Analysis Overview
SHA256
50d5d0185f5a3927be802eb79179534e95969878ec27c8dc4b1d4ab958c76a59
Threat Level: No (potentially) malicious behavior was detected
The file 91e731d986f52dd0f1fd5f8ecb50ce5f_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 13:10
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 13:10
Reported
2024-06-03 13:13
Platform
win7-20240221-en
Max time kernel
143s
Max time network
147s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074799874ea093e4e9a7335ebe309252500000000020000000000106600000001000020000000a620abd0200e02df8d5bf18838f3bffb8d63507216d4172f23b4cacccd6d56f1000000000e800000000200002000000049bb676602153a351f47dd00968570a913c2435c0c3143152865790c12da9eb5900000009c3d3f1312bfb0adcc457c1e580c00f4d6a3b97888faba0eeb6e6bcae9b4a9fdda27a856d026b908a65faab7381fbd2d8521674ae0cb3fea1426ee0dfb5feceb894a3cdf415892b0f48abd346aaea68852c0fda9d28b220c1c717f79bb75762c5f3831869d99ee4e4d326fffb7f941021a6a799175fc6e9162d605810b9df28cf583f3abcaded6e4ae6751c30a61ca6240000000e368a7cf0344b2101ba54ac4d4dedf71112dffbd56b7a5ab41c4c78be6aedee9e4c17c019ac95cba72887b86e4116ed7cb098ae927c3b19284177cba80dab81c | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582131" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAA5AEC1-21AA-11EF-A6D5-5A791E92BC44} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074799874ea093e4e9a7335ebe30925250000000002000000000010660000000100002000000098fa74ea69f0280ed8ee1f409909fc58d070cc32d302cc4901d89a73d0175990000000000e80000000020000200000000119b6bb7613ab54a5c1b3dd8654d6629c13626ef59a12d862337f52cb58f5f820000000c5b64924c0752586edc279bf7298db2697a24596eea1b1baba71023d5b3d709d40000000d774b91c3fa4b5b02254446a362ba30e6965fd279efed090b934ff92f8f3401fcb1665b856122ef14c21415d23db96232058ab5455064ee7a077e0174ed111d0 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70707baab7b5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2292 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2292 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2292 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2292 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91e731d986f52dd0f1fd5f8ecb50ce5f_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | img.sedoparking.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 205.234.175.175:80 | img.sedoparking.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 205.234.175.175:80 | img.sedoparking.com | tcp |
| NL | 37.97.135.129:80 | tcp | |
| NL | 37.97.135.129:80 | tcp | |
| US | 8.8.8.8:53 | partner.googleadservices.com | udp |
| US | 8.8.8.8:53 | www.adsensecustomsearchads.com | udp |
| GB | 142.250.178.2:443 | partner.googleadservices.com | tcp |
| GB | 142.250.178.2:443 | partner.googleadservices.com | tcp |
| GB | 142.250.187.238:443 | www.adsensecustomsearchads.com | tcp |
| GB | 142.250.187.238:443 | www.adsensecustomsearchads.com | tcp |
| US | 8.8.8.8:53 | ed-lascuola.it | udp |
| US | 199.59.243.225:80 | ed-lascuola.it | tcp |
| US | 199.59.243.225:80 | ed-lascuola.it | tcp |
| NL | 37.97.135.129:80 | tcp | |
| NL | 37.97.135.129:80 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\CabBB65.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cdd461129d5a797abba7e0463171d534 |
| SHA1 | ae85659752a6eb22cba00caa294782bfe3dd5d12 |
| SHA256 | c424cfe16f4032a6b99e8e6ce44b3440e4bf4ac5ddd9e457d918b26624eb93c8 |
| SHA512 | acc6ac13e7b3cd01ea4dad71aa6fb3d9e2e593c62d9812bdafb1d5c0512a13d7bbc2e594a97233d349f0c4fcfd844fe989596c727b64ec19ec5011bb48e2444e |
C:\Users\Admin\AppData\Local\Temp\Tar7274.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\Cab741C.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar74AD.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 6cb3d93a71020bce39622871dc5dc8de |
| SHA1 | f011d06c20b9aaee7377481e933e9607d02acbb4 |
| SHA256 | ac46960cbe15f181d56b5113f08c5396403395e1b13b9aee105af15e8e8802fc |
| SHA512 | 3c616433a0831b81aa5572ae25c929267a13771f02779f54f002dd64e87c6e43e9ee69917dcc1d0cfd16ecf512163c634cbb18e0b1f81796c049ef01c39f5b1f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9ed1f09133575494da0a9a39d8b99ea5 |
| SHA1 | 66f2d10895c011d0fac566ca71946937a92bc894 |
| SHA256 | ea94f24dd9be587ccb8f162f80884139ad4cff02f73bf16287a8df333bd04814 |
| SHA512 | 83112b18148bb79fd14723bffc7c04c5db67b6f8407d2f91e4372a391ee56d43e9003310c3cd060e2514f22a4576f5f4aa6f47faa67c70175ef8cee67c3ea009 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b2de7986d15fb4299519d75eeec2b5ec |
| SHA1 | 8f242e9ac87a5e776d68438219d3fa3735611d75 |
| SHA256 | f8d2e22969650bfaa0af253584e7fef4622aac1e028978b9d0c7436ce751d621 |
| SHA512 | 54895b9af6da013be7522b5ecf928051bd0eb8dc51cc8cb455f1ea7277b85ec93d0fb61616f9b22a60926f65f6d60c1da481ca16c2a3d67c9b80ee087f217dd4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5aa583d0b0ce00dbe377a78b923207de |
| SHA1 | 3ed9eb7b6046f73590596856c3002276fb60420c |
| SHA256 | e2bb43f49c338372836a2901b8591d08f795104b8fd61562a6e9fb4564a4639e |
| SHA512 | e6db0a62889003cb94d038e23746b9eb7fd56c099064b600e79961c623c71ede6ac0e6ef6c10fd3c27bba32932144a9f27879e4c39950924e860e5a3ebdaeeda |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 76812c2fec3e58d766301f392263ebe5 |
| SHA1 | 5bb8eef11de108fb73aafb6fb3f226c9b13f9725 |
| SHA256 | 1cb85616ea1386fc469f0ae3cea0339118a0c9dc2e26dcd42894552c31fccb15 |
| SHA512 | 04cf56d292ba0729c5d1e83dc0ce8ed0abc5d449715810316d53ac39bbf692bccba3553ba6b898ec35be5e9f0b1a0d5eeec3c81ce6f89604c2cdadc859048ff5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bf1762d91cae7da74ee9b3242e475a65 |
| SHA1 | 2086578fdb34cded375f9dd63c69c3146bf920ef |
| SHA256 | 949fc6fe3b208535e0ef2c07d677721215a56e10d86106ec4ceadb6babca8b48 |
| SHA512 | 15bd92c90027d0044b80ef9131d86f7fdb8ac03f1d49161f7e75c3fcf1db2b52ed0917205cd58ff57e4424b364a50840316fa7e17967cfb7286c582ca8020d5e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | ac8d03eb5d7802bc2c0a4e0ba95811c2 |
| SHA1 | 31ae3efcf455eb16d11ed6a6ef087cad5fba8adc |
| SHA256 | 9a176bfff66877a3ef88ad16a2ad0426241b44caeaa5c81f2385e90b5a65c55f |
| SHA512 | 4ca8c502c121d989f4f3ae26a93ac309ceb7b709dc3d47af1347314160603d4ed18e21b7fd7107283769722fcb0997696a72bec58b234cda230b6d78081c424a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8fbf19c2d58b1748ff7bcb1c8cc764e8 |
| SHA1 | 18cf7d4069b95ead6cadd1830c009e25a0007a25 |
| SHA256 | 080aa7b08762e1001fed43d8b7f2b9a50dc679b61dd97234c6a1fe6c507950cb |
| SHA512 | 8e6745109bcc1ec0e3eb243c5337a24cd8a8879bc6196c1d002d33a8486bbf774fad7b010ab2b980d0e58fc52f81866e0462ddb2ce75ff540036efc8955d640c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d5d88226342dc6fcf0d0aec23198e8c8 |
| SHA1 | 8972f2ba81a29e8788a9a9e7047ccb4c0bf13d04 |
| SHA256 | b0295b28edd531b92a41ebbb65172233344e69dbe6d5e3907f82cb8024f0aee0 |
| SHA512 | b8ac78f69d8937f0319d7abb55e345c3e1f284dec697523b6e8af1c2e53622862e1d6a8b83c3c1581de4daae073cb3aac6ae6e695e3819b446536008d0be62e2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3445967a8722e44724ab68d765491d76 |
| SHA1 | 3131de052b7d253dbc38866531ff0bf36ad7633b |
| SHA256 | 33f693d4a2dc82a93e63b59a1de0129b2e67d21e9e931f8d53e4a2a9a21e946a |
| SHA512 | 014c2ee309c29928d849ee939dff8f0ccb7631e878c3a06236b8e71d3618045393acfaba8c8745afc5bcf42445254af7452f4601e15972758a6349adae416226 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cbcd0aa6f59f9e83122adb4835e67ceb |
| SHA1 | c776f1be7b960a28c710af53c010f3417ec30785 |
| SHA256 | cf27cc3ad2bc32fee32549c1f3560dfb5a0829a7109afd3f353ad9d8b7e08c4f |
| SHA512 | f104aa83b06d0c5bcbbe7bda960aa19332bc6d59cfa1a299328d2c70360861523fbb2436e9f0398482e862d64f7a9a829b951bafa4face1162204609de561414 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | df5084a36b889a76fc78c25a376ed42c |
| SHA1 | bd36b75c5e883f8ed62c8800a9ce9cf77f686600 |
| SHA256 | f1a3445d36c9b6354f0c8281f272c42a03d9b6594f9b6b0364d51e0f8c128cd1 |
| SHA512 | afaba6046bbf52bee920d37537f20c5a1fb4d1176b3771664810773c6470690406645fc2876b8d85767980558ef1d7540d504c91267945dfe144919bc9293b69 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fd58045592b8028dba949e4dccb9002c |
| SHA1 | 51a1106825817c37b69e0141aebc18198ba2a20e |
| SHA256 | 40c1ebdeb2362326b3b712ee129411350d06b65509ae783b3a51e312997cce60 |
| SHA512 | 9c1b8c226415110b43fcfe56857f1c46423d0156203487547335a4c230453188dff45558903c4deb358d9ce0ddf90b1fa87d569850dde2f575b08f1351d68848 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | af2e90babab867f45be83592e561a3a2 |
| SHA1 | 44defc5bbb9624129a8498e3970c5b00620413cf |
| SHA256 | 09a4836e0a56f5f93748494154b18211d468ee0bbbcaf649b0994b1ca8519354 |
| SHA512 | 4fb7706d0f12886aeabdc8f787f5461658c900ac1ffaf20a45beab57b9240e54bee33944eb7d6a6c73016eb1c22c43a4f017a73a6ca4309e1aa090f66fec10af |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1c730ea13a6c199c92e625d8e5422a8d |
| SHA1 | 264abd021e4a3aca7606a025381c148bd350b88a |
| SHA256 | addcca0eda6a59222c0cfe5a68003791e183cfb8466e3b018dc05a73e08d328a |
| SHA512 | 1110e50e37c372d4cdc1dda604ad710b34da0b0fddbfade8ff9337b4afc8a7ff590c8a905f1ab3a63dcff32c531edeabb1a09a29a88e714c0560f548705f79f5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 97cf0fc5197c9375ee49fa751dcd4849 |
| SHA1 | 9878d5ea3040afdb78c1e131191f1283c32d2bab |
| SHA256 | b547335b333177d113a790d6d0f9868790d17c7067f5efeb41753fb55b9e57e4 |
| SHA512 | 49642c262ff9d5ff897d62bc515f3f356e5a3b956c59fc4f4d0462ff14ae96157845eeacb1ec5ed67e9985117bc0246cdf6c04002c81c371b4144acb30c8864f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6ccf894076951fc0c09a5ca686af9517 |
| SHA1 | 1dd5aa9b834bb6ec5d8ab671143c936253856e66 |
| SHA256 | d62f5cf9b5867e8bbd18efc0ecbc501730a9dee5d8652beece30a17f749f443a |
| SHA512 | efcfddd2fc7aa1354d55c205dcb176a654277f025e219727e095a94352d086d46761f7c6b719d51f1c9c017bd6dc6cb297c87a3f4857273e031bdece50f47411 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b58e8c5958b75d247a186e17e5f97df4 |
| SHA1 | 8bb8cd7d7f254f1c63290973d7f89b4ab9990c73 |
| SHA256 | c5d238bca32bb524608a3b9216a40cb827d27991868e2b53f9942ad54bfbe84f |
| SHA512 | df124ab7e1c354cc7911f51ad8a18d76cdcd86579a0d5e45f2104a6516a5e9c63be6800c677343e6770bea0f9dc36ad47c3db46d645b7f3b4286e1f8e066628d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4b5b0d85471ea346c1e6282afae44590 |
| SHA1 | 5adfdf671864c569002e7a705e49bc6e82bc4142 |
| SHA256 | d568cebc5ca13be2dcac68c8d3d89d374ab98c2b6f1e40adea41bf52a83f658d |
| SHA512 | 1efaf43e1dbd9101312988b6309c3b7f64f372500b437b962b16551f7f2d6f6a26ffb0792026f7052785d1346964ce92c866ea366065ea34f27f58c2335c07d1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3fff72ffbc7beabd75e095f108966ab2 |
| SHA1 | 26eeec55217e5fbf9e4d6a6955d5019c9789a28b |
| SHA256 | d4d3e4db8fb4e54778d04121c193611a325301263c80a5f6f4a4a33e90bbeb87 |
| SHA512 | 32cd6269cb1a1083e3d1a920108de195cc6465dccb058c1c2a79da5ca3964092ce2ecad3f235db84ee1544258715e4af065b460624ed6a40dc7f26693ac7f257 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e8c819ff8795a75f0ccddca701dc8858 |
| SHA1 | 33c10caf6ab1199e2eb243f5d30139327fc8783a |
| SHA256 | 3182824e3e010d606bf90199993b6ceced304f42b1678aa44e560baeb01f86a8 |
| SHA512 | b50ce046a440161da00fdc97a1c6e3f35d9f27a8924beae5139c7fc42e91c526846512e921b1f626dccee382ea83aae8d1da3c3209e4535268c2b6926d79029d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 68ec9b1c3abdc9fb120f556cd867ab6e |
| SHA1 | 5ca3884c902a89987988ce36eb020f4a37b36551 |
| SHA256 | db4c3423252a80998e5fe3ef49514fb1b5b2deec0275d09d94957b62511ffe96 |
| SHA512 | 83e4fa3f7cdcbe43ba61d7dccb4f65a9cfa783516a241e190a5d8fc143b26155a96938884e5bb5f4a168fb84d79e708d9afd1eea6d2be8b269333e2105a95e1f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fa3152fef5f0e0cdc23698ee5d4096d5 |
| SHA1 | 9a11d466d267b22a068c202fa1e01cf68910486a |
| SHA256 | 151969df4ad304df4f265109b314d15d2be1d82844afd64be0e4305baf02f1b4 |
| SHA512 | c6188e319868d1fb98e04aecea1ea5d7c277c7fd8e7989e56ed6336500699a0b4ebd234e37fd2737e0852faad18c899f4ff94d8b4478010b4b4902186930785c |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 13:10
Reported
2024-06-03 13:13
Platform
win10v2004-20240508-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91e731d986f52dd0f1fd5f8ecb50ce5f_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6389509828100681441,10179310753045732426,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5256 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | img.sedoparking.com | udp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 205.234.175.175:80 | img.sedoparking.com | tcp |
| US | 8.8.8.8:53 | www.adsensecustomsearchads.com | udp |
| GB | 142.250.187.238:443 | www.adsensecustomsearchads.com | tcp |
| NL | 37.97.135.129:80 | tcp | |
| GB | 142.250.187.238:443 | www.adsensecustomsearchads.com | udp |
| US | 8.8.8.8:53 | ed-lascuola.it | udp |
| NL | 37.97.135.129:80 | tcp | |
| US | 199.59.243.225:80 | ed-lascuola.it | tcp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.175.234.205.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.243.59.199.in-addr.arpa | udp |
| US | 199.59.243.225:80 | ed-lascuola.it | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| NL | 23.62.61.160:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 160.61.62.23.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.19.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 213.143.182.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4158365912175436289496136e7912c2 |
| SHA1 | 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59 |
| SHA256 | 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1 |
| SHA512 | 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b |
\??\pipe\LOCAL\crashpad_4520_MAHVEWPJQBULFIMN
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ce4c898f8fc7601e2fbc252fdadb5115 |
| SHA1 | 01bf06badc5da353e539c7c07527d30dccc55a91 |
| SHA256 | bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa |
| SHA512 | 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 533a3e3890c011d2ba7bbde9acc41640 |
| SHA1 | 06d05799583d0fe35971d02c6d13571054432515 |
| SHA256 | e1ea4158fc9b8c987a38df76d53f68919e135dc75d6e3e33a3be584c09cf934b |
| SHA512 | 31ea391a497200d1c09937cd7d65e9ea32ce783563b4f859fd21e1082680255c3136087e7e72f9be98500e787d4ae696cb12354ae7980ae1fd9020e6db68b245 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6e65fc5f7460aeb97702b34e50659b8e |
| SHA1 | 4e2722108f7bf06774a1ad3c9f3b592553ce2c1e |
| SHA256 | 49016ba2d5d75e97c2a6f2086dd0540b65c7031e8a2b9120edb3084672ec292d |
| SHA512 | b2ebe3cbad1b0ce3b70cf78aebb8ef3278e50b5c36b91440a06a0055d2cbb88de170fde28ed412c4b3856a27545d3cd86ae1cd40eae4ffb561278aece101d290 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1dd545aedccd6d9b9889e3746bc774f1 |
| SHA1 | 72cc1c801c6c95893f2348da45c8888b45844869 |
| SHA256 | 9272180f13a1d917c7ff04f2eb04b2864b21f29d470bcb2bad824a61c117c2e3 |
| SHA512 | 4385a9ce19652806c327d17336c987ca5e330f658f3bb33695357ed55679bf65e70b62cfee03d920cc1371c4d521d7a27ac85b45205cfb8bb5d255e1a8d5a231 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 073273942240a54ad62fbe685ee62c5d |
| SHA1 | 30d3994bfceb06cfc95e3484e9e7083fab81dcfe |
| SHA256 | fff5887c6d41b8121d1c57447d43c13cdcae3b37a6219de4793c41a468301689 |
| SHA512 | 05d36f2b8afa177d59590b3e83227f909cab9397bd4584c7bc6ec55ae9925f19834f8dac5590e1df8e4c833c9fb0bd85dfb52c0e22f6acf21a04adf3df4fbddf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | f16aebc91422f72a255db5dde5474db4 |
| SHA1 | f40f971238d4880d9679d34ca51540da31ed5067 |
| SHA256 | c8ba495eb4cec7d3412f2056ff58cccb6907aca90a8aa5f5588d0d86bbc0cb75 |
| SHA512 | aa674b6f2b75cdb1237998ac3792a61904222087dfa8d2051d2ef1e6331e7dc1007079b129ea47cbd20cfb9adfa91d87c91e24e2419ac5773c3b42090cb21644 |