d38e2c663f187a7e3df02bc12db56a2fe113d8d7a89c |
| SHA512 | 1354c3d85e00214d32f48e6129e3fbcee1f0bb495795ec61c621de7e52990f1282d52f3fbef7e3d5a4fdeb6c0a41a3400ed49f5e18bd1f6acbc081dcb9a204ef |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6d311635edad142d8f8426ccf6f9a5c7 |
| SHA1 | b13d570f7425a69eea2c1c61a877d43d6cb53340 |
| SHA256 | a86ea54249391a7fca216331f5dd9c43db8acb0c8bcac62b75ee6b9d358ebeda |
| SHA512 | 3efad49cdfd2654f5b29648f8a970db0c1d5f186a98fca3330fec697fe14363674ac558f84c6ec8e0ec6b7b77798ac4b50fba27dba3170b0fc44d342bb0998cd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 49384b0342cd403cf808ddc98c18d7e2 |
| SHA1 | 4a0e08437f7a2aa5f5a16b3240d40ac102139c63 |
| SHA256 | 2ec96859e3474e165ef109ee7b74eda5894676beab4db456f1e04bb19be5a614 |
| SHA512 | b3d8a1b266311b2dbcfae189e5493103222bd8add8f438caddb2627432a0b6eab1326c1206eb44b6d356c5be7b68cc68870a5bdaaa0ba3a36871d8e24d8512a4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dd8153604ecc86fb88d77d5a1e375758 |
| SHA1 | 9409ffc8a2f2feca000f4d32e8354f55ce529e5b |
| SHA256 | 18b2e8d0c60bc1d52222ebfafc21713d7a7353dcfb40655f74ad0455c6039e94 |
| SHA512 | 9355d3f4d57d7430147126157795c2a9a1f5528b74f7b209b61064605df10c584c69e6bd4ce3d664c6e33e28613b77de5d2c4488e5e040f06c6b3c56887c429e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 216adfc46027e83bf3dd26c7400b93a8 |
| SHA1 | 3e5beef21342646fa97a8941bad0b20a26b9b518 |
| SHA256 | 9adf1491b8b1871299462cf22bd2c13a1883964775b709a43fd3c5d1d8ffd9f6 |
| SHA512 | 0bb82a8922124fc18d059c0b10077eb03496ab301f209b64d594d8e5029c8bb309eb6824b40747748b280a3a6d2227337878934e49be279338fe27cfb84a315d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1bf26fc87cb5fcfc4e96b799021f0356 |
| SHA1 | dfc6175c3f9d31aa85e520f0ac1373d8d222a624 |
| SHA256 | 289d36755fd4c9bbbcc3ce4621bdd135120875d934c3bfa065c1296b24acff12 |
| SHA512 | 023da1a65664180826fdc83c4d6d68cdef0448a021e2848eeea5ccfad439001a5346335c0a89d974e8f86ba4fcc2e05b05c96428f7abd71da6ef154264df2786 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 66f684c09749bf2730d0710c0e3a4a58 |
| SHA1 | 0c0128dee1d0172e70d99577fea1be00e55e1586 |
| SHA256 | 70df0b26a9f3c675123ca0c6e501682792eb5fcedbe22b6c70f658814633f3f2 |
| SHA512 | bbc16c2faed56c73e1dc6f000c298989f1b310dd3a7cab73425920b8a116d52397ae0ef74540f3eab4b8987b5fa8ff7b0d8b6694dda6482ef9aa04bf3a13ebc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3fb596d95600d5549d639e440308936a |
| SHA1 | ed0fd3709ea14d32598410e2e27b9fba9bdd41d6 |
| SHA256 | 6ff6bc437eb413862a44424c58e177b2e70f7958440d061ab588217e6979e423 |
| SHA512 | 6d141439c7cf14e15fc0957d2fa9313ffbd563ba31173c615637b26caef25bfc891cf68a9527b6a8084aee0cad3fde29ae27650f3d37970954c888a315fb9ae2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b7d706ece9eec0a268ad5ab4470df908 |
| SHA1 | 7dad8bddf1eec8cead58c6e0851758e7e17a67fb |
| SHA256 | f3b3f85ab6e59f1efc39a6cfa64ebf26b000811fc95e9dab9d2a3f93f6028bba |
| SHA512 | 6773a7f88497dc1b9dce441adb8e857c3c74e9a0101c05c090969973452c54f279b0c809dff04c73641570a64860e51a209c2e796d3f84867914c0638db130dc |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-01 20:12
Reported
2024-06-01 20:15
Platform
win10v2004-20240426-en
Max time kernel
145s
Max time network
141s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8ba37518e4822c55b43f4bfaaae9e5e4_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4d6046f8,0x7ffe4d604708,0x7ffe4d604718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16514293691081312471,3129469794896050985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.187.202:80 | ajax.googleapis.com | tcp |
| GB | 142.250.187.202:80 | ajax.googleapis.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | udp |
| GB | 142.250.178.9:443 | www.blogblog.com | tcp |
| GB | 142.250.178.9:443 | www.blogblog.com | tcp |
| US | 8.8.8.8:53 | adserver.juicyads.com | udp |
| GB | 142.250.178.9:445 | www.blogblog.com | tcp |
| US | 8.8.8.8:53 | episodes.lady-superclipsz.net | udp |
| US | 8.8.8.8:53 | gbpre05223.no.sapo.pt | udp |
| US | 8.8.8.8:53 | t2.gstatic.com | udp |
| NL | 185.94.236.245:80 | adserver.juicyads.com | tcp |
| US | 8.8.8.8:53 | t0.gstatic.com | udp |
| US | 8.8.8.8:53 | t1.gstatic.com | udp |
| NL | 185.94.236.245:80 | adserver.juicyads.com | tcp |
| GB | 142.250.180.4:80 | t0.gstatic.com | tcp |
| GB | 142.250.187.196:80 | t2.gstatic.com | tcp |
| GB | 216.58.201.100:80 | t1.gstatic.com | tcp |
| PT | 213.13.145.4:80 | gbpre05223.no.sapo.pt | tcp |
| PT | 213.13.145.4:80 | gbpre05223.no.sapo.pt | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 185.94.236.245:80 | adserver.juicyads.com | tcp |
| US | 8.8.8.8:53 | www.juicyads.com | udp |
| US | 8.8.8.8:53 | ck.juicyads.com | udp |
| US | 8.8.8.8:53 | ads.juicyads.me | udp |
| GB | 195.181.164.14:80 | ads.juicyads.me | tcp |
| GB | 195.181.164.14:80 | ads.juicyads.me | tcp |
| GB | 195.181.164.14:80 | ads.juicyads.me | tcp |
| GB | 142.250.178.9:443 | www.blogblog.com | udp |
| US | 8.8.8.8:53 | 245.236.94.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.164.181.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.180.2:445 | pagead2.googlesyndication.com | tcp |
| GB | 216.58.204.66:139 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| GB | 142.250.178.9:445 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | australia-505.blogspot.com | udp |
| GB | 142.250.200.1:80 | australia-505.blogspot.com | tcp |
| US | 8.8.8.8:53 | 1.200.250.142.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ecdc2754d7d2ae862272153aa9b9ca6e |
| SHA1 | c19bed1c6e1c998b9fa93298639ad7961339147d |
| SHA256 | a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7 |
| SHA512 | cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2 |
\??\pipe\LOCAL\crashpad_5012_DOARNRYCNLWJFESZ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 2daa93382bba07cbc40af372d30ec576 |
| SHA1 | c5e709dc3e2e4df2ff841fbde3e30170e7428a94 |
| SHA256 | 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30 |
| SHA512 | 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | ed0b92b00c93d61778365b92bfc46aab |
| SHA1 | 07447e5000b9a5904076586e1b5acd5d6578a6f9 |
| SHA256 | f82107af18c11d22d7081d82a55d761bed9ab11b54c14600684a4ec3196143b9 |
| SHA512 | 99eee5854e53c113bad2a4ffd86bb2e30185837ffcb2246d7da78fb10d976e57f533fa4c3f4490b82b97a3df4ce578ceece9a62fe7e37c5e4e469833c47c370d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | b4b4267cd3a577d6a1c633e6a221a28d |
| SHA1 | 0083818c44c995597df3357b18e14dcb6b3569e3 |
| SHA256 | 449c1e3bc5764db3bd7befe246f5173ae3b9e578e7ae01a9ec00a65de74c2bb0 |
| SHA512 | 43b6929f1cbe6b987294fa793252d5fc8fd433431394ded4c07176663a5fff1fceda31b4c8e239f10f44b0d64f026b739c8446dce9f09aa2476ab885858056f4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 83ad739d74cef001f7b3577c07eea0d2 |
| SHA1 | 93dce1c25ad35312d63d7946af4a6f3a5ac08c63 |
| SHA256 | c80949138d4ad251315fe0c643117323001e339a9a51870da2876b33b92d2317 |
| SHA512 | 7dcb28ee4e9192152943647bdf15b883a47fbbc9a88912728cd65e6658ecd0a8b8604f1fe9d83167844d4119ae5fdc2092b16a2d1c8fa0dec9b12fb6e35c6eb7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 6114a36edbc095f30324be3c8b8bd4a5 |
| SHA1 | d2bc1914753a34556d1488806debc441cfcb9c3b |
| SHA256 | 95359955315bfac0fc0584abc160fd9fd781032b8c2ad3a4843509331949939a |
| SHA512 | 7423d4dffb8c89e06b5b63baa9789c590f258f083d5d00998e8df11f9ae5814dc974cb00b79914d215508a5fb68550f696f52eafd9c63001c1b99ec616fe9acb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a65495aa10a748ced9a3f80554858918 |
| SHA1 | 2074bb7eb6466611f9739fcf43102953a2957904 |
| SHA256 | e18400fe838483d8ebea430356aa423af1f711fa39c7b692e9c9723ca055587f |
| SHA512 | 5f55e247b641a0390fa585b4b78363311e2a6e70094c4309633364ef71af728a1c33d8411fa3597fbacb4b55f758a88e666ee3a24ca0f96dfb2d78a9378e35c4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b33ada27ffdc541f3917c0ac174e56f6 |
| SHA1 | 7ed6d6bc35d3caf3724265594ef7602102130275 |
| SHA256 | b7fcee2274f10d2eb9f5f8676edefd51991258cd4217570ae272472508d70bd1 |
| SHA512 | 7a0a118ed7a1597f11d8deed03d6ac9c53a83684c751df4c6d16df459d31ca9b8e58beb8f6698964102468cdfe4c79e93fb161a88e4145bcddf3ef1cf4d5d8bb |