Analysis Overview
SHA256
f1a104746434a55d4252150ed41d9a02d64540a3827fb27a5a37bb7055cd57f2
Threat Level: No (potentially) malicious behavior was detected
The file 91de7d858e06937ce8176d353cafadbc_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 12:57
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 12:57
Reported
2024-06-03 13:00
Platform
win7-20240221-en
Max time kernel
144s
Max time network
145s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423581347" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9046cfd5b5b5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f83964032107743af7ae396e40f0a88000000000200000000001066000000010000200000006b5f3821bf6c76abd158b7fb0a8e28898a9dbe0e7fa903ac7530ca658e8bbbfa000000000e8000000002000020000000d6e63fa8a1ee71e35d9a129e44b8e9339dda978d4f11eec72a79c8e9b0bc47e490000000435345c463328ca3781c5e3ee7492355c62a1e906140911ef7cdfb431db8d89cafb51d5517823a46cdd3f5c29b0355680533b494a9745a35c07ae6230beb41fd2f2eb306ad75c46b773588eeebdaa31bef7861ed89d7533446488d8720a8f813c617ede3a5a3d7ca30300c3dbcc7135d8564e12f51d479c0064a5256d3606a8f2e44634e3f1d3204c172f6727ae76cc7400000007a990fdf5b5b68291eae801e2c9b4f3361e226aef98c370b88d97d5a6aaefbfcc033b77df0e8ef2c5dbbf167bdefb7c2726ae3d7a6e67118de2278dd77bb1793 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E80C8E31-21A8-11EF-AB14-E299A69EE862} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f83964032107743af7ae396e40f0a8800000000020000000000106600000001000020000000ac801a12e57dc79c11b372a25077e2711f4edc0958034cc160f217e99b8aec28000000000e8000000002000020000000a86705ef5ce52f2a1d01dbeeb8189338a6f3f6c38438ba53da34a249919067e6200000005e2ca3c22a6ed756a925c4f829e6cc110d0d300da586550fddd6bf1f52fb7b81400000009043e469ce7ea4c697315fc801d3d6f1c7c173d022f80930514f6a4f897dcbf70ee54ff7f3bd958734125366e925f537b0e90dd1125450c15786a9e7032b1784 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2712 wrote to memory of 1256 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2712 wrote to memory of 1256 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2712 wrote to memory of 1256 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2712 wrote to memory of 1256 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91de7d858e06937ce8176d353cafadbc_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.gravatar.com | udp |
| US | 8.8.8.8:53 | www.cozinhaai.com.br | udp |
| US | 8.8.8.8:53 | 2.gravatar.com | udp |
| US | 8.8.8.8:53 | 1.gravatar.com | udp |
| US | 8.8.8.8:53 | widget.tuasreceitas.com.br | udp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 50.6.138.65:80 | widget.tuasreceitas.com.br | tcp |
| US | 50.6.138.65:80 | widget.tuasreceitas.com.br | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 8.8.8.8:53 | www.tuasreceitas.com.br | udp |
| US | 35.212.52.216:443 | www.tuasreceitas.com.br | tcp |
| US | 35.212.52.216:443 | www.tuasreceitas.com.br | tcp |
| US | 35.212.52.216:443 | www.tuasreceitas.com.br | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\26eb551a1b63623980d76a4ab97dbf5e[1].htm
| MD5 | 4f8e702cc244ec5d4de32740c0ecbd97 |
| SHA1 | 3adb1f02d5b6054de0046e367c1d687b6cdf7aff |
| SHA256 | 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a |
| SHA512 | 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f |
C:\Users\Admin\AppData\Local\Temp\Tar1421.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\Cab141D.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1531.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 45aafc6ff6d330917502ea32a829ff7f |
| SHA1 | 0dcf24ec8796c7a10af65fcffca9ae95b1fe52ad |
| SHA256 | e99ac49bf063da46f1293059dcfd86ae03b3452f735a1ca3217744c67da939e7 |
| SHA512 | 206415f67fe27af9967e7f1334d820e366d94ca4601e68980d9f5b5201346d8a23182ddc0a57bfec4fa461d92c84623de309a3c9e15d199bb008bb505c212b44 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0db3740896d829432489b374814e028d |
| SHA1 | 2b21d313f85b80c8586d5c6820ac5a9d40bb41cc |
| SHA256 | 5c44aec24eb6fe3ed1dc5331b55df5fa39851c94bb9c93ccc8e58034c0ca5220 |
| SHA512 | 3504ceb0ea1fb2bd9ff272580ac53681d4a8f83b0271e0dfc13d57f9a4a713da78dd2378d8d6af86ae011d5ce5baafcbc7e3b39e15bc0830f90eae367438a25b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
| MD5 | c6971fb8bb00c4183f497aadbbeaf3a3 |
| SHA1 | 74e7cdeee3cb25a52da52170776fa4194d834b8b |
| SHA256 | fea5ecf83ee0b3832d1135d2426222426655ff2b43f83048d9839ac2a0849024 |
| SHA512 | 21e5ff4c6eec57474074d006d89cb1606f119814629b681f3b1f1d894df3e6b2f478700383ace5f97b7dbc4b2aea54011f58dec68ac3cfb8f846f8bba947065b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cfa82e39a3c1b462c0171b68693d64c2 |
| SHA1 | 4d3c771953734c5b42afd6440a6e89c22d7f1425 |
| SHA256 | 669111fddb3f9cb0fe4b15bf3a59869c09d89b34a59ba1331fa1b26dfd806b6e |
| SHA512 | f00df3550935d0a0ab1649135219f412e2f9bc860720ee1576ddc0bba54c712f52cf8f0c718bdbc3ba48b5e7f2126b534441cf2f0a3425c6c84709d89f6758d7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e789978fa2c67d0b8fb6686fb7027878 |
| SHA1 | 195f13590268907c5c0eaaccf8336ee7055a0725 |
| SHA256 | b2913be10f9fcc9b8f8ac37d9bd71dd4b4e610a423c82eb81d382fa80fb469cf |
| SHA512 | 5724964ad4f24f8d6c0cfbc73480d9c424a583e01e96330e90f408432a064e333ca26e5edda26d4a805487b9b7e4dcac728c191e389ffdaf71a245f4db9e3714 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 629312046febfb491e2883e22ab6db69 |
| SHA1 | a2ccbb3eb7aaf535f819bc5b8274faf14c254f66 |
| SHA256 | 185946b4a72761a211815ed73c71932d18927f4e28349bb7835b2ae1142ccda5 |
| SHA512 | ed7e39f8c8d09db9d9f518ad930ceecc26f6788667843b87e090cea7f59a048a28a9208dd607d7b21ab724ee3fdd9092942697d6719394a17c0112726d655818 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | bff435d65cfebf0d1e02aa5e1d5fc659 |
| SHA1 | 7c3dd95037eaa429a5fa1c3daee2cfff424c9447 |
| SHA256 | 7c96551907c043d884e69add446d3ea5dd721ffa51c51afc04aa78aeed9a191c |
| SHA512 | 69651a41eb51a45791c402385f6827829e9ff51f2d89190c935409032433805ac240dde5fb9945324edfcce8bd14233b2f03ba86aac63c1d13673846290434cc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e135c1246d50086574e338a41642da94 |
| SHA1 | 52d64e0a7e18f3fc0a55f3efcf0d0030eefec323 |
| SHA256 | e5f26da6d445c5466b630ad3510aead6b249ab6656f4d2885f56727b68b65c24 |
| SHA512 | fa12e9a3cbf01a789a736e90fc26dfc9fe40e7ff8b058f496029733c22eabad669f6ad5aa49d9b88faec86dd5fad6e8565c5bbe7775d1f975402fd06c55a72d7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 97976533068b7f17fae0e468a296b8f5 |
| SHA1 | 4b41ed3adaf3ec6669c0663d96eeec01cd147eeb |
| SHA256 | a831498f36a3b061879e8351bf73e2a6daf93a771f82cb0a1b6410db6c3e06e0 |
| SHA512 | 9763cfccf7aefbb901d6b5244437988687eea3e550261b74af5b5167bfd36cb136dd0c94f912ba4ce52e01954c903c295d2f007aeef40e68675d8c54254cb604 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 281a5f23735ac617fb4e9952fe4afe54 |
| SHA1 | cafa31afec69e92b8a8f05e1b22422856b38cba7 |
| SHA256 | 5ac6b1252db8420fa6b5a7781c7ee4ec191b325bc3add6bc8b8cc8f43a618140 |
| SHA512 | a681093f6424819487d30c0221ffe6c5e9956e709eb2379c8f777defb0cfb6f6820b002f6bd34c539f07dd9b2f4412d7d13803497d29b98445698ec0a81a78f6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d4fd31511b5ef84a9dfd3a0ee4a4bfff |
| SHA1 | a3896a08c9c48694637a2b7e915a2e3f42215ac1 |
| SHA256 | e4c97df7deb78a83fbf06e9fba9ba0809dc961c698cf3420ad9503af5892d9b4 |
| SHA512 | 1841dd9b70570012c2a2dca66f9141e76b5ef5e6f9aa0dd32fc99b26aadf0b6f1b8a610d9a7409716837f2fe47ce32899d0575f728a7c7297d7f7c09c8fe26d8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 456469c81181f360d58a7f026c808602 |
| SHA1 | a7f085107ec5a7d11d2a3f30ccb9b9fa631b8bac |
| SHA256 | 4e05c43a83cdcea4f0bed076fbcb0da537d30d976de8b6dc93a3eeabc61838bc |
| SHA512 | c26b13ca5e7b5ff26a206d916db70366c626fd3fb7786221efad2b03ed6b93fdfd3cf843bfb8134b513eda8d25144e84f9edfb7465b5731f9430ec77ab78b558 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 12cd9795e33ffe157df583d74e3ca93b |
| SHA1 | a9b7b78e508b24a2194950f0f77ef7c7f217e406 |
| SHA256 | 35487844c17a3385b651d8d3994988826c13ef57e49375ec79ca6bd9731ff9e6 |
| SHA512 | a06014d8e7a73669724d5bab14b421f891dc298823c308788e33db9727e4e78a26c474154aa98b1b1d3e6e7f50ba11e7b889229db88f8434985165ecb44df501 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ad1ce27f80a3bca3dcbedfec3227d797 |
| SHA1 | d686762e29e6add31ea86758723d0996c470f0e5 |
| SHA256 | 40902cded75a162b127a949ec84feef7a9d00637608298f70450c82877a9a151 |
| SHA512 | c49723c6f18adf0998a1aff0cabc2ef04a818a94639edf9669b9739585b2b2c0cbb8c5bfd3718fab2f7e46550072dbf3ac2217b73b0b1fcb9a9d2fbeb4e35bf1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 862de06e7e6c8bbd1d23edc3c8362c36 |
| SHA1 | 138b5561108a24e004dd81278430f640273d1854 |
| SHA256 | 0e2f0e1438319d895391465f0a9a4bbe614d7aa8e4a0c27b0d2b2b95a3e45177 |
| SHA512 | 24e0046eb9a3ab8262e167ded368c62b14fd525f99b6bd61bc5ed7cf37aa6cc1bb410274c8cda7b4ed7ac24cd9828dd418febeee3c1179c911a25dae66092f88 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0fe989f5376ca1414e54a2fdac78bfda |
| SHA1 | 30ec6e5f22dd9908f71d7a402ec1ad2f5a3d66e4 |
| SHA256 | a990efca2c44bd76a0b77709fdc54d154e57cd11aaea6d6b932a11b1cac6aaf7 |
| SHA512 | 13ff80bfe08cc9c146db798bddd39e8321b619d11aaf0c20af8b593d67303b210806b13ccdc7c1100d4993b6d531439e4769fa6c2f150d0ed57e778e862906f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b451230ded6fa4bd21ae62e4d78e3ae0 |
| SHA1 | 0dd996763efeffc6bd134460855e938d4a0c72d2 |
| SHA256 | 297355690f0d544061b5aac8aa9a93df8bc5e3d34713a02d5afcb8748353d3b0 |
| SHA512 | e3c9094aa76c09fc2896d4e8e86c9ae047007c8b75dfe56ee11b968613e530d43b9d0baa7f6ae608cd939a439ba790ca158722176bf8e41562400ee99533438e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 43adf91d5cc450aaf31f33a42e8d5331 |
| SHA1 | fb36f8f90e338dc09f8e2555485fd2e3b3f57e49 |
| SHA256 | 8025ef08a2cff60d874abc632036f0db72f8ffb9e0f5e626d32bbca1145973b0 |
| SHA512 | b4c016bee74a75f1e8e71f2b687658a353f71f62c4c3a21e84252cfa844e8313d6a7fbe46e1de8bd745a51737e8979ef4d3274e1f4f82e1d31def4b248f666ba |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 08cafffad3ad97356477908f55f89e1a |
| SHA1 | dfbbf2dcc5cada38d1b9af28977457b613316c9e |
| SHA256 | fe695d588c04f73e19ecd1baf436f735a39f189eeb4f422a95ee3fee40bb03c1 |
| SHA512 | 5e48ce5cafcf0a4d98fa39169194e1527d8db4bacfdae78fdf56911bba42b41f3722d91b7368f74a1198ec168c6552ba1acbc59ac03a1dfc4c5a30d2253635f8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 96455e3674cedd8ebb18a9f3a2e8f6f9 |
| SHA1 | acc83038e8420f9693317ca0cadf9b161c3d8d3b |
| SHA256 | da5dd09509413b63017951f4b56f2ff4fc438ef0f0a23ab7168eaa49307437be |
| SHA512 | 0702adcf911184190aaf3e68b70d72b3c6de45f2a9840bbb01effcea95bc04d0ab213a7352eb5d4f5eea03ec52a4beff467daf8d67b2fa26d3a233dd6075e6c3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7ce304b95c4a7d6931fd9679346e63ba |
| SHA1 | 51b7f27929b0d5a7f9763c3322cd36be4565cc1f |
| SHA256 | 834060acc6571485e32d29f7502652bc6f15f6fbfa90a5aef0f31461b3e624d5 |
| SHA512 | 72a6b6442c172eb5da1c545b82fa49136260adc1575e816c72f1ee5c45a0fb3ce687d21f09d17f422f5a49f1ff0295779cc7389c7406793854c8f406e83b93e2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 432c19560e99b70069657f53ccd0db2c |
| SHA1 | dae39aeda9b61b9731b9ab3f852e4dd4d0c85fcb |
| SHA256 | a311bdd48d3606f6277f000d3a0f496693c551c8d7d09b630fbabd545dd349b4 |
| SHA512 | 768c380a93991f8492d6c2dae31bb5a5a70a6fb959b445c652010d80ffff557e65a48d25bd54918f97132b01749f3f30cd99bbf0195f004fd2ecdd3fb4cb531b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 190808b5a1044ce8a8cdc6b85bef44d0 |
| SHA1 | a91f92b1d6f3913735056656d5c6ce8f8b6b6b67 |
| SHA256 | 8eb91b1cc9ba7e91de98af9e829d9a3574c2657028c94fb0ee3be3e6f4280eda |
| SHA512 | a8d42b7dba9e49d5cb85df76dbdf5b3f38175e056506a37a4469406be97a740798b2a002238a89a95bd3c33121fb6e2ba36d17657e0e6f58171511eac9d227ef |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a469dc2cbae22093a63f42cc2b2d057d |
| SHA1 | 247f4b262d00e6e7fa95297e234cd4009dcd7ba3 |
| SHA256 | 69165e2c035cab43f8edd498547585f100dd1f6066e672637129a828afc9b867 |
| SHA512 | 483207ec2fe0a3bd049777a2755bea2d6865c595c391e8e31748de07229b1eb3e7cbf406f160f0ab89a007ecc6865fb12cda93b83cb2322574bb3be0991273fc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a6674395273a81b9254bb4514b816210 |
| SHA1 | 24cdeddd236ea8aaa888a647cb77eca87a25e5c7 |
| SHA256 | 5f741813759076c3afa9ebc6f516d00ea67151fd64e296d3619a00a109c81bab |
| SHA512 | 40419d1c888e6e7fd86d7e3360b1102c5b5d2ac5d2f1e983554dd60b51d33d3abec4fc795c2a6aa6d5a8bd627a52a49ea179f3c1ce9c9ad8e58087fceb17c74d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e3fa9061ac3bd96fec7e76e3d84d6b4a |
| SHA1 | b93cf2cb7093ebeb0568f76c6660c935060a8fbc |
| SHA256 | b7027c025008798e8bea0dc5b14e971816f6550094611b8436caa13713226a04 |
| SHA512 | 17cced5202b0b58f39fff4800e774da29883a55f54d5412deaabbce8d7e16764dc5a8c61c03026f11f05700700485fe9e53827bde1fe19c0fcc6d9726a398b61 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 12:57
Reported
2024-06-03 13:00
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91de7d858e06937ce8176d353cafadbc_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10710286706743809712,7135361137414124356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.cozinhaai.com.br | udp |
| GB | 142.250.200.34:445 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| GB | 142.250.180.14:445 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | 0.gravatar.com | udp |
| US | 8.8.8.8:53 | 2.gravatar.com | udp |
| US | 8.8.8.8:53 | 1.gravatar.com | udp |
| US | 8.8.8.8:53 | widget.tuasreceitas.com.br | udp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 192.0.73.2:80 | 1.gravatar.com | tcp |
| US | 50.6.138.65:80 | widget.tuasreceitas.com.br | tcp |
| US | 50.6.138.65:80 | widget.tuasreceitas.com.br | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 192.0.73.2:443 | 1.gravatar.com | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.tuasreceitas.com.br | udp |
| US | 35.212.52.216:443 | www.tuasreceitas.com.br | tcp |
| US | 35.212.52.216:443 | www.tuasreceitas.com.br | tcp |
| GB | 142.250.187.226:139 | pagead2.googlesyndication.com | tcp |
| GB | 142.250.187.206:445 | www.youtube.com | tcp |
| GB | 142.250.187.238:445 | www.youtube.com | tcp |
| GB | 142.250.178.14:445 | www.youtube.com | tcp |
| GB | 172.217.16.238:445 | www.youtube.com | tcp |
| GB | 142.250.200.14:445 | www.youtube.com | tcp |
| GB | 142.250.200.46:445 | www.youtube.com | tcp |
| GB | 216.58.201.110:445 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | 2.73.0.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.138.6.50.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.72:443 | www.bing.com | tcp |
| NL | 23.62.61.72:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.61.62.23.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| GB | 216.58.204.78:445 | www.youtube.com | tcp |
| GB | 216.58.213.14:445 | www.google-analytics.com | tcp |
| GB | 216.58.212.206:445 | www.youtube.com | tcp |
| GB | 216.58.213.14:445 | www.google-analytics.com | tcp |
| GB | 172.217.169.78:445 | www.youtube.com | tcp |
| GB | 216.58.212.238:445 | www.youtube.com | tcp |
| GB | 172.217.169.14:445 | www.youtube.com | tcp |
| GB | 142.250.179.238:445 | www.youtube.com | tcp |
| GB | 216.58.213.14:139 | www.google-analytics.com | tcp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| GB | 163.70.151.21:445 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| GB | 163.70.151.21:139 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.cozinhaai.com.br | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 87f7abeb82600e1e640b843ad50fe0a1 |
| SHA1 | 045bbada3f23fc59941bf7d0210fb160cb78ae87 |
| SHA256 | b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262 |
| SHA512 | ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618 |
\??\pipe\LOCAL\crashpad_1476_NYEYWIXSNIZBXLZE
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f61fa5143fe872d1d8f1e9f8dc6544f9 |
| SHA1 | df44bab94d7388fb38c63085ec4db80cfc5eb009 |
| SHA256 | 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64 |
| SHA512 | 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 3954161bab6dcb17e86b3e921c785cea |
| SHA1 | 97431bb2e081853b5c1b1aabbeb5c06c4c0756c6 |
| SHA256 | 1b16183bc8916de8f92c977e3af87d15d9ba453f77b34dcdef04dee6b6662d0f |
| SHA512 | e0ea4ca1768adaa574b812b5c3e4430a0233b98f303cb0556febd98a2b01c7316449248d73218896da8fe50af1801066473e91d8b885c7c8219b9ed1c975ad93 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 30710447357ad3e88536ffddd6e3b6c5 |
| SHA1 | 7b11f2c3b37ec911cf91aa576f2f7545c19f26bf |
| SHA256 | 7c6a0d00cf5b18c0f87ebd0aefd231248ad7927119b7dad9633c5009dc534378 |
| SHA512 | a3e2429d84be307936c8691b09e9cf89413571b71626c21bad1bdd679f321ed5c219d773c03af2c05859831d370b2175221e6fbf5fb4531fe9d65cacbdcdb1e2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 347bd79865e1022cbd8243a694d4b093 |
| SHA1 | 5ac4a7d1142b4f6eacd5e193f62b99b7eeaaf70d |
| SHA256 | 27b9581233a574217f148009b6dc553a0bd6be45b871be373d6282a0f23db79b |
| SHA512 | 6da4f0bc87da4698f83e28f9481efd970bf28d961b4c065d0012eb5457dfbc6d96721e363a1f6c727b0cc7f44b0cfc236d201c8e5873d3c39b73ce045ed6d45b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b4c5c695b6f4c93826c71dad108f5874 |
| SHA1 | 51f4ad42f13334aa178c7e049c2a1e04b870b9e6 |
| SHA256 | 656bf2db694424fc671041095c9f6d75be01914a7ab82a0e648321175b361a87 |
| SHA512 | eae15e609ad7762121b9b4936446064e4b7db289c24b9fdc44f0321f0f2d64464f269cc23940b359ba7d5f0921c9b0c06570a90e4583e2d9d60880e66cf521dc |