Analysis Overview
SHA256
b2ce915681e5bef2128f4d20af9df6e161c5f2050cd38d4347fe7eb157db7bbb
Threat Level: No (potentially) malicious behavior was detected
The file 91b70155face15b5039016d28c5393e2_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 12:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 12:03
Reported
2024-06-03 12:05
Platform
win7-20240508-en
Max time kernel
144s
Max time network
127s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d9db7eeddb426dfb7b83c7f1bff1c42b506a45ce6ce23a112e264faa2f6c444f000000000e8000000002000020000000046c084cef7cfe8b702d88d0336472ed360db021d6f268ea46c2d477cb7b358590000000ce34708af75c3497bfcb32425a7ba98357d57490cc2a6ce9b261d983cafeaa81c4d01a8dcdb701c48c405effc0567b345f6943d0891624c787931902c2d19679dab73a678042b2305f694be0bc52db21af8e01623b4315dca9f3c1dc33c17c07c1bcfc72b4f14687222aada36410da5cc4b41980ba91f63cea667e29ff46fd40717063f21f8da4508af09ffcf286776b400000009014532d956e037699a4b9ac1c4edb748e4718746a79c5bd0156a6a8fb551cbcf652cb50d85a704dbabe42161a04200c830596b16cefd1e92ce89d2131f9ef15 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3097ba1faeb5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39B06701-21A1-11EF-A4F7-5A451966104F} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423578048" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000066f22e134a1d1ad338405e3891e124f457018e2222981b3ad7b6867373465384000000000e800000000200002000000031e1b5052f157738b8fb0a9be93c6ca0fdc520c10f0982e3d7f882101a6f946820000000bef74c0777212d0dd5907d6a042be2c0750fa2bfa182e4f5d799aac22743fdb740000000c4f251fc360801eabc3a6126b06be2b6ade99a9338b83313cf8c1ae8d2a1ca38e809e373dc63fcf4e79f4699ecd0f89f37a78d494112c15f461fff7c51821c01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2156 wrote to memory of 2092 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2092 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2092 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2092 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91b70155face15b5039016d28c5393e2_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.downloadfilmescompletos.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | blogergadgets.googlecode.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | i42.tinypic.com | udp |
| US | 8.8.8.8:53 | i40.tinypic.com | udp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| US | 8.8.8.8:53 | 26-1.blogspot.com | udp |
| US | 8.8.8.8:53 | i44.tinypic.com | udp |
| GB | 142.250.200.1:80 | 26-1.blogspot.com | tcp |
| GB | 142.250.200.1:80 | 26-1.blogspot.com | tcp |
| US | 8.8.8.8:53 | i41.tinypic.com | udp |
| US | 8.8.8.8:53 | i39.tinypic.com | udp |
| US | 8.8.8.8:53 | i43.tinypic.com | udp |
| US | 8.8.8.8:53 | statinside.com | udp |
| US | 172.67.146.166:443 | statinside.com | tcp |
| US | 172.67.146.166:443 | statinside.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 23.63.101.153:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| NL | 23.63.101.153:80 | apps.identrust.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.180.2:80 | pagead2.googlesyndication.com | tcp |
| GB | 142.250.180.2:80 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | ivisitas.blogspot.com | udp |
| GB | 142.250.200.1:443 | ivisitas.blogspot.com | tcp |
| GB | 142.250.200.1:443 | ivisitas.blogspot.com | tcp |
| GB | 142.250.180.1:443 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:443 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:443 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | whos.amung.us | udp |
| US | 104.22.74.171:443 | whos.amung.us | tcp |
| US | 104.22.74.171:443 | whos.amung.us | tcp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| US | 172.67.8.141:443 | widgets.amung.us | tcp |
| US | 172.67.8.141:443 | widgets.amung.us | tcp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | e4cfe490bfcb4f275723ecb0170555ed |
| SHA1 | d53c322888771b7609a01e9c4d2241d523c42f39 |
| SHA256 | ccec7b3b27541541fdd3691400e1d82435f474fc3d37a9952938104580f15cbd |
| SHA512 | 51bdedfedd3f043fbd745f5f83500e60a6fca1a7aef657ce8be3559914a01aefc51790b57fd848b5df3c60b3b9e52f36834b18ccb3b77526ecfd564b0e643533 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 13ed5e0369cedc64c8437eb9a493a981 |
| SHA1 | 880053c91809fef7b2a3d688143f554d5a05c0bd |
| SHA256 | 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454 |
| SHA512 | 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | b54fbd44dd6da7296caacdf17e1bd4d0 |
| SHA1 | 4db08405c0da7c398d436881c003f6ac01fd1c0e |
| SHA256 | 9b27badbf28922890626d8744de49cacaf5b2fd655949b7014886260e1f7c13b |
| SHA512 | 20453c95101c41b563ad6a78df7a67a0e2e384f10f47b3fcb2190d1f9aad5fd895f64193478154558a9fbd4af359631cf0380cf5d22939b172eadfaa181df821 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
| MD5 | c51241510a9d42978be1208462f69ed4 |
| SHA1 | 0432d52705234ba73a1d7a5f5247c4ad88819a7b |
| SHA256 | 8f59e29a9ae2ef78a10cd5cce0a54a7f8576af189a77570b46816702637bc72a |
| SHA512 | 34bc156ed40fbb306b535fcdfd63ca555e582d6d68ca937815b93dcadc3c27395077ef41e0b6a0b3a078ff9ebab35892d272d230b7e527af8b6d55068dae0d50 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
| MD5 | 3cbd995f8bc61a3669d6dccec2391d8a |
| SHA1 | 39e5903bb99f1d045f6b0c2429b43ea8e2d551da |
| SHA256 | d302d7266945490d5d06e91e1c2557830688004c572f39343357dfd57ada50e5 |
| SHA512 | 6335e0e9db04d46564a47818a02c3ed714ee705dbc70ecadf252f2813ef62ed14bf739ea545d69e3214d21600a2d9257013545ab3bd7eeba17fe1fb07b2a22ba |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\55013136-widget_css_bundle[1].css
| MD5 | e3f09df1bc175f411d1ec3dfb5afb17b |
| SHA1 | 3994ec3efe3c2447e7bbfdd97bb7e190dd1658f9 |
| SHA256 | 1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617 |
| SHA512 | 16164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\platform[1].js
| MD5 | ca058c47f91fde91fe2689ab8e0b8a5c |
| SHA1 | f49a88830ab0aedec26386d901232aba544e57d5 |
| SHA256 | 376d19623973dd693148671943ac4e30194fc816761688e08ddfe9dc8553719a |
| SHA512 | 8bc32d1ea3217b651c9842f222612361c129ec5397f176d9724ea154012ffe774818d58292e6eea22deea5b466ae9667a878b5c1bbbf386070d74ed9764f2ab8 |
C:\Users\Admin\AppData\Local\Temp\Cab621F.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 24e01b1e2c1fe9e2466c055da58f3ef6 |
| SHA1 | 358d02b68ffbb531af83283ed5ac5c70504d1748 |
| SHA256 | 86ce27264e271b2b4d1713f0a11a38a4299565f9ff7f5655c3075d79ac22882d |
| SHA512 | 4cdb8982eb40377a94086b5de4e28d2e72d7ab7e695920a2c25523ea1ce648b58dab8e9ac6b3203c3c9dc28ef3a911e5c5802cfe09c736af76d5086f7379630f |
C:\Users\Admin\AppData\Local\Temp\Tar6251.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MEFTDE7Q\cb=gapi[1].js
| MD5 | bc9ced769206f4c3a7fa4a45a3bde4ab |
| SHA1 | d98f42d7ebf2422f38fceb549643b44196a3499c |
| SHA256 | 5195cb1baf306ba306ec62513e4a5936001c6d4a86e2e99c2cfed7648af84684 |
| SHA512 | b408c4e27196def6e55664f9b470f4a6fc3bf48a7a7e75088b663ffaa4ad73439ee2b2e6f610e255cb73851d2323104ea7c469db3792e96477570ea5e65d334c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar6EA6.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0c4529adf01d09d1264d143115530787 |
| SHA1 | 410436e350d2ad256b0764b02fe6e092ec31f7b2 |
| SHA256 | f59c884654eafe6ed6f76b32ef80c4483ca4eb3d8e378b8a7f8416c9a1428b8a |
| SHA512 | 14b0d67f4d868f1376295b80e25296983b6ad45d774efbe462553f36434a0453006c1753ff91627ae92681f1efba2737e19bc3aacc38547e2920018baa89aef7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5fa681bc363c5e79414dc44c943512e2 |
| SHA1 | bf99f1f70d8497f368ebd101ee64fe884ca0d289 |
| SHA256 | 3d0a9685bb710f5eacdf2cb7d737f8e4b758d5c8a69c623eb4b388bdc9fc4a5c |
| SHA512 | 37fcdf712babbe5d077b3c5e3c54c887b467d69b0e02ec94d517ddfa7ef18d30e9ef3d040617d512138bc21e2bfc276749a88c18fa4467e79b9f5d6aec9097de |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0539c090194b36dd359aab4c72ebaf43 |
| SHA1 | cea4de0ccb84b8cdeec7c24ab17bf7b59c17fe10 |
| SHA256 | f750cfcdb9da47af6f1205bdd5bb4e74d98765ce98985cee2e44546f6a9d6be6 |
| SHA512 | 1a9ed0d548e20210775df5a834ed3c56f313f583b8468c101edede8c59473cad5af135141f0c9ea56652a27079e34c0d63b2c121a9b56f814abbd2dc99eb353d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b6d51fb945827dcd9041a191e80c3085 |
| SHA1 | 530824ccaef11407aa1b0fb6b01021a2615c9e6d |
| SHA256 | 552462dccdbeabccdf0373b3bb3d035a0e579705b41c4a5424025a20bfbb442d |
| SHA512 | 92498620f7d701b16912eefc0f75d15774c3372cc2cc8d128c9dee9581c574e766a0c26e59ccc839edd12e8442116750919962038872886984eff6522c0af8b1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 20ba59c0ea7bb4b60a5766dea38edeaf |
| SHA1 | a6db5d96b33b0f4d5a9e5a43738d7e30ea86c02f |
| SHA256 | 03affdd8df3494cd457aa08ddf7feef6bbc288f041270178efc71f9b49cbcfda |
| SHA512 | 7333336164d229afbbb020e218384260bfe2d093c7f4193f49199429677cdea3e0a64dbfcb2b8034b01faf2011e6e650f386c0fdacebb4cd0b26e01a5d065af3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0cc32df0c7af76e58dbf09a953004f30 |
| SHA1 | cfdfb93588f2e7045acd0346ccf78a0488a3cee6 |
| SHA256 | 8c19948ae43d2ad7779177a52b00585df7170d528c819fa246cb33bb13332d20 |
| SHA512 | 1969d1c41d3e76ad96d8a377423db627bd4a16a66f99843df4ba609f90acdfcf19198c5350f9dce88faae4b9c75f0572bc516766ffc9e1316b77e6c1b4a948ee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b02b24a25f8e1d98c4991eaaed7e5583 |
| SHA1 | 619b5461e2e2a88e706b6eaa258aed13cc31a587 |
| SHA256 | e36357963569f9d7fe180837b3d21aa098b6eac125c42285a3377309f4565698 |
| SHA512 | 2a138dfd3dea63e36856d961ef880ae6ed9c5c159fdf920816bf845fe903f962eebc7b7ab3623211fc0d535238d44fb9eb87b0bcfaba5c4f335efb8f6c25f9ae |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 959942a5bcc8fe39c3f53014201329a4 |
| SHA1 | fd23e1828921a257c6e8c881dcce55b3bcb4e013 |
| SHA256 | 5f94d24df496433e3d71e7f503b0b418ebe9fef9e2c63c52795eca7c3e23343f |
| SHA512 | 85a85d1443be19338215e73055540e6060295a36f8ac31dbec09c70660f1ad58e6ae67e1d914c27bb2e02539cb13cb5336124f99b2717d09ee94053931fb25d6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d23a4d1a09542f7a359fa2cc109991fe |
| SHA1 | e03f09bcfe7f426ffefd443ffc490d1d724bbea2 |
| SHA256 | fe95ce8d6b3f4783d58e9adc4ddffe1388c8b0d588d9b3ed971f8511c6dddcd1 |
| SHA512 | 8b93c5519cb54077ae9e6a40e5b2574faf93401e2d731e91cf513f09a3ce3315c42483bbfebf75f162aff6e05923575ac71480e860c15cd1118b5eba9b3e3eb2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e352ca566b394b42f4706783ee7eb6cf |
| SHA1 | 72653bb8e5c4e9368b851043b9de036b265b1212 |
| SHA256 | 4613d5bd5647ed3ad6bc175e84f6d6ee4920bb4360506307ac56b6570a919b04 |
| SHA512 | 12ef500b5b1c242751cc3beef36aac755276f7d7372c00d7c716167ed7b87df507fc331aa318e2ca5b8ab8a458509573c5f84a55f3a90ce1e0f1bd01546abea8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5ad8db9f0427fe3411e405b816b4f6d9 |
| SHA1 | 1879afa3d5d32a594d6aaf1e5fc45cba7994d61d |
| SHA256 | 4666dad2aeeb06854d77065f2caca54dc5eeea781ce8558f1ec98beeafbba5c0 |
| SHA512 | 43cd4330a33f302ed3854297bc14b014c9097ff209e4984957ba250c11a6213e073308afe224dc60ddaebd887351ec96f3728825b3b5a04d6638c4f6413bcc75 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | aea2e337e2441209b52c241972d5164c |
| SHA1 | 59704c5a52e48c9b95f1923efa959d330b338a9d |
| SHA256 | 1ea1f18b74df9b86245b46fd6311a033ce3226dcd1c790a42281456d8c0bcc38 |
| SHA512 | 5b5c37a14348de225c08c3e3bb2173b3a25bb23b4e14064129060286c28ee7a4498c64fc34dcd177b0a39a2bd4e437f3b256748b21d617d75a53ba91aa43e369 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0bd26f52c951aa0c0c4b575d90216755 |
| SHA1 | f838f3fafa297b525c315ff9aec737dc9e29d4b2 |
| SHA256 | c096f1d9af94805d0e226856568a01aa76a160ce5de86a2e784fdab0c6612b9d |
| SHA512 | cd5e4b5797e5def61312dfb1c19a0c41958336c1db3c9dd8886828b2440bf5b250dbb7f9fc02970c78903dbaed19a7bd35b4330bd0400412373203444580212f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | be9a2403afa3ead2d9aa194c1ef165b5 |
| SHA1 | 355a8ccc13b196f3539dd0d7837c9b0d9d502b38 |
| SHA256 | 9377a9137450f710a0d11f1be51bfa31acc3bba908e8f4d882b46c8bf23c025f |
| SHA512 | 84e4f0ce9f66b43f696f3f93e1c9d6aa50980c9ac75d1b28db45354b856697780ad3a81062f20290fe73c1a6ef201dd2d99b4e6d72ab1bc31eea1987f28b7824 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6c4900528f953e21732275297e5c333e |
| SHA1 | 080c79685ee2557e8abbfc536cb2ef6fab3e2c8f |
| SHA256 | 44c30755d100be9f6f3263692da783eeada0f7013d4132559e0df9b88e46088b |
| SHA512 | 02a1e209bd8c0add8d6db7a32c5978e7ed2124f256800d3d756a681fc13cedd63c1d108d6df83424ace088fbbeccd6c51845e0b6871e25a3896b7bcaa2edcdcc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 84ba4211aa024901e36e7ecc145ffb61 |
| SHA1 | f2bc44b7d98bf8446a48a792f1e682f55ecb5309 |
| SHA256 | 22e557c3c6505cde1b8eaa5fadb07429758d72f3b61ae513c1b3a72526096672 |
| SHA512 | 53805aa5100070716f7952a5d331922e86af97c46039455407c47d84b9be7ab616290d8c0bb9c0ce346483956775ef4ae14531c44ec0454eb8239781bd5a3d95 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ee9c5b14b20af013c0798259cd0d922b |
| SHA1 | 2ec33b496e2d07e107f1179c796918e967ee2e0e |
| SHA256 | a2cac93f9ca760eefb20f3565e31041d8f6948e42f010a80e634402134fe0d15 |
| SHA512 | b817c15ffd198ad7dd2aaf64fd5e0329834567c912c38b97ec42df1d839cf35592553379a085d54d1cba321484c67c07f8bfd80deabc5838b87187c72da41109 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 12:03
Reported
2024-06-03 12:05
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91b70155face15b5039016d28c5393e2_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5249544394386564008,215585724320652248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5340 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | www.downloadfilmescompletos.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| GB | 142.250.178.9:443 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.139.2.190.in-addr.arpa | udp |
| GB | 142.250.178.9:443 | www.blogger.com | udp |
| US | 8.8.8.8:53 | blogergadgets.googlecode.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | udp |
| US | 8.8.8.8:53 | 26-1.blogspot.com | udp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| US | 8.8.8.8:53 | 9.178.250.142.in-addr.arpa | udp |
| GB | 216.58.201.98:445 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | i42.tinypic.com | udp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | i41.tinypic.com | udp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | i40.tinypic.com | udp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| US | 8.8.8.8:53 | i44.tinypic.com | udp |
| US | 8.8.8.8:53 | i39.tinypic.com | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| US | 8.8.8.8:53 | 1.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | i43.tinypic.com | udp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 3.bp.blogspot.com | tcp |
| GB | 142.250.178.2:139 | pagead2.googlesyndication.com | tcp |
| NL | 190.2.139.23:80 | www.downloadfilmescompletos.com | tcp |
| NL | 142.250.102.82:80 | blogergadgets.googlecode.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 82.102.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.200.1:80 | 26-1.blogspot.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.178.2:80 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 2.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.200.250.142.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | ivisitas.blogspot.com | udp |
| GB | 142.250.200.1:443 | ivisitas.blogspot.com | tcp |
| GB | 142.250.180.1:443 | 3.bp.blogspot.com | tcp |
| GB | 142.250.200.1:443 | ivisitas.blogspot.com | udp |
| US | 8.8.8.8:53 | whos.amung.us | udp |
| GB | 142.250.180.1:443 | 3.bp.blogspot.com | tcp |
| GB | 142.250.180.1:443 | 3.bp.blogspot.com | tcp |
| US | 104.22.74.171:443 | whos.amung.us | tcp |
| US | 104.22.74.171:443 | whos.amung.us | tcp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| US | 8.8.8.8:53 | 171.74.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| NL | 23.62.61.99:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.imageboo.com | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 52.111.227.11:443 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
\??\pipe\LOCAL\crashpad_2692_AOJHJPGRNDNXWPPK
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1c9df30eb9196e1f422d493ba9c1fea3 |
| SHA1 | a8559572cdfef02951acf4e3d6de7ad60d9cbf1e |
| SHA256 | 024c38c7ec46e6cf66b1f5c14b96b5f2df75bc1cf429d4952dc2de05dbb29716 |
| SHA512 | ce61c65c6be936e03dfc0195fd53d328c45ade76b9fa8327f6e6917b04747171ca7bdba1d36fcad5eb12f828160a409c43c764f3b39a4464a020a4675160c880 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
| MD5 | bdced4c2cf63d567ffe0740f597ffd7a |
| SHA1 | b7a2d2445d921eccd3171697bf92465c0468003b |
| SHA256 | 139e94faade83507d49f8e7dd96e89d8ccca26965c46c5b0d024fe5386585f69 |
| SHA512 | 8e19aa46e309697e3d2045f1abdf689f423f018af67c5d2001fa00287f86275f43485164e07954028ba0e7286e53f0721980dbb5408798ff5fb071d69599c717 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 29962d93bcff2776c7a29bce9f81f0a3 |
| SHA1 | 6bc0fe8dad9294c1842e6b2017db340b87430308 |
| SHA256 | 44f284375cb266cedbb65820595c3d7a233e604a1cf00691cccb2fb709e60228 |
| SHA512 | c02c279f19be71d1cb9a1b275983d9b22a40508a3004d042ec15a931fdb57ef7fd5bcfb9662b8e29a97eb611b63d0fa2eef6b73ffd49b8a5b5cebc703ead9283 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1d5043dbc7c5559ce01435b0d77859a1 |
| SHA1 | e8ba62d74bd8e989150ddcd825af1e394d4fbfe0 |
| SHA256 | 39747384de67859beb6d3c9f8b8a17f7ba0bdc16a7b51efad7dfa1a08aacacc6 |
| SHA512 | 1ff50bc1a114a5bcc55684b8d561ff244d3945f0701a682f9e2898020e300ba8f1a82ca57451a8d3fbdeda08025f4756ff7c5211cdcfc2d8b34e330403f9eb62 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3cd4b2cb520d24f1e12e8dfe6c0a502e |
| SHA1 | f46ba37ccb13513e466d275252075745e8f8ce46 |
| SHA256 | 1822fad98be8c1be58388b57aa98acbdabd1c4f27fc7ca69c7220e1594056985 |
| SHA512 | 2402861a9d783ef235759e53c637cc854ff83d4409cb6b1849252e15c6e164dfeae719bdf5531fd27da8f9e0c88679f925d1827ba3b0f1ec38ac2c622a4b8a1a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 2ff548f00e0a720d7c91d4f1d23e8b90 |
| SHA1 | fe376c1af837df6357db893a3c95051e64b6d690 |
| SHA256 | 4d9df811cbcf8bf11b1fae7d81bca31619762268b4a9494b7c85bc49c8692001 |
| SHA512 | aa62ff95e9ba4a4a00ee823e49de33ec8cd6f78242d5e0548965f7f3987ebfb58b093171cd76eafb7d54513bbe8110aa8bd1c53964a4e5506455947b2a67956e |